Welcome to “Ask a security trainer,” the column where the Digital Security Training team at Freedom of the Press Foundation (FPF) answers your burning questions at the intersection of journalism and security. Submit yours here! Let’s jump right into this week’s question.
Dear DST,
I’ve been reading a lot about how to protect my data while I’m traveling, and a lot of the advice involves deleting things from my phone. At the same time, I need to be able to access my password manager so that I can access everything else. How can I protect my passwords when I’m away from home? Any advice?
Best,
On The Road Again
Hello On The Road Again,
I’m so glad you’re thinking through this, and that you already use a password manager. (For those who don’t, read all about choosing a password manager!) Protecting your passwords when traveling is one of the steps in our new guide to preparing devices for travel through a U.S. border.
To add to this resource, here are a few ideas for how to avoid toting all of your passwords along with you when you are, well, on the road. Please note that the password manager 1Password has a specific solution to this problem, but if you use a different password manager, preparing for travel will require a little more work.
If you are a 1Password user, Travel Mode is a solid option. When enabled, Travel Mode restricts access to vaults and everything in them. To set this up, you’ll need to log into 1Password on your web browser (be sure to have your account name, password, and the info from your emergency kit readily available). Find Travel Mode by clicking your username in the upper right corner and then selecting Manage Accounts. When ready, be sure to check your phone and/or your computer to make sure Travel Mode was effectively enabled. See 1Password’s guide for more information.
While Travel Mode can certainly be used as an all-or-nothing approach, there are a couple of ways to finesse this setting to maintain access to certain passwords. For one, you can mark vaults as Safe for Travel. All of the passwords in these vaults will remain on your devices while Travel Mode is on, so opt in carefully. For personal accounts, you can also use or create a new Safe for Travel vault, where you can copy passwords that you’ll need on hand. (This option may be restricted on enterprise accounts. If this applies to you, it may be worth checking in with your team to see if there are any currently existing travel policies.)
To toggle Travel Mode off when you safely arrive at your destination, log back into your account via your browser. To do so, you’ll need access as before to your username, the secret key from your emergency kit, and your password. Provided you haven’t deleted the 1Password app from your phone, you can find your key in the app in Settings > Accounts.
If you use another password manager app or you simply prefer an alternative, consider downloading a separate, secondary password management app for the safe storage of credentials you will need on your trip. (Our favorites right now, in addition to 1Password, are BitWarden and, for passwords you prefer to store on your own computer, KeePassXC.) After all, a fair amount of our travel advice overall includes creating travel-only accounts. If you are game, why not apply this principle to password managers as well? That way, you can return to your regularly scheduled password manager when you return home.
This advice applies especially to those who use the built-in password managers in browsers like Chrome or Safari. If you’re in the habit of storing passwords there, it may be prudent to migrate to a password manager. (Here are steps for exporting passwords out of Safari and Chrome.) They are interoperable, after all, and when handled safely, far less vulnerable to being accessed by anyone else who uses your device.
Thanks again for asking!
Safe travels,
Davis Erin Anderson
