TSA Master Keys | Hacker News Reader

TSA Master Keys

schneier.com

299 pointsprivong143 comments

Not only is this another impressive demonstration of incompetence, but by disseminating the idea that people's luggage could be “secure” and “backdoored” at the same time, they're actually destroying what security has existed before. They should pivot to be the “Transport Endangerment Agency”.

Solution: take a gun. Seriously.

In stark contrast with the requirement that TSA be able to open your luggage (unlocked or backdoored), if you declare a firearm in your checked luggage the TSA cannot - by law - have the means to open your [hard-shell] luggage, YOU must retain the key or combination and must be present to open it when inspected.

(Of course, traveling legally with a gun has its own litany of issues, but for those of us who are OK with the basic concept may find doing so helpful against TSA's security theater.)

Many photographers travel with a flare gun or starter pistol in their equipment case specifically for this reason. The $10/hour grunt workers can't get access to your super-expensive equipment if you're transporting a gun and have the case properly secured.

Be sure to read up on the specifics and downsides before doing this... there are still plenty of horror stories (though instead of equipment theft/damage the stories are more about bureaucratic snafus).

It doesn't make your equipment any safer, guns are stolen from US airports all the time:

Although the law requires guns to be carried in locked, hard-sided cases, baggage handlers have no problem getting into such luggage, he said. The other possibility, experts said, is that TSA screeners who X-ray or inspect bags by hand could be pocketing the guns. Source: http://articles.chicagotribune.com/2006-08-14/news/060814020...

It reduces the odds of theft by making it harder to open the case (only the owner unlocks it, no backdoor key), formalizes its inspection (only opened when owner present), and raises the stakes of theft (stealing a camera is one thing, stealing a gun garners much harsher punishment and gets more dedicated authorities involved).

Yes, anything can be stolen (whole luggage even). Put in a real case, with a serious lock, which legally cannot be opened without you, and you've significantly improved the odds of seeing that camera (and "bodyguard" gun) again.

Just because improving the odds didn't reach 0.0 doesn't mean it's 1.0.

Make sure not to fly to New York. They will enforce state firearms laws when you return to the airport and attempt to check your gun.

http://www.nytimes.com/2013/06/10/nyregion/lawful-handguns-d...

As I said, "traveling legally with a gun has its own litany of issues". Guns are legal in all states (NY included), with limitations. A Henry or Marlin Papoose .22LR will break down into a very small package, and are legal in pretty much any state without paperwork.

Could you declare a gun and not carry one? And then claim you forgot it if anyone checks?

Your bag gets hand-inspected by a TSA agent with you present. They'll ensure the weapon is packed securely and that the ammo is in original factory boxes (meets ORM-D requirements). So you can't declare a weapon without actually having one.

Note that "packed securely" can have different meanings at different airports. There isn't a uniform standard or branding on cases that meet airline and TSA requirements for weapon transport. But you'll have the fewest problems with a Pelican that is fully locked.

No. They will make you open the case and show the gun is safe/unloaded. They then affix a tag to the gun, which declares that there is, in fact, a gun in this case (with the tag inside the case, a rather surreal requirement).

Inconsistent. No airport I use regularly does chamber checks anymore, and I routinely fly with handguns and sometimes rifles.

At LAS they don't even do a TSA screen. They put a tag in he bag at gate and just use X-ray on the bags later. They will call you at the terminal over PA if there is an issue.

I concur. I've flown several times per year for the past five years or so, and almost always check at least one firearm. I am asked to open the case about 80% of the time, and I've never been asked to demonstrate that the firearm was unloaded.

Also note that TSA allows you to carry ammunition loaded in a magazine, which may be in the same case as the firearm. I usually check a Glock 31 with three loaded magazines in the case.

No, but you could just carry a starter pistol or flare gun if for whatever reason you couldn't declare a real firearm.

Bring a starter-pistol. They qualify as firearms with regards to TSA regulations, are legal in every state, and are often trivial to bring abroad.

Most luggage isn't really secure in the first place. It takes less time to open up a suitcase with a good knife than it does to unzip many suitcases. The idea that a little padlock will protect your suitcase from thieves is laughable. Like physical mail, the system is based on trust, and trying to patch security onto it is difficult.

Padlocks protect you from baggage handlers getting a little on the side while on the job. If a baggage handler slices your bag open with a knife, that's going to be noticed quickly, and the odds of being caught are high. If the bag is unlocked and he can merely unzip it, pocket something valuable, and replace it, then that may not be discovered for many hours or even days, and the odds of being caught are much lower.

Obviously they don't protect you from someone who simply steals your entire bag, to open it at leisure away from the airport. But something doesn't have to protect against every conceivable threat in order to be useful.

Locks on your luggage is like locks on your front door. A lock on a normal house door is easily defeated with a crow bar or a strong leg. But they're still useful to keep out people who are willing to use the door knob but not actually break down the door.

Padlocks don't prevent this at all. Take a zippered bag (any zippered bag). Jab a ballpoint pen between the zippers, then easily pull them apart with your hands. To re-zip, take the locked-together pair of zips and slide them back and forth from one side of the bag to the other.

This requires no more effort or skill than opening an un-"locked" bag.

> and the odds of being caught are high

I had checks stolen from a carry-on bag at JFK, by a TSA employee, pretty much right under my nose. Some airports have had mafia-run theft rings operate for months or years before getting caught.

Did you discover the theft right away, or only after the fact?

Thankfully I discovered it soon after, since I intended to deposit the checks at an ATM at the airport, and could phone the issuer of the check and have it stopped and reissued. But I was well past the checkpoint by then. I had made sure the checks were in the bag just prior to going through the checkpoint since it occurred to me to use an ATM to deposit them.

Sorry you had to go through that. Anyway, if your bag had been locked and the thief had needed to cut it to get to the checks, he'd probably have been less likely to steal them and more likely to be caught if he had, no?

Sure, but if someone cuts your suitcase open with a knife it'll be much more obvious than if they used the master key to open it and then zipped it shut again.

Maybe if you cut it, but that's not even necessary

https://youtu.be/zMTXzQ0Vqn8?t=106

I've been through the training for airport security officers (not in the US, though) and that's one of the techniques they taught us. Also most baggage locks are ridiculously easy to pick with basic tools (literally a 15-30 minute lesson) even if you don't have the master keys available.

No, for instance anything with a zipper can pretty much be opened with a pen instead of a knife. Just poke through and it will unzip. Depending on the zipper quality you should be able to just rezip it.

If you're stealing from a zip-closed bag, don't bother with a knife -use a ballpoint pen (and then you can do it back up again leaving no obvious evidence) :)

https://www.youtube.com/watch?v=G5mvvZl6pLI

edit: s/suitcase/zip-closed bag/

Well, this is nothing new. Most widely-accessible/affordable physical security is only there to introduce enough of a hindrance so insurance companies will actually pay out if when the worst happens.

You think I'd rather file an insurance claim than prevent my stuff from being taken?

His suggestion about seals is the most valid point. None of the locks are really locks. A TSA compliant lock that records the time when it was opened might be useful, but otherwise a seal provides a lot more value.

The zip tie idea is fine except that my checked bag is the only place I can put something capable of cutting one.

I'd argue the seal provides little value as the TSA will need to break it if they wish to search the luggage. Once the seal is broken, the luggage may be tampered with. Perhaps if the TSA resealed the luggage they searched?

The seal is to detect any tampering. Why should TSA tampering be exempt from this?

I'm saying that if the TSA tampers with your luggage and breaks the seal, it will happen at the beginning of your trip. This allows anyone seeing your luggage after the TSA tampered with it to also tamper with it without you (or the TSA) ever being able to know if an unauthorized individual also tampered with it (since they can effectively piggyback off the TSA's authorization).

That's certainly true. But even if there was a way to detect post-TSA tampering, what useful recourse would one have?

It seems that in either case, checked luggage is at risk of being tampered with, searched, or outright stolen and there is very little we can do about it (aside from filing a claim with the airline and hoping for the best).

I don't disagree with that. I was only responding to the claim:

>otherwise a seal provides a lot more value

Custom print the seal.

http://www.andfel.com/security-seals.html

unfortunately several of these professional seals are only a bit more obscure, but not much harder to open than a zip tie.

Introduction to Tamper Evident Devices from datagram at defcon 19 https://www.youtube.com/watch?v=W07ZpEv9Sog is interesting to watch

I just use boring zip ties that I mark with a sharpie to make them unique (and show if they've been replaced). I'll also toss a handful of unmarked ties onto the "top" of the luggage.

I've occasionally sent a piece of luggage through, and found it re-zip-tied with a new tie, with a TSA love note inside.

> Most luggage isn't really secure in the first place

Nothing is secure, really. I'm continually amazed that people want to see security as a binary thing.

A knife leaves obvious traces. Using a key both avoids making it immediately obvious and adds ambiguity – since most bag theft happens as part of organized rings inside airports, that's significant because it allows the airlines to avoid paying compensation by requiring hard proof that something expensive was actually in the bag when it entered the system and missing before you left.

So use a ballpoint pen on the zipper. You jam it in the nylon teeth so they separate, and you can loot the bag. Afterwards, use the zipper pull to heal the teeth and there's no trace you were in there.

http://www.youtube.com/watch?v=wpIJVWXsBBI

To counter this (and unauthorized use of a TSA key), wrap your bag in industrial cling-wrap plastic.

You should also go right to baggage claim when you land. Most airports don't have someone looking at the bag claim receipts, so thieves can walk right out with a bag.

That's definitely a valid attack on one type of bag but the point stands for everything else: e.g. many people use hard-shell cases for important things, which also radiate “more valuable than socks – steal me”.

In both cases, the problem is the same: the system makes a visible promise of security and has an easy silent failure mode. Getting rid of the TSA “safe” locks or locks at all on zippered bags would improve security by accurately communicating the level risk.

At least then you can claim someone tampered with it. What if they steal your laptop from your baggage. Can you still claim you had it in there? Unless they open it right before the cameras (and they'll know where those are), you won't be able to do that.

Sure you can. I know a few people who lost their luggage - in those situation they just claimed the maximum value the airline would pay, so they suddenly had 5 laptops and jewelry in their luggage. I'm not saying that's a morally right thing to do(it isn't) but the airline will just take your word for it.

I don't know how that worked out for those people but the time that happened to me, the airline most definitely did NOT take your word for it. Their policy, which was standard on most U.S. carriers when I checked at the time, was to reimburse per-pound at a rate set for used clothing. If you wanted any more than that, you had to show purchases receipts to justify the price, which was aggressively appreciated, and they outright excluded anything with a plug so those 5 laptops wouldn't even be paid at the old t-shirt rate.

What about corporate travelers taking prototypes and other sensitive items in pelican cases or similar luggage?

Pelican cases offer durability, not security.

They are way better than anything with a zipper. The best SE on a pelican is to attack the hinge.

never check something valuable

This is seriously the most insightful comment in the entire thread. Stop trying to secure your checked luggage! Just don't check things at all, or at least don't check things that are valuable. I travel pretty often (sometimes 2+ week trips), and I haven't checked a bag (valuable or otherwise) in nearly 10 years.

If you need to transport something valuable that you can't carry on, ship it instead, overnight if necessary. No, that may not be cheap, but if you're that concerned with security, it's probably worth it.

(Not that FedEx/UPS/etc. don't come with their own problems, but I've found them to be pretty reliable over time, and you can insure the item in question.)

I doubt these images really did all that much for people who wanted a set of TSA keys. The locks themselves are widely available and it's easy to reverse engineer a key if you have the lock (especially multiple copies of the lock to destroy and test on).

If anything, this just made it easier for casual lazy people to get a set of images for keys they'll never make :)

It seems like the real value of the picture was that it made it obvious how insecure the system was.

The tiny locks and keys kind of make it obvious that it's not so much insecure as it was never ment to be secure.

Can you reverse engineer a master key from one sample lock though? Genuine question, IDK.

Should be doable as long as you have the non-master key for that lock too. A standard key lock works by having pins which are separated into two pieces. The key lines up the boundaries with the cylinder, which allows the cylinder to turn. Master key systems are typically done by having the pins be separated into three pieces, which allows two positions to turn the cylinder. One position is used by the normal key, and one is used by the master key. Having the normal key will let you figure out which is which, and then you can figure out the master key from that.

The way I understand master keys work is that the lock has two "breaks" in each pin, instead of just one. So each pin has two positions that allow the lock to open, and you don't know which one belongs to the master key.

I think at least two locks would be required, and depending on how many pins and possible positions there are, more might be needed in case of a collision.

I mean a lock comes with 1 key right? If you make a second key that opens it, but shares nothing with the default key - you may have a winner.

Source needed.

Make a working key from scrap metal by reverse engineering a lock

http://www.instructables.com/id/Make-a-working-key-from-scra...

http://www.lockwiki.com/index.php/Impressioning

Seems to still be a lot being done in the name of security theater in the US, and just wasting dollars on the TSA, for what appears to be very little effect.

Who's really profiting there? Is it just for the employment of people that otherwise wouldn't have a job? Or are the majority of citizens there really made to feel more secure by having them? I'd have to say some defense contractor is getting a bit fatter off this.

Seems like a ridiculous waste of money.

https://en.wikipedia.org/wiki/Michael_Chertoff#Body_scanners

"Michael Chertoff has been an advocate of enhanced technologies, such as full body scanners.[25] His lobbying firm Chertoff Group (founded 2009) represents manufacturers of the scanners.[26][27]"

"Michael Chertoff (born November 28, 1953) is an American attorney who was the second United States Secretary of Homeland Security under Presidents George W. Bush and (for one day) Barack Obama, and co-author of the USA PATRIOT Act."

It isn't just a defense contractor, it's the former head of the DHS who implemented these policies and gets kickbacks from body scanner use. He set up the nationwide deployment of the scanners, then profited directly. It's corruption to the extreme.

It's bizarre it can happen. Surely the wheels have to fall off that out of control cart soon.

You'd think, but year after year we get stories like this. Sometimes it catches up with people [1], many times it seems they get away with it [2]. The main difference seems to be how much money they're worth, if they're elected or just "regular" employees, and how good their connections are.

[1] https://en.wikipedia.org/wiki/Darleen_Druyun

[2] http://www.forbes.com/sites/judystone/2015/02/17/the-sham-of... - goes into more, but the relevant part is about 2/3 down. Search for "Rick Scott pushed".

It sucks to watch corruption and violence win the day. We seem to be seeing it. Where an economy can be based on maintaining a military force in other countries, to maintain the petrodollar and central banks. And a lot of good people losing their lives, brought up in the belief, they're helping freedom. What a mindfuck that is.

After a few years people get acclimated and if you dare to criticize the corrutpion you're seen to be evil.

For instance, try telling the average american that the TSA needs to be shut down.

They'll think that they're keeping us safe, the same way people think that police keep us safe, and will think that without obamacare we wouldn't have health insurance, in a few years.

I find the sudden mention of Obamacare rather odd. TSA has done jack all to keep us safe in the decade and a half it's been around. Obamacare, while deeply flawed, has done quite a lot to help people access health care.

> Seems like a ridiculous waste of money.

The people paying for it (US citizens and those who travel into or through the US) would surely see it as a waste. But the people profiting don't, and the people profiting are the same people who make the laws mandating them.

I opt out of the naked scanners every time I fly. Just tell the TSA clown trying to herd you into the naked scanner the magic phrase "I'm opting out." After a 5 minute wait, some other clown will come over and molest you, and then you're free to go.

I do this as a little protest against a system I see as stupid and illegal. If everybody opted out, the system would get so backed up that they would have to change their policies. I'm doing my part, and I encourage you to do yours next time you fly. (Unless you're not white, in which case you should probably just keep your head down :-/ )

I'd do it if I have cause to fly into the States again, but I can't help but think its not really going to help much. From my youthful experiences at being a knob, I'd say don't piss off food makers/deliverers, or airline staff. I once annoyed a Qantas security lady, and I noticed it for a fair few trips afterwards. Then again, with wealthy interests controlling the US, I can't really see what will help at this stage. Its a descent into corruption and mess, but I can't judge how quickly it'll crumble.

You can opt out politely; I do it all the time. Recently, it's been interesting, since I dislocated my shoulder and can't yet lift my arm as high as they want me to. But it still seems to work out.

I always opt out of the "rapey-scan", then smile and groan a little whenever they pat me down. I also travel about 30-40 segments a year, so I get my kicks frequently. It's surprising how often that "TSA Precheck is closed" or the TSA Pre metal detector beeps just for me.

I do the same. Keep up the good fight!

I also opt out every time. At one point the FSM came to me in a dream and told me that I shalt not go through a pornoscanner. And who am I to doubt the word of noodle?

I don't know why you're getting downvoted.

Any religion is as good as the other, and you're just going by what your religion's deity told you. Nothing wrong with that, as far as I can see.

Well, the religion is nonsense. Not that that differentiates itself from others. Love one another, as you would have banks do to you.

The upshot of TSA is that because it's a single government organization, it's easy to identify the costs and quality of operations.

Pre-TSA, we were wasting the same or more amount of money on private contractors of dubious quality. But you didn't really know how much, as the cost was spread across thousands of airline/airport authorities/municipal government combinations.

I would be very surprised if the federalized version wasn't much more expensive -- for one thing, because its centralized its a bigger and more profitable target for vendor lobbying for requirements that necessitate the purchase of particular goods and services (whole body scanners, etc.)

Are you sure it was the same amount of money? Before the TSA, airport security agents were very minimally trained and there were no expensive body scanner machines.

I would not be surprised if the TSA version of airport security cost 10x the previous version.

Don't underestimate the cost of bodyshop-style arrangements. The guy fumbling through your luggage may have been making $8/hour, but the billing for it could have easily been 8-15x the salary.

A good point. It seems to me an increase in people annoying you throughout the flying process is only going to have increased costs, coupled with expensive hardware and presumably billions in software too.

Speaking for Tasmania, there's a desolate looking guy on the Hobart bomb scanner device every time that flags me over. His face says it all, "I know this is a bullshit job, just submit and it will be over with quickly, I collect a paycheck, you feel bad for a little while."

The true cost dwarfs what any budget says - the time that everyone wastes (getting to the airport needlessly early, waiting in line, being molested, missing flights, obessing over packing the "wrong" thing, and inventorying your luggage immediately after landing). When you add this up, how many human lifespans has the TSA killed?

Definitely a way to find a silver lining hehe. Maybe we're getting better at shining a light on things, and they'll crawl back into the slime over a generation or two.

Deleted comment

Naive response on multiple levels. An ad hominem implies that the criticism is superficial or irrelevant to the main issue. Money is the main cause from a realist point of view, not an accessory. Money waiting to be made is the first item in the chain of causation for many (most?) government projects.

The outline: problem in government that can be solved -> contractor group identifies problem -> contractor group contacts their lobbyist -> lobbyist lobbies government at right points -> contractor group gets contract to solve problem for far more $ than the problem is worth (usually) -> lobbyist can now find another job for the contractors as soon as they identify another problem.

Ask qui bono, ruthlessly. Follow the money from branch to root. Do some research on where the money is ending up, and you'll find who set the process in motion via corruption.

On a side note, Americans will never feel safe because there is a pervasive circus of media and behavioral memes which encourage fearfulness and paranoia. Have you ever seen the nightly news? Have you ever talked with a mom? We could be sitting alone in sterile jail cells, and people would still worry that the jail cell being cold might give us pneumonia.

I'm guessing Brazil.

Was it ever possible to have a secure lock held by tens of thousands of people with a secure master key, even if the authentic master keys were never revealed?

This. One thing that kills escrow systems dead is the complacent spread of authority.

You start with critical keys that are closely held. Over time other parties express the need for access ("Okay, if you promise to be good"). Nothing bad happens (that anyone can prove...) so over time more entities are brought into the circle of trust. Eventually the dog-catcher has access to your stuff.

There's no way these keys haven't already broadly leaked (I mean, before these pictures).

Really, it doesn't matter if they've broadly leaked or not -- from very early on in the "TSA must have your keys" period, theft by TSA agents from luggage was a noteworthy problem. The spread of authority may be a problem, but when the original authority isn't trustworthy in the first place, problems start long before any spread.

I admit to thinking more broadly, about key escrow systems in general.

The whole idea of a small set of physical keys and a large number of publically available locks is, of course, utter horse poop.

The logical extension of this "security" and "industry needs to meet law enforcement in the middle" to digital keys is terrifying. And I'm guessing it's how quite a few people think about it in the TSA and other organizations.

I'm asking a different question.

Forget about leaks for a second.

If a mechanical engineer can get their hands on 1,000 sample locks and keys (for instance: by simply buying them) and then imaging them, is it that difficult to reverse engineer the skeleton key system?

Matt Blaze developed a very cool attack against master-key lock systems: http://www.crypto.com/papers/mk.pdf

It requires access to one (non-master) key as well as a lock which is open-able by that key. It also requires being able to generate a modest number of new keys with a key cutter (however significantly fewer than brute forcing the entire space).

IIRC, the attack boils down to: - Start with the known non-master key - Hold all but one of the teeth constant, and try different values of that one tooth until you get a different working key. This other value must be the master key's value. - Repeat until you have the master value for each tooth.

If TSA locks work the same way as the locks described in this paper, a single lock/key seems sufficient to generate the master key.

I recall reading that it really only takes about one (maybe two) regular office keys to create the master key that unlocks them all. There were flaws in that system which made it easier (given only keys), but I would wager it's not too hard to make a master key given a few locks as well.

It's very easy to do actually, you just need one lock actually. It's called key impressioning, and basically you put a blank in a lock, look for the scratches on it, file it down a bit, rinse/repeat.

It shouldn't be quite that easy, because the engineer has locks A, B, and C, and needs to discern from them the skeleton key that unlocks X, which they do not have.

So luggage handlers can open my suitcase, put in some drugs, and at the other end I can get caught for having drugs in my luggage?

They should setup a service where you checkin your luggage, they check it for drugs or illegal stuff, they seal it, and at arrival you get your suitcase with the guarantee that it had no drugs at checkin.

You've just described the conspiracy theory behind the Schapelle Corby drugs case in Australia, who claimed the drugs she'd been caught with in Indonesia must have been planted by a baggage handler:

http://www.theage.com.au/news/National/Bag-handler-theory-ov...

At the time, the case & defence theory was so high profile that Australian airports had a service to seal your luggage in layers of shrink-wrap before your overseas flight, so you could know if your luggage had been tampered with by baggage handlers and prevent it being "Schapelle'd":

https://www.choice.com.au/travel/on-holidays/luggage/article...

As for the TSA locks, the Prestolock TSA Search Alert locks come with a green/red indicator to show if the lock has been opened by a TSA key. Though the TSA tend to leave a notice in your bag as well saying it was opened for inspection.

Yeah, I can't say I had much sympathy for Schapelle:

It was claimed that she was the unwitting victim of a domestic airport transshipping smuggling ring, who would stuff drugs in unwitting passengers bags and pick them up at the other end. Her lawyer later admitted that this theory and the 'evidence' the defense presented around it was his invention, to the point where he was disbarred.

She claimed that she had never been involved with marijuana nor had anyone in her family. Photos and other evidence surfaced showing her smoking, and before and after her trial, family members including her mother were charged with drug offenses, including 'supply' offenses, not just possession.

Photos of her surfaced with known drug dealers and smugglers. The most damaging of these was with a drug smuggler. Schapelle claimed that the photo was from 'years ago' and that she had disavowed contact after learning of his involvement. The Indonesian prosecution showed that the photo was taken at the jail where she was being held pre-trial.

I'm not a smoker, but definitely pro-legalization. But her case was exactly that, full of conspiracy theories that had little to no backing in reality.

I think Bruce Schneier has a term for coming up with theoretical threats and then "fixing" that threat through an elaborate system.

If the authorities want to frame you they don't have to go to so much trouble. The officer just uses the drugs in his pocket. The problem is the laws, clearly.

I assume the goal isn't to frame you, but to smuggle drugs.

Baggage handler/TSA agent at airport #1 opens baggage, places drugs inside, calls baggage hander/TSA agent at airport #2 with luggage brand and traveler name.

When flight arrives, hander #2 intercepts baggage. At this point, they either take the whole suitcase, or remove the drugs and the traveler is none the wiser.

The counter measure to this is loudly speaking out, not other systems. When enough people speak out a system gets a reputation. It is how we understand a country as being corrupt or hostile. If they want to frame you, it is really, really easy. The problem they have is they can only frame a couple dozen people before they lose a huge amount of trust.

Just bring your own drugs. What are the odds of two people putting drugs in the same suitcase?

Them taking out the drugs at arrival would be a better plan I think.

Don't give them anymore business model ideas.

I'm kinda surprised that key number 2 on the imgur mirror is a dimple lock. Those are generally used for more high security things than crap tsa travel locks; they're expensive too. Key 4 doesn't surprise me though.

https://imgur.com/a/JQD7l

Dimple locks are not at all for high-security, they are less common though.

They can easily be defeated with a deep-drilled blank wrapped in aluminum foil.

Many dimple locks can be picked with just some tension on the cylinder and a ball pick. The common cheap Bell brand lock at wal-mart or amazon [1] is easily picked like this. All you do is stick the ball pick in the back of the keyway, apply your tension, and wiggle the pick around the keyway as you pull it out. You might have to insert it a few times, but I've been able to reliably open one of those in about 10 seconds.

1: http://www.amazon.com/Bell-Sports-7015777-CATALYST-U-Lock/dp...

The whole proposition here is ridiculous. "we must assume any adversary can open any TSA "lock""

No shit.

We're not talking about a bank vault here -- it's luggage. Does anyone, anywhere, have any expectation whatsoever that a luggage lock provides meaningful security? I think I opened my mom's luggage lock with my sister's hairpin when I was 6 years old, and I have zero lock picking skills.

The article isn't about the usefulness of TSA's locks, it's an allegory about backdoors, and another humorous take on the TSA's utter incompetence.

http://www.heraldnet.com/article/20141130/NEWS02/141139966 -- third picture in the slide show.

Much higher quality images here: https://imgur.com/a/JQD7l

Workaround: https://www.schneier.com/blog/archives/2006/09/expensive_cam...

It's sad that so many comments concentrate on whether luggage is secure in the first place. Of course it is not. The real issue is that having a backdoor makes a new class of attacks possible. A wilful or accidental leak, for example. Or you can reverse engineer the master key if you have enough locks.

The big impact is that one leak kills the security of all locks (of that type).

I don't think this would necessarily be the case when looking at (publicly) backdoored encryption. Here, you could have an individual backdoor key for each "lock". Of course, the mass storage of backdoor keys make a mass-leak also more probable.

My google-fu is lacking, but recently (last year?) an inmate escaped thanks to their cellmate who was a master jeweler & had a full kit in his cell. A photograph of the guard's keys was smuggled in and the jeweler cut a key for the inmate to escape.

I think this is the story you are talking about: http://www.news.com.au/national/killer-escaped-prison-after-...

> THE design for a key that allowed a convicted killer to escape from a Territory prison was printed on the cover of a booklet given to all inmates, it has been revealed.

Pahahaha. That sounds like something you'd find in an ARG puzzle, but this was a prison. Kinda curious how the other prisoner had jeweler's equipment in his cell, it seems like that could be pretty dangerous. Good behavior?

Most prisons don’t look like it’s shown in movies, but more like http://static.businessinsider.com/image/53862b38ecad041f184e...

It’s also not uncommon for many criminals to be allowed to leave the prison and walk around in the surrounding area to go to stores, etc, unless they are a direct threat.

So, having this equip in the cell is not unusual.

That photo's probably from some German-speaking country. Is it representative of US prison cells?

Reminds me of this story:

Jail keys changed after TV lapse http://news.bbc.co.uk/1/hi/england/london/5145026.stm

The TSA has resulted in millions in stolen items, and not caught a single "terrorist". Its procedures are a joke, it is irradiating everyone, or if they opt out, molesting them, which is a crime in all 50 states... not to mention every single TSA search is a violation of USC 18-242.

The existence of this organization proves that both Bush and Obama and the Democrats and Republican parties are corrupt and irrational... and more interested in their own power than in benefiting the country.

I had a TSA lock and it lasted exactly one trip. They searched the bag (found a note inside) and didn't lock the case back up, I never saw the lock again. Ridiculous.

Hey everyone :)

If someone happens to have questions about these keys, we don't physically have them. But we plan on making our own versions & finding the right blanks. If you think you can help, or want to know more, you can always reach out to myself or @Irongeek_ADC.

If you happen to know Solidworks & how to trace objects, I'd like to really get to know you.

Cheers :)

I usually pay to wrap my luggage with plastic, see www.cnbc.com/2014/04/02/travelers-pay-to-protect-luggage-with-plastic-wrap.html I do it more to protect the suitcase than its content. I think it defeats the purpose of a TSA lock. Is it still allowed in the USA?

I generally use either a pelican case with abloy protec 2 321 or 330 padlocks (essentially the least pickable), or a pacsafe anti theft suitcase with tsa lock and seals. Not perfect, but beyond casual or even local LEO surreptitious entry.

Schneier's post is a re-blog of Nicholas Weaver's original story here:

https://www.lawfareblog.com/tale-three-backdoors

There's a comment in the original post about bags with firearms requiring a non-TSA lock. Has anyone travelled with a firearm as a maneuver to secure their luggage? Seems lengthy, but probably works. I'd imagine you need to check-in in a different area and not the front desk?

Edit: I just watched the YouTube video posted below. Looks like we're just dealing with a flawed system.

I do not fly anywhere without a firearm (save for non-free cities such as SF and NYC).

This method absolutely works.

My luggage is a very large pelican case.

> I'd imagine you need to check-in in a different area and not the front desk?

Yes, and at some airports you get your very own line (which is almost never busy). I've saved multiple hours at certain major airports because of the separate screening procedures/lines.

Most of the time, though, you'll just go to a normal desk, say "I need a firearms declaration," and they'll check you in as-normal, until your bag needs to be screened. At that point, you'll go to another area, unlock the bag for the TSA (if it alarms) and receive a hand-screening.

There was a talk about this by Deviant Ollam at The Last HOPE in NYC in 2008. Mp3 Link: http://www.thelasthope.org/media/audio/64kbps/Packing_and_th...

More info: http://deviating.net/firearms/packing/

Benefits also include having your baggage held by an employee and requiring your ID to reclaim it, which should also reduce baggage theft as well. I've heard of photographers packing their expensive gear with cheap starter guns (used for racing) in order to get this benefit.

Look at this video I made a while back about handgun locks...

https://youtu.be/BjkRVNFkjaw

For luggage it's usually on a zipper with two sliders, which you just pull on the tape to separate, look inside, do whatever you like while in there, and then move the sliders back and forth twice to re-close, so it never really mattered.

I used to buy those TSA approved locks with the master lock. They would just cut them off anyway.

OT but, I wonder what would happen if i had items in my luggage encased in a block of plastic?

spoiler alert: don't check your luggage

Oops

The worst damage an individual can do to the environment, short of starting a tire fire at the dump, is to fly. Save the environment and avoid the TSA, don't fly.

I am pretty sure that in terms of person-miles per gallon flying is comparable to automobiles. Are you referring to some secondary damage that flying causes?

Actually, flying is better than almost all cars sold in the US (except for the VW Up!, which comes close).

An Airbus A380 uses the equivalent energy of 3l gasoline per passenger per 100km. This is a mileage of 80mpg.

Only rail is more efficient.

I remember reading somewhere that rail, and most other mass transit, isn't actually that efficient. The idea being that sure, a bus or train full of people is really efficient, but in order to get all of those people to want to ride it, you have to run a lot of empty or almost-empty vehicles around all the time. Sum up all the trips for the whole system, and it's about the same as an average-ish car.

It obviously depends – in Tokyo, or NYC, you’ll have almost-full trains 24/7. As you obviously use smaller trains at night, and only full trains during rush hour.

Even with busses, most transit authorities have lots of different sizes – from 10 people busses in rural areas at night, to bi-articulated busses for 300 people at rush hour in downtown areas.

If you always try to use the same vehicle, though, yes, you get the same mileage as an average car. You still save space on the roads, though.

http://environment.about.com/od/greenlivingdesign/a/fly_vs_d...

Well next time I'll be sure to drive from Paris to New York. Thanks for the tip.

Nothing would be more efficient than a boat, but that would take a serious level of commitment to the environment.

Reply on news.ycombinator.com