Hacker News Reader

Comment by kevinalexbrown | Hacker News Reader

The first time someone pointed this out, the FBI raided his house[1] and sparked a Senate investigation. This was four years ago. I did this to one of my Southwest tickets recently, though didn't use the forged copy. Honestly, it's like they think HTML is unreadable, or, more likely, that it's security theatre designed to make everyone feel safe. I would be okay with that if it wasn't taken so seriously.

[1] http://arstechnica.com/security/news/2008/06/tsa-defiant-pas...

Edit: The Soghoian blog post about the raid: http://paranoia.dubfire.net/2006/10/fbi-visit-2.html

View on HN

That is hardly the first time someone has pointed this out. Schneier wrote about it in 2003, for example (http://www.schneier.com/crypto-gram-0308.html#6 and in his book from that year), and again several times later (e.g. http://www.schneier.com/blog/archives/2005/02/flying_on_some... http://www.schneier.com/blog/archives/2006/11/forge_your_own... http://www.schneier.com/blog/archives/2011/07/man_flies_with...).

The bug has been closed as WONTFIX by the director of the TSA.

Due to being able to use your mobile phone as a boarding pass, most security checkpoints are acquiring the ability to read the 2d barcode on the boarding pass and display the corresponding name. I've seen security start to use this randomly on paper boarding passes as well.

The barcodes are not encrypted. Generating a modified one would be pretty simple.

http://shaun.net/2011/05/whats-contained-in-a-boarding-pass-...

http://www.flickr.com/photos/kalleboo/6197243200/

[Update: iNate2000 says cell phone ones are signed. That would make modifying it much more difficult. It also implies printed ones are not signed, which makes that form the the attack vector.]

And as we all know, there is no way to generate your own 2d barcodes...

IATA (the International Air Transport Association) requires airlines to digitally sign the data in the 2D barcode, but only when used on the screen of a mobile device.

That won't make a difference until they add the requirement to paper boarding passes (or phase out the paper boarding passes).

And this all begs the question of whether checking IDs does anything for security.

What would you generate a barcode for? It's most likely just the ID of the boarding pass encoded, not all the info.

Nope! The machines at TSA checkpoints aren't connected to a database of any sort. All of the info is encoded in the boarding pass in a PDF417 2D barcode.

If you can read PDF417 (Zebra Crossing, the barcode reader for Android, can do it somewhat unreliably if you make your own build and have a good phone camera - otherwise, there are online services that can extract PDF417 from an image) you can see the info for yourself.

And, more importantly, if you can read PDF417, you can make your own!

To connect those machines to a database would both involve a lot of infrastructure build-out (imagine the chaos if that system went down nationwide!) and a lot of information sharing and standardization between airlines and the government. Signing the barcodes is smart, and is how "mobile boarding passes" work, but because paper passes were standardized so long ago, there's no security in place.

I also suspect the current TSA checkpoint barcode readers aren't smart enough to actually check the signature in a mobile boarding pass, but I don't want to find out myself.

My initial reaction was "wow, good point; there's no way that the government would ever make the airlines buy completely new barcode scanners everywhere, for the simple purpose of improving security checkpoint effectiveness".

But then again, they threw down millions per unit for those back-scatter machines, so all bets are off.....

I'm actually rather surprised the TSA haven't pursued such a project yet - it seems like a perfect opportunity for a politician to give their friend's consulting firm a lot of money.

I'm hoping that the airline industry implementing the smart way to do this (signed information in barcodes) for mobile barcodes means that the eventual rework of paper boarding passes will be intelligent as well, but as you say, all bets really are off...

Scanning the barcode and then doing a lookup of your flight reservation against your ID is far superior than just checking the printed name against your ID.

My opinion of all this security theater is that it is not actually designed to make people feel safe. It is instead that the people at the top know another effort by dedicated attackers willing to die can not be stopped. And I bet that they consider such an attack happening again pretty likely. When it does, the federal government wants a conspicuous example of what they were doing to keep us safe so that the population doesn't riot. From this perspective, the more annoying and egregious the security hassles, the better they are.

I think there are two purposes to the TSA. One is to make people feel safe, as you mentioned. The other is to get people into the habit of having their rights routinely violated by "government agents". It is a form of conditioning, and its pretty effective.

10 year olds at this point have never known a world that was otherwise.

In another 15 years, almost all adults will be completely used to it, and the idea that we don't need the TSA will sound as absurd to them, as to most of us it seems "absurd" that in fact in the past you could fly in the USA while carrying a rifle or shotgun aboard, with ammo. The flight attendants would offer to stow it for you in a coat locker, but otherwise wouldn't bat an eye.

Even today you can fly with firearms (in checked baggage) but a lot of people think that this idea is completely absurd because they've never seen it... and they've been conditioned to being disarmed and the idea that you can't have a gun in an airport. (you walk in and check it at the counter, before going thru security.)

There's another purpose, politicians must be able to stand up (on the TV, press releases etc.) and say they are doing something. Other people/newspapers/tv shows will ask "Why aren't you doing anything about $TOPIC?" ($TOPIC in this case is 'terrorists', and '$NAME doesn't care about terrorists' is not soemthing politicos want to see)

We call this security theater.

If it was theater only for those who want to feel more secure, I'd be less aggravated with it. But my forced participation into such theatrics, such as removing shoes, no water bottles, seems that it will only lead to more annoying machinations in the future. Furthermore, this theater only makes the people we are trying to protect against, more creative.

"Something must be done! This is something!"

> "10 year olds at this point have never known a world that was otherwise."

It takes 2 generations to completely change the nature of a society. As long as those born before 2000 are still around all hope is not lost. Do not give up.

IMO, relevant

One of the best talks I've ever seen http://youtu.be/5gnpCqsXE8g?t=8m40s

In the 1920's my Granny was arrested in Germany when she was a teenager because her father sent her to Berlin from Glasgow without a passport because 'he didn't believe in this modern nonsense'. Even passports are pretty new.

The real concern for the 'no-fly list' or 'terrorist watch list' is that it can, and probably is or will be, used as a general shitlist for dissenters (i.e., anyone who voices a problem with their government). That can transition into generalized free-speech quashing and worse faster than people think.

http://www.aclu.org/technology-and-liberty/watch-lists

I am actually a little bit afraid to fly now because of numerous comments I have made about the US involvement in forcing the Afghani people to produce heroin etc. I expect I may actually be on this "terrorist watch list" just based on my comments online.

kind of like people can never imagine caring for their elders without having Social Security, or having to pay for doctor's care for their elders without Medicare/Medicaid. We just become more and more dependent on the government to supply what used to be the responsibility of each and every individual. And as that happens, our individual freedoms are slowly diminished and extinguished.

Who do you guess is behind the conspiracy?

Reply on news.ycombinator.com