psybin

It's standard. All people who are taken aside by customs in the US are given a standard form which asks for all passwords and keys for all devices they own. This is so they can immediately use the content on them to reject you from the country. It's presented to you in such a way that you are to believe you have no option but to fill out the form. You're offered the ability to talk to your embassy, but are told that is a useless opportunity that won't get you anything of value.

Guess what, absolutely nothing will happen if the border guards do anything wrong. You're the criminal, not them.

> Encrypt them with spacefiller data and start crossing borders, and then refuse to provide passwords and abandon them for sheer amusement.

You don't get that option. The first thing that happens to everybody who is attempting to enter the US and flagged is that they give you a form to write down all keys and passwords you might have, they will then unlock your phone and attempt to find anything that might be used to bar you from entering.

A common method of confirming a profiled person seems to be using the "I have not done illegal drugs" checkbox on the entry documentation, they will find any drug reference on your devices using the passwords they just discovered. If you answer "yes", you're a criminal and you are barred from entry. If you answer "no" and they find any reference to any recreational drug, no matter the context, you just lied to a federal officer and you are barred from entry.

One rejection is enough to ban you for life from ESTA, so for most people entering the US who don't have a temporary working visa, being profiled is the last time you'll ever be able to enter the united states. A woman I was speaking to was bumped back onto their flight for a 3 year old SMS on her phone where a friend asked if she wanted to come over and smoke a joint.

He has a phone number, go call him.

The owner of Cock Mail / cock.li is at least completely realistic with what can be expected from an email provider. Goofy domain names aside, being completely frank about privacy and security realities is what you want.

Can you capture the HTML and any images and rehost it somewhere?

Firewire in most setups allows DMA access to the host, but only to the first 32 bits of RAM. There's tools for unlocking, reading out keys from memory while asleep, all sorts of nasties.

It's a common feature for very high speed writes in hardware, DMA in firewire and thunderbolt is no mistake.

It almost certainly goes through the US no matter what you do. Traffic going anywhere out of my city first drops down to a big peer exchange in the US, then back up into Canada.

No, the rules aren't per interface and there's no authentication of a new network device.

If there's a SMS challenge, process.

If there's a question challenge, process.

If no exceptions were thrown, you're authenticated.

Things get crazier once you have one compromised hole-punched device that is behind your NAT/firewall too. You can end up in a situation where you have a local C2 server on your light bulb, controlling a sub-botnet of your fridge, washing machine, and wifi controlled doorbell. It's not unreasonable to think that this could compromise orders of magnitude more devices than the original botnet itself, considering how many things are just saved by their interface not being routable or accessible from the wider internet.

Something I've wondered is how much of an impact large botnets have on other systems they rely on. If you had a million compromised CPUs in a small geographic area suddenly jump from a low power state into doing a massive amount of work, could it cause localized brown outs? Some napkin math says probably not, but it's not something I've heard considered much before.

Most compromises in things like this are going to be invisible almost by accident. Unless your light bulb is maxing out your upload for extended periods of time, or the police come knocking on your door when your light bulb does something very illegal and very loud, nobody is ever going to notice.

If there's a ROM with non-editable software it will just get instantly compromised as soon as it comes back up. For your standard "internet of things" device there is no room, physically or in the bill of materials, for things like connectors for people to physically deliver updates.