3D reproduction of TSA Master keys (2016) | Hacker News Reader

3D reproduction of TSA Master keys (2016)

github.com

64 pointsjacquesm76 comments

This is why I use a zip-tie. All the "security" of a TSA lock, but also some limited proof that your bag was tampered with (in particular if you use an uncommon color/shade).

PS - Although both are largely security theater, as you can just shove a pen into the zipper.

Use the zip-tie to "anchor" the slider too... that will defeat the pen trick.

Superglue works well too

Nope. Just stick a pen right through the zipper itself.

Don’t need any slider for that attack.

Yes, we're talking about an attack against the zipper (and not the zip tie nor the bag)

The goal here is tamper evidence... sure you can open the bag through the zipper but you won't be able to close the zipper back if you can't move the sliders.

I dunno, I think something like [1] could do a pretty good job of putting the zipper back together and then you would just have to remove the underside component at the very end and then jiggle the existing zippers to hide the fact that it had ever been opened that way.

I suspect there might be even more surreptitious versions of such tools.

[1] https://guide.sportsmansguide.com/tips/camping-101-quick-fix...

Sure you can defeat it using specialized tools... but at that point, you are far from "all I need is a pen" and opportunistic attacks. The tool will have to match the width of the zipper: you'll need a collection or to have done reconnaissance.

At that point, shimming the zip-tie itself is probably easier/faster (and doable without specialized tools).

This is what I do. The key is to use the small size zip ties and leave it little bit loose. Then you open it by putting a hotel pen in the loop and twisting, rather than needing a sharp implement.

IN many parts of Europe, I've seen people shrink wrap their luggage, like so:

https://media-cldnry.s-nbcnews.com/image/upload/t_fit-760w,f...

I think it serves a similar function.

One can easily cut the zip-tie, search and re-zip it again, right?

Yeah, but you can get zip ties that are uniquely numbered and colored. They’re meant to help ensure that cargo shipments get to their destination without being tampered with, which is exactly the kind of threat model we need to use against the TSA.

Yes, those could be faked. But your regular joe TSA agent isn’t going to be able to do that, just like your regular 18 wheeler driver isn’t going to be able to do that.

If you’re dealing with someone that wants to break into your luggage and they can fake the uniquely numbered and colored zip ties, then you’ve got a much higher threat on your hands that you need to deal with in other ways.

> The TSA has issued an official statement making it known that they don't even care that we've done this, as the now-pointless locks affect theft prevention, not airline safety.

Does this imply that the locks are only there to slow down theft by those who officially touch my packages? And, who are those who touch my packages?

Put it in another way, 'you need to buy this protection, because we will steal from you'...

Baggage handlers are not TSA/government employees. They are the ones that the locks "prevent" from stealing your stuff.

> officially touch my packages

I was including all who handle my luggage, including TSA/government employees.

TSA/government employee do steal travelers property regularly. A quick search for 'tsa employee steals' returns nearly a million results.

e.g. https://www.foxnews.com/travel/tsa-employee-caught-stealing-...

I recall somewhere reading about a team taking a 4K video walking past someone with keys on their belt and using photogrammetry to reconstruct 3d printable files of the keys from the visible angles and most of the printed keys worked.

They didn't need to bother. The Washington Post published a perfectly serviceable photography in 2015.

https://theintercept.com/2015/09/16/tsa-doesnt-really-care-l...

Dear god

TSA is not wrong. A luggage lock for most normal types of luggage serves no security purpose. TSA don't actually care, they'll just destroy any real lock.

Is there a viable solution to keeping the locks secure while providing TSA a way to access the bag contents?

The locks must not be compromised. Instead, locks get unique serial numbers. TSA gets portable CNCs specifically designed to make keys, and mills the keys they want by scanning (qr/nfc) the serial no.

I’ve heard traveling with a flare gun checked in your luggage allows for standard lock usage, which will require you be present for bag searches (at lease domestically, US). Not what you are asking for but a cleaver ‘hack’ non the less.

First heard about this at DEFCON at a great presentation titled: Packing and the Friendly Skies. [0]

He makes a great case for keeping your laptop with your gun as the only way to guarantee its physical security.

[0] https://youtu.be/KfqtYfaILHw

I feel like this would go poorly in Europe

Actually, provided you are legally temporarily importing your weapon for something like a sporting event, this happens all the time in (some countries) in Europe.[0][1]

[0] https://www.lufthansa.com/ba/en/sports-baggage [1] https://www.pewpewtactical.com/international-travel-firearms...

You can travel with guns in much of Europe just fine. Also, you can lock with whatever the hell you want in Europe so the whole point is moot.

> you can lock with whatever the hell you want in Europe

But can't they break it off without you present anyway?

They can but the idea is to protect against opportunistic theft by luggage handlers. A broken lock also makes your insurance claim a lot easier.

European's attitude toward basic second amendment rights is weird.

The Royal Family having full gun rooms is ok and a tradition but the blebs even having access to a basic weapon is “problematic”.

European attitude towards guns differs a lot by country. In Czechia for example getting a license is straightforward and lots of people have small firearms. They just don’t fetishize it and brandish it at every opportunity.

Actually, that's an interesting idea for a startup. What if every lock had a serial number (maybe on a scannable QR code?), and the serial number goes through an algorithm and creates a unique key shape from it. That key is provided to the consumer and the TSA can recreate that key by entering said serial number into the proprietary algorithm. You'd need some sort of super-fast-3D printer, but I don't think exceptional accuracy would be necessary.

You could even have the keys printed as the bag is working its way through the chute to the officers.

Better than the current system... (I don't think this solution is perfect, but it's better than either having your lock broken off, or having your lock be vulnerable to one of 7 known TSA keys.)

I bet that you could make a fancy key with retractable teeth that could be set to any lock bitting. Seems likely to be cheaper (and definitely faster) than manufacturing a new key for every lock.

https://www.youtube.com/watch?v=v2K_WgL71Ro doesn't need to be a traditional key, really, if you know the bitting

I'm amazed no one's mentioned blockchain yet, as a solution looking for a problem (and ponzi whale money).

Interesting idea, and even more potentialy practical than you suggest:

>You'd need some sort of super-fast-3D printer

Nah, just a modern electronic key duplicator. You can find a lot of kiosks and such these days that make use of tools like JMA's Multicode electronic key cutting machine [0]. No need for additive manufacturing here, just have a standard blank and very high precision fast subtractive is mature technology. Would not at all be a big deal to just feed an algorithm generated pattern into it instead of having it scan an existing key. In fact, I don't think the algorithm even necessarily needs to be proprietary or secret here? The specific threat scenario in this case involves those with brief access to the luggage between when you drop it off with the airport for flight and when you retrieve it again at arrival. Key cutting machines aren't exactly pocketable, so the fact that theoretically somebody could go to any kiosk or private machine and make copied keys in practice doesn't mean they can bring a machine into the cargo area and make use of it in real time. And with mass variation of keys and no single master, there is no way for an attacker to just have all the keys needed with them. Even the cost doesn't seem like more than a drop in the bucket on the scale of these things.

I don't know if it's actually a significant enough deal to bother with, but if it was this does seem like a potential easy low tech solution.

----

0: http://www.jmausa.com/productosdetalle.aspx?idproducto=157

That’s just a more expensive lock with the same effective security. What attack profile would it protect against?

Any thief who wants to go through the trouble to getting TSA master keys can just as easily cut your uniquely serialized lock, exploit or cut the bag, or walk away with the entire bag.

The security of a luggage lock is provided entirely by deterrence. Even with a TSA lock on your luggage, the weakest security link is not the lock’s core.

I’m honestly shocked that this hadn’t happened years ago.

It has. That repo is over 7 years old.

It has, the link to that repo was posted the first time 5 years ago.

The last commits in the repo are from several years ago.

It happened years ago. The latest meaningful commits where 6 years ago.

Wasn’t aware of that. I guess the headline may need to add the year?

Most of the commits are in fact from about seven years ago.

Not endorsing or excusing the status quo, but these were never serious locks to begin with.

That's true, but it may still serve as a nice allegory of why backdoors are bad.

The alternative is security inspectors physically destroy baggage or we allow any and everything to be checked in to the cargo hold.

Or they search the bags in front of passengers, so passengers can unlock the bags themselves? (just saying there are other alternatives, not just as-is or nothing)

They sure aren't. I've paid for my bag to be cling film wrapped because of how easily locks can be unlocked and it is at least easier to see if my bag has been tampered with (not that the cling wrap is going to prevent it fully but might make my bag a less attractive target for theft, etc).

What prevents someone breaking in and then re-wrapping it?

Lower hanging fruit?

What prevents someone from picking 15 different locks you put on a case?

Baggage handlers at most airports aren't going to riffle through every single case, you're just making it easier for them to choose someone else's case (and potentially saying your case has valuable stuff inside)

I tried it once just out of curiosity.

They wrapped a lot of the stuff around my case, to the point that I spent a few minutes getting it off afterwards. Which I suspect is the point. A lock can be removed in a second. Then just quickly open, scan for anything valuable, close.

Removing the wrapping is a considerable effort, takes time, and leaves a huge heap of plastic that may cause somebody to ask questions.

So at least on the metric of that locks are there just to make your stuff look more bothersome to get into than the next person's, I'd say the plastic does amazingly well.

Here is the LockPickingLawyer's take on this (3:43min): https://www.youtube.com/watch?v=GhESSMvf_to

Hadn't considered the possibility of people using these locks elsewhere.

Besides weapons, are there any frequently stolen, high-value items that people can’t just bring as a carryon? Like most electronics are explicitly banned from the cargo hold due to lithium batteries.

Purses, jewelry, alcohol, clothing - anything of any value is a potential target.

Firearms are required to be locked with a non-TSA lock.

Because of this, it’s a fairly regular thing for photographers to travel with a firearm. Under US law, a “firearm” includes the bare frame for a firearm, so that can be as simple as an inert piece of metal. Doing so means that you can put all your camera gear in a Pelican case, toss in a tiny piece of metal, then lock the case with a key that only you have.

I genuinely love reading about clever and harmless hacks like these that exploit the letter of the law to solve problems that the makers and enforcers of said law probably don't know or care about.

Flare guns are also allowed and treated as firearms, so anyone can go to Walmart or an outdoors store and pick one up without any legal requirements and then use that to improve the security of their luggage. One of the first hits I got searching for this was for people traveling with fursuits worth thousands of dollars.

http://www.fursuit.care/travel/flying-with-a-firearm-in-your...

Also "starter pistols" used during track meets.

Harmless hacks that will require you to spend extra time in the airport security. It's not like you can "just" do this and expect no hassle. You will be called aside for additional screening, etc.

Not really-- this stuff is just declared at the check-in kiosk and becomes part of your checked baggage allowance.

I have not tried it myself, but my understanding is that when you declare this kind of checked luggage that you were automatically redirected for hand searching of your luggage. Since you can place locks that inspectors don't have keys for, they would require you to be present in order for them to be searched.

If you have done this personally and found this not to be the case, I'd find that very interesting. I've known one person that has done this, and what I described is what I was told happened to them.

I’ve traveled pretty extensively with firearms, and it’s almost never an issue. It varies depending on the airport, but I’ve found that it actually makes things quite a bit faster at smaller airports, airports in “red” states, and airports that are typically hunting destinations.”

In fact, I’d say it usually _speeds_ check-in, at least compared to having to check a bag at the counter anyhow.

Depending on airport is so true.

I had a work trip where a coworker was wearing a t-shirt that had a design of a bunch of words in the shape of two revolvers with their barrels crossed. It was a same day round trip, so he received "random" special attention on both legs.

On a different trip, the person sitting next to me told me his story of how the belt he was wearing that had bullet casings (don't know what caliber) that were cut in half and punched into the leather as a design. TSA flagged him, airport police took him into custody, later to be remanded to the sheriff. He spent overnight in sheriff's lockup, brought back to the airport after arraignment, and then told to not ever wear that belt to an aiport again.

Because of these stories, my expectations of having anything firearm related going through an airport as nightmarish. Then you hear of people getting full handguns past TSA. So I don't know what to think honestly

The TSA website makes it pretty clear that ammo and toy guns are prohibited as a carryon. Even though the website doesn’t say so, I think someone could assume this ranges from everything from shell casings to a fake ammo belt.

Also FWIW it seems like red state airports have the most signs warning travelers not to bring guns or ammo through security. I have yet to see this at blue state airports.

> Under US law, a “firearm” includes the bare frame for a firearm

It feels to me that it's serialized part of firearm built in a metallic material. TSA website[1] also distinguishes "firearm" and "firearm parts", the latter of which includes often-controlled gun parts as quoted below.

> Firearms must be unloaded and locked in a hard-sided container and transported as checked baggage only. As defined by 49 CFR 1540.5 a loaded firearm has ... > Firearm parts, including magazines, clips, bolts and firing pins, are prohibited in carry-on baggage, but may be transported in checked baggage.

This might be only relevant to gun nerds, but I think what that "tiny piece of metal" applies to are stripped AR-15 lowers and polymer Sig inner frames. Those two parts are so considered firearm that are practically not much of one.

1: https://www.tsa.gov/travel/transporting-firearms-and-ammunit...

An AR lower is the easiest/cheapest way to go about this, as they can be had for <$50 new. There are several states with restrictions on AR-pattern firearms, though, so I switched to using a Chiappa “Little Badger”: https://www.all4shooters.com/en/Shooting/rifles/Chiappa-Litt...

I've got the "Big Badger" otherwise known as the Chiappa M6. It's a great design.

You can literally scratch a "1" on a piece of steel and register it as a firearm if you want to.

Generally speaking, there’s no such thing as federal “registration”.

The only exceptions that I can think of are NFA items: suppressors, short-barreled rifles and shotguns, etc. You could stamp a serial number on a piece of pipe and register it as a suppressor with a Form 1 - but that would cost you $200 and require that you file a Form 20 every time you travel interstate with it, so that’s not really a reasonable option for this.

In many cases, all you need is the sear mechanism for a firearm — that is the most critical part that needs to be controlled, for without a sear you have no way to fire ammo and everything else is just a hunk of metal.

Just some part that is required to have a serial number on it, really.

You’re using logic, which obviously has no place in the law :)

The term we’re concerned with here is “firearm frame or receiver”, as defined in the Gun Control Act of 1968. Of course, that law didn’t define the term. The ATF did, and that definition is in two places: 27 CFR 478.11 and 27 CFR 479.11. Both are identical, and currently read:

> That part of a firearm which provides housing for the hammer, bolt or breechblock, and firing mechanism, and which is usually threaded at its forward portion to receive the barrel.

https://www.ecfr.gov/current/title-27/chapter-II/subchapter-...

My apologies. I should not have attempted to apply logic to this issue.

Cameras and camera lenses, prototypes, musical instruments, silverware, works of art....be careful whether you are blaming the victim here.

Previously discussed: https://news.ycombinator.com/item?id=10214024

Is this the exact analogy for what happens when companies are required to institute a “backdoor“ for encryption?

Yup, pretty much.

Reply on news.ycombinator.com