Hacker News Reader

Comment by flavor8 | Hacker News Reader

Most luggage isn't really secure in the first place. It takes less time to open up a suitcase with a good knife than it does to unzip many suitcases. The idea that a little padlock will protect your suitcase from thieves is laughable. Like physical mail, the system is based on trust, and trying to patch security onto it is difficult.

View on HN

Padlocks protect you from baggage handlers getting a little on the side while on the job. If a baggage handler slices your bag open with a knife, that's going to be noticed quickly, and the odds of being caught are high. If the bag is unlocked and he can merely unzip it, pocket something valuable, and replace it, then that may not be discovered for many hours or even days, and the odds of being caught are much lower.

Obviously they don't protect you from someone who simply steals your entire bag, to open it at leisure away from the airport. But something doesn't have to protect against every conceivable threat in order to be useful.

Locks on your luggage is like locks on your front door. A lock on a normal house door is easily defeated with a crow bar or a strong leg. But they're still useful to keep out people who are willing to use the door knob but not actually break down the door.

> and the odds of being caught are high

I had checks stolen from a carry-on bag at JFK, by a TSA employee, pretty much right under my nose. Some airports have had mafia-run theft rings operate for months or years before getting caught.

Did you discover the theft right away, or only after the fact?

Thankfully I discovered it soon after, since I intended to deposit the checks at an ATM at the airport, and could phone the issuer of the check and have it stopped and reissued. But I was well past the checkpoint by then. I had made sure the checks were in the bag just prior to going through the checkpoint since it occurred to me to use an ATM to deposit them.

Sorry you had to go through that. Anyway, if your bag had been locked and the thief had needed to cut it to get to the checks, he'd probably have been less likely to steal them and more likely to be caught if he had, no?

Padlocks don't prevent this at all. Take a zippered bag (any zippered bag). Jab a ballpoint pen between the zippers, then easily pull them apart with your hands. To re-zip, take the locked-together pair of zips and slide them back and forth from one side of the bag to the other.

This requires no more effort or skill than opening an un-"locked" bag.

Sure, but if someone cuts your suitcase open with a knife it'll be much more obvious than if they used the master key to open it and then zipped it shut again.

Maybe if you cut it, but that's not even necessary

https://youtu.be/zMTXzQ0Vqn8?t=106

I've been through the training for airport security officers (not in the US, though) and that's one of the techniques they taught us. Also most baggage locks are ridiculously easy to pick with basic tools (literally a 15-30 minute lesson) even if you don't have the master keys available.

No, for instance anything with a zipper can pretty much be opened with a pen instead of a knife. Just poke through and it will unzip. Depending on the zipper quality you should be able to just rezip it.

If you're stealing from a zip-closed bag, don't bother with a knife -use a ballpoint pen (and then you can do it back up again leaving no obvious evidence) :)

https://www.youtube.com/watch?v=G5mvvZl6pLI

edit: s/suitcase/zip-closed bag/

Well, this is nothing new. Most widely-accessible/affordable physical security is only there to introduce enough of a hindrance so insurance companies will actually pay out if when the worst happens.

You think I'd rather file an insurance claim than prevent my stuff from being taken?

His suggestion about seals is the most valid point. None of the locks are really locks. A TSA compliant lock that records the time when it was opened might be useful, but otherwise a seal provides a lot more value.

The zip tie idea is fine except that my checked bag is the only place I can put something capable of cutting one.

I'd argue the seal provides little value as the TSA will need to break it if they wish to search the luggage. Once the seal is broken, the luggage may be tampered with. Perhaps if the TSA resealed the luggage they searched?

The seal is to detect any tampering. Why should TSA tampering be exempt from this?

I'm saying that if the TSA tampers with your luggage and breaks the seal, it will happen at the beginning of your trip. This allows anyone seeing your luggage after the TSA tampered with it to also tamper with it without you (or the TSA) ever being able to know if an unauthorized individual also tampered with it (since they can effectively piggyback off the TSA's authorization).

That's certainly true. But even if there was a way to detect post-TSA tampering, what useful recourse would one have?

It seems that in either case, checked luggage is at risk of being tampered with, searched, or outright stolen and there is very little we can do about it (aside from filing a claim with the airline and hoping for the best).

I don't disagree with that. I was only responding to the claim:

>otherwise a seal provides a lot more value

Custom print the seal.

http://www.andfel.com/security-seals.html

unfortunately several of these professional seals are only a bit more obscure, but not much harder to open than a zip tie.

Introduction to Tamper Evident Devices from datagram at defcon 19 https://www.youtube.com/watch?v=W07ZpEv9Sog is interesting to watch

I just use boring zip ties that I mark with a sharpie to make them unique (and show if they've been replaced). I'll also toss a handful of unmarked ties onto the "top" of the luggage.

I've occasionally sent a piece of luggage through, and found it re-zip-tied with a new tie, with a TSA love note inside.

> Most luggage isn't really secure in the first place

Nothing is secure, really. I'm continually amazed that people want to see security as a binary thing.

A knife leaves obvious traces. Using a key both avoids making it immediately obvious and adds ambiguity – since most bag theft happens as part of organized rings inside airports, that's significant because it allows the airlines to avoid paying compensation by requiring hard proof that something expensive was actually in the bag when it entered the system and missing before you left.

So use a ballpoint pen on the zipper. You jam it in the nylon teeth so they separate, and you can loot the bag. Afterwards, use the zipper pull to heal the teeth and there's no trace you were in there.

http://www.youtube.com/watch?v=wpIJVWXsBBI

To counter this (and unauthorized use of a TSA key), wrap your bag in industrial cling-wrap plastic.

You should also go right to baggage claim when you land. Most airports don't have someone looking at the bag claim receipts, so thieves can walk right out with a bag.

That's definitely a valid attack on one type of bag but the point stands for everything else: e.g. many people use hard-shell cases for important things, which also radiate “more valuable than socks – steal me”.

In both cases, the problem is the same: the system makes a visible promise of security and has an easy silent failure mode. Getting rid of the TSA “safe” locks or locks at all on zippered bags would improve security by accurately communicating the level risk.

At least then you can claim someone tampered with it. What if they steal your laptop from your baggage. Can you still claim you had it in there? Unless they open it right before the cameras (and they'll know where those are), you won't be able to do that.

Sure you can. I know a few people who lost their luggage - in those situation they just claimed the maximum value the airline would pay, so they suddenly had 5 laptops and jewelry in their luggage. I'm not saying that's a morally right thing to do(it isn't) but the airline will just take your word for it.

I don't know how that worked out for those people but the time that happened to me, the airline most definitely did NOT take your word for it. Their policy, which was standard on most U.S. carriers when I checked at the time, was to reimburse per-pound at a rate set for used clothing. If you wanted any more than that, you had to show purchases receipts to justify the price, which was aggressively appreciated, and they outright excluded anything with a plug so those 5 laptops wouldn't even be paid at the old t-shirt rate.

What about corporate travelers taking prototypes and other sensitive items in pelican cases or similar luggage?

Pelican cases offer durability, not security.

They are way better than anything with a zipper. The best SE on a pelican is to attack the hinge.

never check something valuable

This is seriously the most insightful comment in the entire thread. Stop trying to secure your checked luggage! Just don't check things at all, or at least don't check things that are valuable. I travel pretty often (sometimes 2+ week trips), and I haven't checked a bag (valuable or otherwise) in nearly 10 years.

If you need to transport something valuable that you can't carry on, ship it instead, overnight if necessary. No, that may not be cheap, but if you're that concerned with security, it's probably worth it.

(Not that FedEx/UPS/etc. don't come with their own problems, but I've found them to be pretty reliable over time, and you can insure the item in question.)

Reply on news.ycombinator.com