Hacking Airline Lounges for Free Meals | Hacker News Reader

Hacking Airline Lounges for Free Meals

schneier.com

155 pointsohjeez115 comments

Open articleView on HN

Can people please stop using "hacking" about every little tweak, tip, or technique to gain something?

Complaining about the usage of "hacking" is also very tired.

so where do we go from here?

keep sharing and enjoying content

Hacking complaints - blog post coming up.

If we weren't on a webtube BBS called "Hacker News" I'd be much more likely to agree.

A hack is a novel solution using existing technology outside of its primary intended use case. Even though this is a 'social hack', a hack is nonetheless exactly what this is.

It can be taken too far though. If I go shoplifting am I "hacking the shop"? If my shower breaks and I pour bottled water over myself to clean am I "hacking bottled water"?

Shoplifting can be a bit of an art. I agree with you that the “hacking” thing is overused, but I think it makes sense to call something like booster bags a “hack”, for example. There are lots of “hacks” for shoplifting.

Aren't hackers notorious for being interested in things like lockpicking? And that interest is based on an interest in taking apart a system? Shoplifting has worse consequences than recreational lockpicking, but I could see it having some of the same system deconstruction appeal if approached in the right way (not advocating shoplifting, by the way)

It's a matter of intent, i.e., theft versus exploration.

I completely agree, except I am advocating shoplifting. I also wish there were more hackers who would use their lockpicking skills for more than just recreation. I feel like the idea that “hacking” can only be motivated by pure curiousity, and not by anything political or in any way threatening, is an idea that serves the interests of the people in power. They don't want us to think about or analyse our political situation, or to try to change it; they would rather divert our attention and our abilities towards solving rather pointless puzzles, which at best are inconsequential, or at worst just make them even more money.

Shoplifting is anticipated and not at all novel. It's not out of scope of the shops primary function (one of which is to protect the retailer).

Perhaps 'trick' would be a better term in this airport case. I guess the difference between a trick and a hack is that you can't trick a machine (it does what it's told and doesn't care what your intentions are) but you can certainly trick people (they can be fooled in to misreading your intentions and responding dynamically). Also a trick is usually just about improving device utility rather than re-purposing it.

Is there any technology at work here? How is this not a bad faith scam?

Hacking has unfortunately become a buzzword, and now you can apply it to just about anything to make something stupid sound clever: "Honey, let me hack the light bulb for you". I agree with you, it's plain ridiculous.

"Honey what are you doing with your hand down there?" "It is a growth hack, dear"

I agree that the word is overused. Just like "hacker" is. For instance I don't think half the articles linked here on Hacker News have anything to do with hacking (I'm not saying this is bad), and a lot of them pretend to be by having "hacker" in the title (and this, I think, is bad: no, it's not because you coded that in Ruby or Node.js instead of PHP that your blogging platform is for hackers…).

But clearly "hacking" can be used for things other than computer related stuff, and I feel like calling a clever trick "hacking" is less harmful (well, it's even harmless IMHO). Getting back to your comment, I feel that here it is a valid usage of the word. Take something similar for instance: calling Steal This Book [1] a kind of society hacking cookbook (it is mostly outdated though) feels completely right to me.

Defending the meaning of the word may be important, but wanting to restrain its usage all the time is useless and counterproductive.

[1] https://en.wikipedia.org/wiki/Steal_This_Book

"Hacking headlines for more karma"

I agree - articles like this are saying, "I'm hacking the phone system by checking busy payphones for change," or "I'm hacking my favorite bar by not tipping the waiters, so I save 15%!" It really gives hacking a bad name.

specially when used as a synonym of "defrauding", as in most "growth hacks"

In any airport I frequent, this would not be worth the money. Some garages offer free parking for 30 minutes for pick-ups, but by the time you park, go through security, eat, and return you would owe at least $4. Then there's the time/gas cost of getting to/from the airport. Even if you used public transport it could be expensive, it's like $16 round-trip on BART from SFO to downtown San Francisco.

There are airports that are easier to get to (for example London City Airport that I use often) - though not sure how many airports that conveniently located have good first class lounges. But would definitely make sense if you live near the airport, or work at the airport, or if rather than going just for a meal you use it as office space (go there, eat breakfast, work using their free wifi, lunch, etc.)

It's really not a problem for places with decent public transportation. There are parts of the world where it makes sense to have a monthly or annual pass. I've no idea what it is like in the area where this occurred though.

The Skytrain in Vancouver goes from the downtown to YVR in about 30 minutes. It is possible to go to the airport and back on a $2.75 ticket (on weekends and holidays; the ticket is valid for 90 minutes).

Here in Guatemala you can take public transportation for about 0.125 USD, if you live near to the airport it could be worth the time.

I don't specifically know about Xi'an, but I remember in 2012 subways in Beijing were a flat 2 rmb (about 0.35 USD) and in Shanghai something like 2 to 4 rmb depending on distance. Nanjing was similar, but I don't remember the specifics. So assuming all Chinese cities that have subways charge the same order of magnitude, this loophole would have indeed been valuable.

The city my sister used to live in had a free airport bus. Took you there for free. Might have been run by an airline. Saw many flight attendants utilizing it.

For people that work at airports this could be a very worthwhile hack.

The idea of having to go through security everyday for free meals sounds unpalatable.

Why? You don't need to carry anything and the guards probably know you pretty well by the 100th visit or so.

By the 100th visit they'd get suspicious that you're scoping out the joint for a terrorist act.

Not if you tell them you're just going to eat. Seems like that's pretty easy to confirm. Why be sneaky about it? Obviously nobody at the airline lounge cared that this guy showed up every day, why would the guards care?

Imagine you're a guard there and I drop by every day for a meal. You're wondering if I'm a a terrorist looking for security holes while I eat, and your biggest concern is false negatives: you would hate to rule me out as a threat and then find out I blew up your airport. What questions would you ask me to figure that out?

Hello, do you happen to be one of those y'know... Terrorists?

Can't prove a negative. Next question?

There's a reason you don't often see phrases like, "Can't prove a negative," used by people whose job is to evaluate security risks. The relevant way of approaching problems like these tends to use a lot less Boole and a lot more Bayes.

So, same question, and this time really think about it: you are capable of keeping an eye on a limited number of potential threats, you can never completely disprove that any individual means you harm, but you have to look as carefully as you can at the most plausible threats in the time you have available. How suspicious is my behavior, and what evidence would it take to convince you that my threat is negligible? What about the idea that you might personally be blamed if you cleared me and I later turned out to be a terrorist: does that affect your calculations? If so, is that in the best interests of the airport, or just you personally?

> Not if you tell them you're just going to eat.

That assumes that on-scene guards ask questions of the subject before reporting observed suspicious behavior (which may or may not be the case, and is even less likely the case in the event that the "guards" that observe the behavior are automated face/gait/etc. recognition systems looking for unusual patterns.)

This did not take place in the US.

There are plenty of flying commuters. Don't think this would be a problem.

Some airports have land-side lounges, which would cut down on the hassle.

First Class ticket normally goes through an express and polite service... (maybe even in the US)

Security in other countries is not nearly as painful as in America

This story happened in China. I don't know about China, but maybe their airport security is not as bad as U.S.

Personal story: Bringing liquids to airplanes is not allowed in Iran. I remember on our flight back from Shiraz, we brought about 8 liters of rose water, orange blossom water, etc. with us. The security saw it in the screen and asked what the liquid was. "Herbal water", I said. He nodded and called, "Next". Didn't even open the bottles to make sure.

Also many people bring back several liters of water from the holy Well of Zamzam[1] in their flight back from Mecca. The record I've heard of was 40 liters.

[1] http://en.wikipedia.org/wiki/Zamzam

I've never flown domestically in China, but I remember security being worse than in America. I remember having to take my shoes off before it became standard in America and having to go through security a second time right before getting on the plane where all the drinks I bought after security had to be thrown out.

My anecdotal experience at Guangzhou (2 months ago), flying internationally, was the opposite. Didn't have to remove shoes, didn't have to take my laptop out of my bag. I was going to remove my belt before going through the metal detector but they told me not to, which set off the alarm. All they did was wave a handheld metal detector over my body and then I was through. Didn't get patted down and didn't have to go through a body scanner.

They follow the American protocols, and then some.

Last time I was there, after handing my bags over I got called to the inspector's room. They'd x-rayed my bags and seen a cigarette lighter [1]. I have no idea how they recognized it as such, but they pointed to the area in my bag where it had been seen, and asked me to open the bag and remove it.

On another flight, we were all waiting in line to check-in, but the agents hadn't shown up. Somebody gave up on waiting, and just left their bags sitting in line - this while the recording about unattended bags was playing (yes, they've got that in China, too). It was funny to watch everyone in the line studiously ignoring the unattended bag, for fear that they'd shut down the terminal while calling the bomb squad, and we'd all miss our plane.

[1] I don't smoke, but it's in my first aid kit for sterilizing a needle.

What about domestic flights? Some domestic airports like Melbourne have the lounge outside the checkpoints, and even if they are through them domestic security in Australia is very quick and easy.

it's nothing more than security theater

it gives people the illusion that they're safe even though the actual incident which prompted the creation of the TSA and DHS has been ridiculously under-investigated and official conclusions' are full of holes.

I flew from the airport in question to Shanghai a couple of months ago.

Security wasn't unpleasant, but it took a while, there was a long and slow moving line. We had to discard lighters and show passports, but the latter is par for the course in China. It feels like the Chinese are slightly more overbearing with foreigners, which helps, since there's a huge language barrier.

We where lugging a flight case of cymbals, which got quite a lot of attention and laughter from the operators going through the x-ray.

In SFO, the Delta lounge is outside of security.

This has already been debunked to be false: http://shanghaiist.com/2014/01/29/passenger-with-first-class...

Another interesting story in the comments of that article: https://www.schneier.com/blog/archives/2014/02/hacking_airli...

In comments: https://www.schneier.com/blog/archives/2014/02/hacking_airli...

Good story about buying a suit at 6 am: "Upon exiting customs, I was greeted (by name) by a number of large men holding submachine guns (rare in UK)."

They take it all very seriously!

In January 2004 I took my mum to Disneyland Paris.

Someone had accidentally left their luggage next to the belts below the customs booths.

The airport was shut down and cleared on that level, whilst a brave man with a machete hacked carefully at the bag to discover sausages.

I work in a pretty big GDS/IT company and that wouldn't happen in our systems. Virtually no airline asks for such a retarded business rule, flexible classes allow generally 1 to 5 changes in departure date/time(no questions asked), after that it requires manual intervention on a case by case basis.

In that system, could you not buy a ticket, do 5 changes, then cancel the ticket and rebuy, repeat?

It would be a lot harder to make back the cost of the ticket though.

Since the ticket would be fully refundable, it would just increase the time and hassle involved, not the monetary outlay.

Technically, if it's already ticketed it's a refund, not a cancel (at GDS level at least), but airlines use both the same at marketing level.

You can try that but full refunds are unusual, normally there's a penalty fee. More than for preventing ripping off lounges, it's to prevent third parties from playing tricks on the seats' availability. Maybe it still pays off, have a look!

> full refunds are unusual, normally there's a penalty fee.

At least on United (not too familiar with other airlines' policies), full-fare tickets (Y, J, F) are refundable without a fee. If it was paid on a credit card, they'll typically just reverse the charge.

Probably refundable within 24/48h of the purchase. Many companies do that. Normal penalties apply from then on. So unless you buy your ticket in the last moment, no, it wouldn't work.

Refundable within X hours usually doesn't apply if you book within Y hours of the flight. The US DOT rule is refundable within 24 hours if booked at least 7 days in advance.

No, fully refundable fares are fully refundable at any time up to the flight. That's the whole point of a "fully-refundable" fare; it has no penalties for refunds. This is made pretty clear in the fare rules, and is the basic reason to buy full-fare tickets rather than discount fares (apart from the mileage bonus, I guess).

The 24 hour limit is for refunds on non-refundable fares. Most airlines will still let you cancel any ticket within the first 24 hours, even a discount fare (in the US, the DOT requires this for tickets booked at least 7 days in advance).

I thought the basic reason for full fare tickets was to show economy on your expense report but get an immediate, guaranteed upgrade.

I'm thinking he never changed the actual flight info, he just manually "photoshopped" the data on the ticket. Even with the barcodes, many airports and lounges do not actually check the barcodes, they just visually verify the info.

There was a story a few years back when Delta and some others started doing boarding by zones. People were doing online checking, saving their printable ticket as a PDF or whatever, and editing that file to change the "Zone 4" text/image to "Zone 1", and then getting early boarding.

If you travel with any regularity you soon realize that all these special checks and verifications are pretty weak. Even when you are in a place that DOES use the barcode reader to pull the data, it wouldn't be that hard to hack the barcode. The reader devices appear to be non-networked, so they are just scanning a code and displaying text. I haven't personally tried it, but that kind of "encryption", if there is any, is pretty easy to reverse engineer. You can have multiple data samples (tickets), and you know at least some of the key info contained within (passenger name, flight info, etc.) and you can experiment endlessly until you figure it out.

That could explain why on my last few flights boarding was done according to random-seeming letters. At least you can't guess them that easily.

I think some airlines let you pay for priority boarding.

I don't understand the apparent desire for early boarding. Almost every airport lounge I've been in has been more comfortable than the aircraft. The plane's not going to leave without you. I much prefer sitting in the lounge and wandering on last.

Space for carry-on luggage is limited. If you board last, there is a high possibility that the airline will check-in your carry-on luggage instead. This will cause you a delay since now you need to wait in the baggage claim area after arrival. Had you boarded just 5mins prior, someone else might have to wait 30mins in baggage claim instead of you.

Ever have this happen? It doesn't happen this way.

They have special space for "checked carryon." they ticket it with a special ticket and put it in a SEPARATE part of the plane. When you unload the flight attendants get the "checked carryon" and put it next to the door, then you grab it on your way out.

I sat on the front of a small plane before and there was no space for carryon at all on that seat. There was no seat in front to put it under, and the overheads on that seat had a bunch of flight attendant stuff in them. Being the first on the plane wouldn't have enabled me to avoid the "checked carryon."

I've had to check my bags and go to baggage claim lots of times because I was in a late boarding zone.

This is by no means how it commonly works. Some planes will "gate check" your carryon, but most of the time that last-minute checked luggage gets checked through to your final destination.

And for the other comment above, the plane certainly WILL leave without you.

I travel 60-100K miles per year.

This weekend, my partner had her backpacked gate-checked, but it didn't go to the separate part of the plane. It became checked luggage, which then failed to come off the plane and landed in another airport. Fun times having a carryon lost on you.

Uh, excuse me - what? If the overhead compartments for carry-on baggage is full - you got plenty of space under the seat in front of you.

The only exception is really if you're by the emergency exits - then you're not allowed to have anything that could obstruct or confuse people when they make their way to the emergency exit.

Well, that came out silly in hindsight - of course there are more options than the overhead compartment and under the chair in front of you.

What I was trying to say is that I've found it unusual that I've not been able to put my carry-on baggage under the chair in front of me and I have not noticed the flight crew having to handle any other options than the two above.

Don't use a roller bag -- get one of the many soft-sided bags sized to fit carry-on spaces. Your odds get much, much better.

The only reason I don't like boarding last is that sometimes the overhead storage is so full it can be a pain in the ass to fit my suitcase anywhere near my seat, which not only is a minor annoyance when boarding, but can delay me when getting off (if I have to put it further behind where I sit). Generally I aim to be in the last 3rd of people boarding.

There are also budget airlines that don't offer reserved seating (e.g. EasyJet and Ryanair in Europe - I think, I don't fly these airlines though), so priority boarding on them allows you to chose a seat, or to ensure you sit next to whoever you're traveling with.

Also Southwest in America.

> The plane's not going to leave without you.

I saw at least one case where a checked-in passenger arrived around 7 min before the official departure time (he was in a bar) but the gates were already closed and they didn't let him in.

Airlines in the US close boarding 10min before departure (assuming no delays). Once they close the gate door, they are not allowed to reopen it to allow a passenger through

That's a different situation. Boarding time is often up to half an hour before departure. If you're at the gate but sitting (rather than queuing anxiously or even, as some people do, trying your best to board first for some reason) then they're not going to deny you boarding simply for being one of the last people to board the plane. If there's a gap between the queue ending before you arrive, then you're more likely to be denied boarding.

Boarding first or near the first is much better when you end up with a seat near the back, since it means you can just walk all the way through a mostly empty plane, put your stuff in the empty overhead compartments, and get seated without having to make your way through a narrow corridor filled with other people fiddling with their stuff. If your seat is near the door, then the opposite of this advice holds: be one of the last to enter the plane, and you won't have to get jostled around by everyone else behind you walking by. I think if everyone queued up in this order (furthest from door enter first, closest to door enter last) it would make boarding a lot more efficient.

It does in the USA, even if you have a single ticket that has a connection, said connection will leave without you, even if your bag has already been packed on the connecting flight.

Bruce Schneier has written before on forged boarding passes

https://www.schneier.com/blog/archives/2006/11/forge_your_ow...

https://www.schneier.com/blog/archives/2012/10/hacking_tsa_p...

Someone even created a boarding pass generator to demonstrate their weakness. They promptly got their door busted in by the feds.

> The way to fix it is equally obvious: Verify the accuracy of the boarding passes at the security checkpoints. If passengers had to scan their boarding passes as they went through screening, the computer could verify that the boarding pass already matched to the photo ID also matched the data in the computer. Close the authentication triangle and the vulnerability disappears.

The last time I flew, they scanned my boarding pass at the security checkpoint and made a bunch of random marks all over it. I would be surprised if they accepted your second, unadulterated boarding pass at the gate.

If they used a cryptographic signature, they could detect ticket tampering without networking the barcode readers. I'd be somewhat surprised if they actually did that, but it would make it much harder to forge them.

My recent flights within Europe and to Asia (from Europe) - they've scanned the barcode as well as visually inspected the ticket.

From the guidelines:

> Please submit the original source. If a blog post reports on something they found on another site, submit the latter.

Should this submission be amended to the URL and headline of the original article? http://www.thestar.com.my/News/Nation/2014/01/24/Man-uses-fi...

No, because the comments on Schneiers blog add value that isn't on the original source. Which is why there are now (two even) comments here that link to comments on the linked blog post. Schneier also found the comments on HN helpful, which is why he now links to this HN thread, even though the HN thread just linked his blog.

(Quite the circle by now)

The "hack" I've seen the most frequently is buying a ticket that gets you in the priority lane in addition to a standard ticket so that one can go through minimal security wait times and then cancel the ticket in time for a refund.

Couldn't it get you in trouble? You'd have to check your bags under the standard ticket, but enter security under the premium one, and airport security might realize they have the same person on the flight twice.

I thought that was a classic red flag?

Barring extraordinary circumstances, checking bags while flying is a textbook case of doing it wrong.

Why is that?

Checking bags adds a lot of time to your trip after the plane lands, you have to wait ages in many cases for the ground crews to unload and process your baggage. In addition the size for carry-on luggage is pretty large with a small amount of work you can pretty easily get all you need for a trip into the carry-on baggage.

Except for a few bad days, I generally don't wait long for my checked luggage. It's sometimes already there by the time I make it to the claim area. Finding overhead space can be a hassle and I much prefer boarding and unboarding without dragging a ton of stuff. And carry-on obviously limits the items you can bring along on a plane.

Your arguments are perfectly valid for some, but this is isn't a case of "this method is obviously right".

Your arguments are perfectly valid until the first time you arrive to your business meeting w/o your bags.

> the size for carry-on luggage is pretty large

That's not so true in Europe, where many airlines have a quite strict size and weight limit (e.g. 8kg @ 55cm x 40cm x 20cm)

The size is basically the same everywhere because there's limited difference in the planes. EG American Airlines which I just flew has the limit of 56 x 36 x 23 cm. Big enough for a one week duffel easily.

If there is incliment weather, it prevents you from jumping on available flights and flying standby at will, or changing your travel plans.

Sometimes you can pass people in the standby priority lines if they have bags.

While I mostly agree with you, the restrictions on carry-on liquids makes this very difficult for a lot of people.

Does it count as "extraordinary circumstances" that I carry a Leatherman pretty much everywhere I go? Since we became scared of everything sharper than a thumb, I've had to check a bag if I want to travel with my multitool, which I don't think is terribly unreasonable.

I used to routinely fly with it on my person. I'd take it out of its sheath, put it in the basket for keys and change and such at the metal detector, and hand that to the uniformed agent standing there. I was never once challenged for this, or even looked askance at.

I was unable to get into the US Mint while carrying a Leatherman. That was pretty shitty.

I don't even know where to begin telling you how wrong you are.

While I often just pack a carry-on bag for weekend trips, anything more than 2-3 days I'm checking a bag. I don't have to pay for it, my bags get priority-tagged so I don't have a long wait at the other end, and I've had to reroute due to weather at a connection twice in the past year, both of which I knew about before arriving at the airport.

So of the arguments raised against checking bags in the replies further down, none of them actually apply, and checking a bag means less stuff for me to lug around in the airports.

The choice of whether to check a bag or not is, thus, dependent on the specific passenger, the specifics of their trip, etc., and it is irresponsible and flat-out wrong to suggest otherwise, especially in such a "this is right and everything else is wrong" fashion.

Be sure to read the comment left by "askme" on the linked page. It is a similar story but it actually made me laugh.

Most airline lounges in the U.S. offer free snacks, wine and beer – not meals.

I haven't seen free meals in airline lounges lately either.

Not saying it's the same everywhere but with British Airways you can access a better lounge if you're First Class (not sure if they have meals - maybe someone can confirm that).

Both the Business Class and First Class BA lounges at LHR T5 have meals.

This is not "hacking." This is just scamming.

You could buy a first class ticket and hold on to it for a year, then use the lounges whenever you actually do travel.

It doesn't look like this is possible in the US though. I don't see an airline that offers their lounge just for having a first class ticket. Alaska even requires a ticket for the day you're there.

In the article it says he rescheduled his ticket more than 300 times so he might have just always moved it a day or two and basically flew every day... ;)

Most US airlines don't offer lounge access for domestic first class tickets, but they generally do for international business/first. And sometimes for "premium" transcontinental routes (like JFK-SFO).

Then again, the food in US airline lounges leaves a lot to be desired. The free meal would probably just be cheese and crackers and carrot sticks...

Very true, I can't imagine going thru the effort to do this to get some pre-packaged cheese and Bud Light.

Probably better to just hang out in a hotel lobby which has the same amenities and less hassles.

Once upon a time the lounges in the US had unlimited free drinks. (I don't travel as much now, so I'm not sure any more) It might not be worth the commute to an airport for a mediocre lunch, but for all you can drink?

The real issue is the time involved though. A few hours is worth more than a couple dollars saved.

It wouldn't be worth getting exposure to that level of radiation on a daily basis from the security process

Reply on news.ycombinator.com