9 ms·
3D reproduction of TSA master keys
- ck2 11y agoWell someone's life is about to get "interesting". Hope they do not live in the USA.
- Strom 11y agoAccording to their github profile, they're located in France. If they're a French citizen, then extradition to USA most likely won't happen. [1] Traveling can still get really interesting though. [1] https://en.wikipedia.org/wiki/Extradition#Bars_to_extradition https://en.wikipedia.org/wiki/Extradition#Bars_to_extraditio...
- balabaster 11y agoThis is assuming that they are indeed who their profile suggests and they weren't in a coffee shop with no security cameras that they didn't use an untraceable transport to get to, and didn't used a VPN and TOR on an untraceable computer... or they took their cellphone with them. Of course, they quite probably are and quite probably uploaded it from home... and hoped that any extradition wouldn't get enforced.
- reacweb 11y agoAs far as I understand the law in France (I am french, but not a lawer), providing these files may be slightly reprehensible because it helps to create illegal copies of the keys. But, there is a strong mitigating circumstance in the fact that TSA has been careless with its keys. I think that the author does not risk anything in France. The spirit of the law is very different in US.
- tajen 11y ago...and their camera doesn't contain dead pixels, off-colors, watermark patterns or EXIF serial numbers that ony matches one profile on Facebook.
- bluesign 11y agoThat's a great example for why any kind of 'master key' is dangerous.
- at-fates-hands 11y agoJust a story to support your point. When I was a junior in high school, me and some buddies got into lock picking. Our goal was to be able to break into the school and explore places we weren't supposed to go. We could get in and out and no one would be the wiser. One of my friends figure out the janitors only had two master keys they used for every lock in the school. We were able to steal one, and reproduce it several times for each of the team members and get it returned without them suspecting anything. For two years, we roamed every part of the school and discovered some amazing things about our school that no one would ever know except us. For two years we had a run of the place, then turned them over to another group of incoming students were hackers like us. They did the same thing and it went on for several years and became somewhat of an urban legend. It finally ended when one group used the keys to break in and vandalize the school. Afterwards, the locks were changed, cameras and alarms were put in and all the fun ended. But your point is spot on.
- valdiorn 11y agoTaking bets on when this gets DMCA'd out of existence. Surely the keys are copyrighted? :)
- balabaster 11y agoI'm quite sure enough people have copies of that there's no putting this genie back in the bottle.
- at-fates-hands 11y agoLike a wise man once said, "One does not simply delete something from the internet."
- userbinator 11y agoI have a feeling the Streisand Effect is going to take hold pretty soon.
- tobylane 11y agoThe BluRay master code was too (copyrighted and attempts made to DMCA it).
- pingswept 11y ago"the functional elements of a 3D print can't be copyrighted" http://boingboing.net/2015/03/23/demystifying-copyright-licensi.html http://boingboing.net/2015/03/23/demystifying-copyright-lice...
- Yeri 11y agoIt's been online for a few days: http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-luggage-keys-leaked-photos/ http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-lugga...
- Bluestrike2 11y agoThe article links to the SNEAKEY project, which is pretty impressive. Using a photo taken from 195 feet away, they were able to duplicate phsyical keys by decoding their bitting code from the photo. Never stumbled across this before. http://vision.ucsd.edu/~blaxton/sneakey.html http://vision.ucsd.edu/~blaxton/sneakey.html
- iMark 11y agoWhen I heard about the keys being reproduced from a photo, I assumed that the photo was taken of the keys close up. Under these circumstances, it's an impressive feat.
- Bluestrike2 11y agoThe TSA key photo was taken as a close up; SNEAKEY is something different, but the same end result.
- fit2rule 11y agoSeems to me pretty much any lock can have itself picked. Isn't that the point though? If these are TSA-approved locks, I'm pretty glad they're in-secure, because it'll teach fine lessons about security at a very personal level when its breached. Perfect place to put a security lesson.
- kalleboo 11y agoAny lock with this red logo can be unlocked with that set of keys: http://www.cargogear.com/imagelibrary/images/stclockpackb.jpg http://www.cargogear.com/imagelibrary/images/stclockpackb.jp... This includes for instance pretty much any lock included with or built into luggage from Samsonite etc.
- balabaster 11y agoIn fact, you can do it with just a ballpoint pen: https://www.youtube.com/watch?v=wpIJVWXsBBI https://www.youtube.com/watch?v=wpIJVWXsBBI
- deelowe 11y agoWhile true, this totally misses the point. Also, not all luggage uses zippers (esp. not super thin, cheap ones): https://www.thepurplestore.com/cgi-bin/product_detail.cgi?pstore_id=16417 https://www.thepurplestore.com/cgi-bin/product_detail.cgi?ps...
- ZenoArrow 11y agoI can't say much about other countries, but I do know they're common in the UK. You often see them on combination locks, so that the TSA (or similar) don't need to know the code to open the lock.
- deleted 11y ago[deleted]
- flexd 11y ago
- mcherm 11y agoI will hang onto this and use it as an example of why it "government managed backdoor key escrow" for encryption algorithms is such a bad idea.
- fweespeech 11y agoYep, it is the perfect explanation for why the Government can't be trusted with "master keys" of any kind.
- wnevets 11y agolike the "master keys" for the nuclear arsenal?
- deleted 11y ago[deleted]
- Fargren 11y agoThey are not master keys if they are the only keys and they only open the lock they were built for.
- newjersey 11y agoExactly. This is only a problem if the locks were publicly available which they should be in case of insecure technologies like the clipper chip. I guess the physical equivalent is a knox box as illustrated here https://www.rsaconference.com/writable/presentations/file_upload/exp-w21_exp-w21.pdf https://www.rsaconference.com/writable/presentations/file_up...
- malloci 11y agoBringing up the protection of the nuclear arsenal only enforces the fact that an encryption "master key" controlled by the government isn't such a great idea: http://arstechnica.com/tech-policy/2013/12/launch-code-for-us-nukes-was-00000000-for-20-years/ http://arstechnica.com/tech-policy/2013/12/launch-code-for-u... http://www.nbcnews.com/id/20427730/ns/us_news-military/t/air-force-official-fired-after-nukes-fly-over-us/#.Vfb0Xbfuf1I http://www.nbcnews.com/id/20427730/ns/us_news-military/t/air... http://www.aol.com/article/2014/11/03/2-nuclear-commanders-fired-another-disciplined/20988136/ http://www.aol.com/article/2014/11/03/2-nuclear-commanders-f... http://www.rt.com/usa/usaf-general-drunken-women-moscow-529/ http://www.rt.com/usa/usaf-general-drunken-women-moscow-529/
- flarg 11y agoIn comparison, I recollect patients at a UK secure hospital being able to memorise keys at a single glance and reproduce them from memory - my colleagues had to keep their keys in leather sheaths at all times. Also - https://www.schneier.com/blog/archives/2005/09/shoulder_surfin.html https://www.schneier.com/blog/archives/2005/09/shoulder_surf...
- lawlessone 11y agoCall it what it is , the master keys are a backdoor :-) . This should show people why backdoors are dangerous.
- vermontdevil 11y agoBet you that the officials will double down on this through the judicial system instead of acknowledging the truth about the absurdity of having a 'secured master key'.
- viggity 11y agothese are not keys to get into a secure facility, they're for fucking luggage. a rusty hammer or discount $1 pliers will break these things. Consider me not impressed.
- Uehreka 11y ago> a rusty hammer or discount $1 pliers will break these things. True, but with the master key you could open anyone's luggage, take something out, put something in, or just examine the contents, and then close it up with no evidence that you'd done anything.
- loopbit 11y agoActually, there would be a (very) small piece of evidence. The TSA-approved locks I have to travel to the US have a small red ring. If the lock is opened with a TSA master key, the red ring appears, it has to be opened with its own key for the red thing to disappear. So yeah, you'd know that someone has fiddled with your lock, little more.
- antsar 11y agoSure, and if they actually wanted to be sneaky (to steal something, to plant something, etc) they could just open the zipper with a ballpoint pen as mentioned elsewhere in the comments. That surely won't leave any red rings.
- vortico 11y agoClosing a split zipper is a bit difficult, but you're right. It can be done with more ease than 3D printing a TSA master key.
- mejari 11y agoSimple solution: Travel around until you get your luggage inspected, copy the notification paper they place in your luggage, place copy in any luggage you surreptitiously open, boom: TSA did it, not you.
- TD-Linux 11y agoI printed the TSA007 key yesterday and it easily opened a TSA lock on hand.
- asadotzler 11y agoWhen one can break into most zipping suitcases with a bic pen, rezipping it so you never know I was there, what's the point of a lock?
- PirateDave 11y agoSome locks do have alert features [0] so you should at least know it was opened. It won't stop a thief, but at least it lets you know when someone was looking. That is, if it makes it to your destination :-) [0] http://www.amazon.com/Kolumbo-TSA-Lock-2-pack-BLACK/dp/B010664DDM http://www.amazon.com/Kolumbo-TSA-Lock-2-pack-BLACK/dp/B0106...
- matmann2001 11y agoThe comment above is saying that you can get into luggage without even touching the lock. You just use something like a pen to break the zipper mesh. Sliding the zipper back and forth when you're done will re-zip it.
- Danilka 11y agoAnother example of why HN posting time matters https://news.ycombinator.com/item?id=10200641 https://news.ycombinator.com/item?id=10200641
- dheera 11y agoI feel like what matters more (unfortunately) is that you know a bunch of people who you can get to immediately vote you up. What might be more interesting is if HN used Facebook login and its front page ranking algorithm only counted votes from people outside your friend network.
- Shivetya 11y agoOh please no, do not link it to facebook. If anything, analysis of past voting should give a clue to accounts who game the system.
- DanBC 11y agoHN does have some vote ring detection. I have no idea ho effective it is.
- city41 11y agoAs far as I can tell this is a completely unsolved problem. Reddit has the same issue, and now Super Mario Maker on the Wii U has the same problem. Anytime there's a plethora of content and it relies on user interaction to bubble up, a lot of good content is missed.
- unimpressive 11y agoI'm fairly sure that HN uses lots of manual human monitoring to make sure that good content doesn't slip through the cracks. In fact, most of the secret sauce of HN seems to be real-human intervention along with making that intervention invisible. When the mods boost up a story nobody really notices because it looks like the 'normal' way a story gets boosted. Bans aren't really public or announced, etc. And none of that is criticism, it works really damn well. Moreover, the HN moderation explicitly 'owns' the community in the sense that it's their house and their rules which helps because it doesn't give people a sense of entitlement about representation. (Having some experience with the matter, nothing kills you more dead than people getting entitled and demanding a 'reasonable explanation' for every descision you make. Everybody wants theirs and it means you can't actually take any action to improve things without wading through lots of crap.)
- Hortinstein 11y agowow on a side note. I learn to love Github more and more. Had no idea they have STL viewers built into preview panels. Very Cool
- willtheperson 11y agoIs there such a device that you can put in your luggage that video records the contents and and towards where the person opening it would be standing? Is it illegal to record someone going through your stuff? I mean, if they are just looking through it to ensure the safety of everyone, why can't I ensure the safety of my stuff?
- click170 11y agoBe careful about wires and electronics in your bags. If it looks even the slightest bit suspicious you might find that they've detonated your luggage instead of delivering it. Something like a goPro should be fine though, no visible wires and its one of the most iconic cameras these days.