Access codes for United cockpit doors accidentally posted online | Hacker News Reader

Access codes for United cockpit doors accidentally posted online

techcrunch.com

161 pointsgk167 comments

My first thought was "aren't these rotated often? even just generated for every flight?", but then I rapidly thought about who would need to set them, and I decided it strange that the flight attendant would know the password at all... if the goal is to protect against an attacker, giving the password to anyone outside of the cockpit just makes them a target and a weakness; but once you go that far, I wonder why they need access codes at all?... the pilots should just lock themselves into the cockpit and they need neither a key nor an access code at that point, right? Isn't this needless complexity to have these codes?

Pilots get up to use the lavatory, and are brought food. The code is an authenticated knock, and replaces the speakeasy-style "secret" knocking patterns that were used before 9/11. Someone in the cockpit views the person who entered the code on a CCTV monitor and decides whether or not to buzz the door open. This is a control against someone who knows the code but is under duress. If the pilot inside doesn't explicitly deny the request to enter after some number of seconds, it's automatically granted (useful if the pilot is unconscious, say).

This all came up in the Germanwings pilot suicide. The suicidal pilot waited till the other pilot was outside the cockpit, then repeatedly denied acccess to the cockpit when he entered the code to get back in.

I don't remember even seeing doors that were more than a privacy shield before 9/11. Sometimes it was just a curtain, and sometimes, it stayed opened during flight.

It makes me really sad that young children will never get the experience I had when flying, of going into the cockpit during a flight and looking at all the buttons and talking to the pilot. :(

A child in the cockpit once accidentally disengaged some controls which eventually resulted in a crash that killed all 75 people on board.

https://en.wikipedia.org/wiki/Aeroflot_Flight_593

This is actually an odd case, as it was mainly the result of improper training and different configurations between two planes. In a Boeing plane, autopilot will never disengage without specifically being disengaged. In an Airbus plane, giving a 'harsh' enough input will disengage the autopilot. The pilot here mainly had experience on Boeing, so was not aware of this minor but very important difference.

The Air France flight that crashed into the Ocean by Brazil was also partly the fault of different designs by the two major aircraft manufacturers. In Boeing planes, the input is synced between the pilot and copilot (if one pulls up, the other physically moves as well). In Airbus planes however, the input is merged together instead. If one pilot pulls up, and one is pushing down, nothing really happens.

This ended up partly leading to the crash, as one pilot heard the stall warning and pulled up (causing more speed loss), while the other pilot correctly pushed down. If the inputs were synced, the other pilot likely would have noticed his copilot was making the wrong input.

> In Airbus planes however, the input is merged together instead. If one pilot pulls up, and one is pushing down, nothing really happens.

Which is just crazy! I wonder who the product manager who thought "what should happen if one pilot is pushing on the stick and the other is pulling? I know, just average them and fly straight" was. There are various things you can do in that situation that would kind of make sense (the Boeing design being the best), and that is not one of them.

They might have thought "there is no sensible answer in that case, so just have the behavior be the natural operation of the existing systems as designed" which turned out to be adding the inputs.

Except that there is a sensible answer: you physically force the two controls to synchronize.

Once you settle on a design where the two controls move independently of each other, then yes, there's no sensible answer. But, don't do that.

Even then, anything else would make more sense, for example "the left stick always has priority and the right stick flashes a red 'disabled' light", or anything else.

Agreed. No solution will be good, but there are definitely less-awful ways than averaging the inputs.

I suppose what the Parent was getting at, is that it doesn't make any sense to have two sets of completely disconnected flight controls in the cockpit. That's a lot like having two different mice plugged into your computer at once...

I can't think of a situation that would warrant one flight control being pushed and the other pulled...

Most aircraft have both sets of flight controls physically connected (either via direct links, or actuators driven by flight computers). So if one pilot pulls back, the other set of controls comes back as if it's being pulled on. One of the advantages of this design is both the pilot and copilot can be aware of what the control input is at any given moment.

Or, you know, the captain could have told the co-pilot "I have control" as they are typically trained to do in handling emergency situations!

> The Air France flight

More information for those interested. It's a long read.

> This is actually an odd case, as it was mainly the result of improper training and different configurations between two planes.

That might be the case, but I would rather not be on a plane where children are allowed inside the cockpit. Parents can visit an aviation museum if they want to.

> One of the children had unknowingly disengaged the A310 autopilot's control over the aircraft's ailerons while seated at the controls. [...] With the autopilot active, Kudrinsky, against regulations, let the children sit at the controls

I remember visiting the cockpit pre-9/11 and it did not include being invited to sit at the controls. Or, in other words, children visiting the cockpit was probably more the proximate cause than the root cause.

The child sitting at the controls was the pilots child, that's the reason for the increased (but certainly unacceptable) access.

There is a difference between letting a child in the cockpit and having him sit in the pilot seat, as it was the case in the Aeroflot Flight 593 crash.

That transcript is harrowing.

Seems kind of similar to the plot of the Grisham novel Airframe.

s/Grisham/Crichton

Well, not just as a kid for me. One pilot showed me just how much work the autopilot did by turning it off and turning our glassy-smooth commuter jet ride into a bumpy and alarming one. I hope the other 150 people in the cabin didn't get as worried as I did!

One of my fondest childhood memories was nearly crashing a three story ferry into the side of a canal after the captain let us hold the wheel. He very quickly took over and I doubt we were ever in danger, but I can definitely understand a reluctance to let kids even stand close to the cockpit controls. It's all wholesome until an engine shuts down!

A couple of times in the 1990s I 'drove' a steam locomotive [1], with coaches, on the tourist railway not too far from where we lived.

I was about 9 or 10, and was only just strong enough to push or pull the regulator (controls how much steam is allowed into the piston). The driver explained the important gauges, like the boiler water level and pressure, and showed the tiny view ahead which he had to use to look at signals. And the shelf above the firebox, which could be used to keep tea warm.

[1] One of these: https://en.wikipedia.org/wiki/SR_V_Schools_class

For some children, a brief moment in the airplane, locomotive, boat, whatever, cockpit can be enough to inspire dreams and future aspirations.

It needs to be done safely of course, but as a child, seeing into the airplane cockpit was my favorite part of the trip. All the buttons and switches, and the uniforms the pilots wore... it all dazzled me as a young child. To this day, I still desire to fly an airplane...

I completely agree and I'm grateful I had so many similar opportunities. As a child I had been in airline cockpits and at the controls of a few boats (my father worked in marine operations) and I can definitely associate those experiences to my love for systems and technology. Especially systems with switches!

Unfortunately the systems I work with only have switches written in code. Perhaps I should rig the deploy process up to a sturdy industrial switch panel for fun.

It's nowhere near the same, but I remember being a little kid back in '96 (maybe '97, I'd have to call up my mom and ask) and getting to ride up front with the monorail pilot at Disney World.

Anyhow, kids aren't the only danger in the cockpit. Around the same time, I rode in a Bell helicopter with family members during a local festival. An older cousin in his 60s at the time sat up front with the pilot. Trying to "get comfortable," he'd slammed his foot against one of the pedals and managed to bump the cyclic in his surprise. Needless to say, the pilot wasn't very happy once we landed.

Shouldn't the pilot have instructed him to keep his feet off the pedals before takeoff? Seriously, a minute going over safety procedures with a neophyte and nothing would have happened.

I'd assume he did, because it's kind of an obvious thing in hindsight. But I was pretty young at the time, so I don't really have a clue beyond what stuck in my memories.

Eh, it's not that bad, just do it before or after the flight.

Source: Did it as a child twice

Wait how would this stop a pilot doing what he did in the case of the Germanwings pilot suicide? Are you saying it came up during the investigation/coverage or were you saying that it as fixed as a result of this.

The "fix" for the issues that the Germanwings tragedy laid bare was a "2-person policy": if one of the pilots has to leave the cockpit, another member of the crew will take their place. But this introduced new problems, e.g. the time that the cockpit door needed to be open increased considerably, creating new opportunities for forcibly entering the cockpit. Many airlines are in the process of rolling back this policy.

http://onemileatatime.boardingarea.com/2017/04/30/two-person...

By way of background, US airlines apparently always had the 2-person policy (after 9/11). But the reason was, from what I understand, that one person had to get up to the door to look through a peephole to authenticate the pilot requesting access back in.

European airlines, by contrast, had a monitor in view of the pilots, so they could authenticate visually from their seat.

In the wake of the GermanWings tragedy, they were chastised for not having the 2-person policy, introduced it (partially under the pressure of media and the public, in my opinion, and because "you've gotta do someting!!!1!!"), and now, as this has faded from public attention, they revert to their original (entirely sensible) policy.

In US carriers, if a pilot leaves the flight deck, someone else in the crew needs to enter the cockpit.

How does that help? What will a flight attendant do if a pilot is hell-bent on flying into the ground? I'm not sure the second pilot could do much either.

Open the door.

Though a suicidal pilot can still bring the plane down, for example by repeatedly fully kicking the rudder back and forth at high speed.

https://en.wikipedia.org/wiki/American_Airlines_Flight_587

My point was that when the plane is pointed at the ground, that won't help.

Pick up the fire axe that is also typically present in the cockpit and kill the person flying the plane. Then open the door.

seems like a potential suicidal pilot would have quite a chance to get the drop on the flight attendant...

It takes a quite long time to get a big plane "pointed at the ground". It's also impossible to get a plane literally pointed at the ground without breaking it, and most planes can not maneuver enough to get there.

In high altitudes, there's plenty of time to open the door, immobilize a rouge pilot and fix things.

> The code is an authenticated knock

Many aircraft have actual keypads on the cockpit door. That's what was leaked in this case.

Edit: Yes...I was thrown off by the context of knock. Thanks for the clarification.

Entering the key on the keypad is the "knock". The pilot is only alerted that there is someone outside if you enter the correct code. They then verify using either CCTV or the peephole. If you just physically knock on the door then the pilot will be suspicious.

So the confusion here is about the term 'knock.' In this context I believe it's being used to indicate the nature of the mechanism of entry.

It's a 'knock' because the entry of the code is used to indicate to the people in the cockpit that someone outside wishes to enter. It is the people inside who can then decide if the person is allowed entry or not, even if the code is entered correctly.

So in that way it's similar to knocking on a door, just one that is authenticated with a code.

It's troubling that airlines require reliability redundancies in order to maintain safety. The reinforced cockpit doors were good solution, and then...Germanwings happened. Wow. I just don't know if I even want to fly commercial anymore.

How are you going to travel otherwise? It's not like private or commercial non-line aviation is any safer, nor are other forms of transport.

Realistically the risks here are so low, that you're really unlikely to be affected. There's a lot of risks you're frequently exposed to, that are higher.

How are you going to travel otherwise?

https://www.youtube.com/watch?v=8QTq-HEEnn4

"The Obvious Solution To the Airline Problem (United Airlines)"

Lets talk about your drive to the airport...

That seems like an excessive response to arguably the least dangerous mode of transportation humans have come up with. Safer than driving, bicycling, walking on the street. I wouldn't be surprised if it as safer than pushing your computer chair from one side of the office to the other.

There may be a situation where both pilots are unable to fly the plane and need help or first aid e.g.

https://en.wikipedia.org/wiki/Helios_Airways_Flight_522

> At 11:49, flight attendant Andreas Prodromou entered the cockpit and sat down in the captain's seat, having remained conscious by using a portable oxygen supply. Prodromou held a UK Commercial Pilot License, but was not qualified to fly the Boeing 737. Crash investigators concluded that Prodromou's experience was insufficient for him to gain control of the aircraft under the circumstances. Prodromou waved at the F16s very briefly, but almost as soon as he entered the cockpit, the left engine flamed out due to fuel exhaustion and the plane left the holding pattern and started to descend. Ten minutes after the loss of power from the left engine, the right engine also flamed out, and just before 12:04 the aircraft crashed into hills near Grammatiko. There were no survivors.

and Trans American Flight 209

I sometimes wonder whether the "best" way to solve this is to enable cockpit access by democratic vote of the pax, with buttons at every seat that allow for secret voting (i.e. hidden from view). Like with BitCoin, terrorists would have to control a majority of the seats then to gain illegitimate access, while in a case like the suicidal GermanWings pilot the pax would let the legitimate captain in.

Let's take it one step further and let the passengers directly control the plane in this way. Then you wouldn't have to worry about pilots at all. Twitch Plays United Airlines.

So every time a pilot wants to use the restroom and return, he has to wake up the whole plane and ask them to vote him in? I feel like your proposal addresses the one-in-a-billion case and doesn't think at all about the multiple-times-per-flight case.

Nope, this would be invoked only after a standard access request has been denied from the cockpit.

An emergency, real or supposed, is about the worst case scenario for democratic voting.

Generally agreed, which is why I support the fairly wide authority a captain has.

But the existing solutions might fail, as in the Germanwings case. As a passenger, you definitely have a stake in the safe landing of the plane.

Just to be clear, I'm not advocating this as a realistic proposal. I'm just saying that it might have addressed the Germanwings (and possibly MH 370) case, without lending itself to compromise as in 9/11.

Might help with the suicidal pilot problem, but not with hijacking, which is more common. They can threaten all the passengers to vote 'yes' to let them into the cockpit

They cannot see who votes what though. They could threaten to kill one after the other, unless they're let in. Question is who is more susceptible to this threat, pilots or pax.

Would be worse than the current situation?

Sometimes allowing pilots to close them self inside a cockpit could end up badly https://en.wikipedia.org/wiki/Germanwings_Flight_9525

I wonder if inputting the code is a recorded data point in the back box, rather than relying on a voice recording from the flight deck?

Well it has happened where a pilot committed suicide by crashing the plane. Ugh, I think, I hope that wasn't a movie.

This doesn't seem as bad as when the TSA published pictures of their master keys - it sounds like the codes have already been changed & the pilots still have to do visual confirmation even if a correct code was used.

The endless struggle between convenience and security continues. Considering the statistics I actually think the airline industry and its associated governing bodies have accomplished an incredible feat of balancing these two sides of the seesaw. It can be a hassle flying, but there are 895 million passenger trips per year in the US (stat from 2015) and the last fatal US passenger airliner accident was in 2009!

I'd worry much more about new regulations pushing large quantities of Li-Ion batteries into airplane holds than about these cabin access codes being published.

>and the last fatal US passenger airliner accident was in 2009!

Asiana flight 214 (San Francisco crash with the fake names announced by a major news outlet) was in 2013.

https://en.m.wikipedia.org/wiki/Asiana_Airlines_Flight_214

<pedant>Asiana isn't an American airline</pedant>

Either way, the main point still holds - the American airline industry, along with its foreign counterparts in Europe and Asian, do an amazing job keeping the flying public safe.

It really is amazing that we can go years between fatalities.

To put it in perspective, air travel in the US involves about 10% of the passenger-miles of road travel. If air travel had a similar fatality rate as road travel, then we'd see 3,000-4,000 fatalities per year from airliner crashes, in the US alone.

Sorry, I misread it as last airline crash in the US.

Reply on news.ycombinator.com