Why we should not know our own passwords

March 10, 2017 by Megan Squire, The Conversation
What if even you didn’t know your own password? Credit: shutterstock.com

Since 2009, U.S. Customs and Border Protection agents have been allowed to search electronic devices carried by citizens or noncitizens as they cross the border into the United States from other countries. More recently, Homeland Security Secretary John Kelly suggested this digital vetting should also include harvesting social media passwords. Kelly's proposal prompted legal and technology experts to respond with an open letter expressing deep concern about any policy that demands that individuals violate the "first rule of online security": Do not share your passwords.

Travelers themselves responded, too, looking for ways to avoid surrendering their device passwords to federal agents. One approach – what we might call the "Nothing To See Here" method – tries to make a device unsearchable by erasing the hard drive before travel, uninstalling social media apps, letting the device's battery charge run out or even wiping the device if an emergency or "duress" password was entered.

The "I'd Love To Comply, But I Can't" approach involves exotic solutions like installing two-factor authentication on the device or social media account, and then making the second factor (such as a passcode or digital key) available only in a remote location. Retrieving the second factor would require a warrant and travel outside the border crossing.

These methods are dangerous because they put an already stressed traveler in the position of defying law enforcement at the border, a legal environment that is designed to support the government and not the traveler. Following this advice properly also requires careful execution of technical skills that most travelers don't have. And the degree of advance planning and preparation required might itself be considered a sign of suspicious activity requiring deeper scrutiny by border officials.

But it's tempting to wonder: Could computer scientists and software designers like me create a better password system? Can we make "I'd Love To Comply, But I Can't" the only possible answer for every traveler? In short, can we create passwords even their owners don't know?

The search for the unknowable password

Developing unknowable passwords is an active area of security research. In 2012, a team from Stanford University, Northwestern University and the SRI research center developed a scheme for using a computer game similar to "Guitar Hero" to train the subconscious brain to learn a series of keystrokes. When a musician memorizes how to play a piece of music, she doesn't need to think about each note or sequence. It becomes an ingrained, trained reaction usable as a password but nearly impossible even for the musician to spell out note by note, or for the user to disclose letter by letter.

In addition, the system is designed so that even if the password is discovered, the attacker is unable to enter the keystrokes with the same fluidity as the trained user. The combination of keystrokes and ease of performance uniquely ties the password to the user, while freeing the user from having to remember anything consciously.

Unfortunately, in our border travel scenario, the agent could demand that the traveler unlock the device or application using the subconscious password.

A team at California State Polytechnic University, Pomona, proposed a different solution in 2016. Their solution, called Chill-Pass, measures an individual's unique brain chemistry response while listening to her choice of relaxing music. This biometric reaction becomes part of the user's log-in process. If a user is under duress, she will be unable to relax enough to match her previously measured "chill" state, and the log-in will fail.

It is unclear whether CBP agents would be able to defeat a system like Chill-Pass by providing travelers with, say, massage chairs and spa treatments. Even so, the stresses of daily life would make it impractical to use this kind of password regularly. A relaxation-based system would be most useful for people undertaking high-stakes missions where they fear coercion.

And just like with other plans to make CBP scrutiny impossible, this might end up attracting more attention to a traveler, rather than encouraging officers to give up and move on to the next person.

Can you score security?

In 2015, Google announced Project Abacus, another solution to the "I'd Love To Comply, But I Can't" problem. It replaces the traditional password with a "Trust Score," a proprietary cocktail of characteristics that Google has determined can identify you. The score includes biometric factors like your typing patterns, walking speed, voice patterns and facial expressions. And it can include your location and other unspecified elements.

The Trust Score calculator constantly runs in the background of a smartphone or other device, updating itself with new information and recalculating the score throughout the day. If the Trust Score falls below a certain threshold, say by observing a strange typing pattern or an unfamiliar location, the system will require the user to enter additional authentication credentials.

It's unclear how a Trust Score authentication might affect a border search. A CBP agent could still demand that a traveler unlock the device and its apps. But if the agency couldn't disable the Trust Score system, the phone's owner would have to be allowed to hold the device and use it throughout the agent's inspection. If someone else tried to use it, the constantly recalculated Trust Score could fall, locking out an investigator.

That process would at least ensure a phone's owner knew what information federal agents were collecting from the phone. That hasn't been possible for some arriving travelers, including U.S. citizens and even government employees.

But the Trust Score system puts a lot of control in the hands of Google, a for-profit corporation that could decide – or could be compelled – to provide government with a way around it.

So now what?

None of these technological solutions to the problem is perfect, and none of them is commercially available today. Until research, industry and innovation come up with better ones, what's a digital age traveler to do?

First, do not lie to a federal agent. That's a felony and will definitely attract more unwanted attention from investigators.

Next, determine how much inconvenience you are willing to tolerate in order to remain silent or to refuse to comply. Noncompliance will have a cost: Your devices could be seized and your travel could be seriously disrupted.

Either way, if and when you are asked for your handles or passwords, or to unlock your devices, pay attention and remember as many details as you can. Then, if you wish, alert a digital civil liberties group that this happened. The Electronic Frontier Foundation has a web page with instructions for how to report a device search at the border.

If you think that sensitive materials might have been compromised in the search, notify family, friends and colleagues who might be affected. And – until we figure out a better way – change your passwords.

Explore further: How to protect your private data when you travel to the United States

Related Stories

Google eyes shift from passwords sooner than you may think

May 29, 2016

Is this a dream or an answer to yours? Is Google really set to kill the password on Android—in 2016? Wait, that is this year. The headlines are not a dream. Google is to ditch passwords in favor of a biometrics means for ...

Electronic media searches at border crossings raise worry

February 18, 2017

Watchdog groups that keep tabs on digital privacy rights are concerned that U.S. Customs and Border Protection agents are searching the phones and other digital devices of international travelers at border checkpoints in ...

Dashlane, Google in open source password manager project

August 7, 2016

(Tech Xplore)—PC and tablet warriors who must access files and applications for work and for play tolerate their password rituals whether dozens or more times a day. Painful as entering passwords may be—forgetting some ...

Amazon orders reset for some customers' passwords

November 25, 2015

Amazon.com has required an undisclosed number of customers to reset passwords to their online accounts after the company said some passwords "may have been improperly stored" on devices.

Recommended for you

Researchers find tweeting in cities lower than expected

February 20, 2018

Studying data from Twitter, University of Illinois researchers found that less people tweet per capita from larger cities than in smaller ones, indicating an unexpected trend that has implications in understanding urban pace ...

Augmented reality takes 3-D printing to next level

February 20, 2018

Cornell researchers are taking 3-D printing and 3-D modeling to a new level by using augmented reality (AR) to allow designers to design in physical space while a robotic arm rapidly prints the work.


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.