3 ms·

"every nth person" selection is just too predictable. You could try to prevent people shifting in line, but in a crowded airport you will never be able to contr

"every nth person" selection is just too predictable. You could try to prevent people shifting in line, but in a crowded airport you will never be able to control that effectively at current staffing levels. The cost of effectively enforcing that rule would rapidly add up to more than $300k and cause serious inconvenience to travelers.

mikeash 11y ago
Yes, preventing shifting in line doesn't help if your attacker can just count the length of the line before they get in it. You really want a random element. Anyone familiar with Dungeons and Dragons should be able to name the obvious solution there....
- woodman 11y ago
  The uncertainty already inherent to the existing process is high enough in my opinion, either the software or the hand counter would equally meet the real objective here: providing a point to audit for reportable metrics. While a dungeon master presiding over a hopeful throw for critical hits would be a solution, I don't think the TSA wants to make security theater entertaining - it makes the accidental nature of the whole endeavor obvious.
- mfukar 11y ago
  But Mike, what good would Polymorph do in this scenario?
  - mikeash 11y ago
    If you can't figure that out on your own, then you're obviously unqualified to be a TSA officer.
    - mfukar 11y ago
      Haha, bummer.
woodman 11y ago
If they aren't watching the line then they aren't doing it right, inducing a predictable behavior in an adversary is half the point. Remember all the hubbub several years ago around TSA behavioral profiling? I don't think I've ever seen the link drawn in the media, but that was around the time that technical failures were being uncovered in the detectors and scanners. Also, and I'm well aware of the fact that this makes me sound crazy, that is when the TSA employee that checks IDs and marks boarding passes started calling me by my first name. So they're watching the line. Anyway, with the level of uncertainty already high in queue fill rates - I don't think anybody is going to feel confident enough that they'd alter their diabolical plans. Oh and I just remembered something that renders all this pointless, the functionality for randomly alerting is already built into the metal detectors... undoubtedly a contract requirement for a feature that is never used.

mikeash 11y ago

Yes, preventing shifting in line doesn't help if your attacker can just count the length of the line before they get in it. You really want a random element. Anyone familiar with Dungeons and Dragons should be able to name the obvious solution there....

woodman 11y ago
The uncertainty already inherent to the existing process is high enough in my opinion, either the software or the hand counter would equally meet the real objective here: providing a point to audit for reportable metrics. While a dungeon master presiding over a hopeful throw for critical hits would be a solution, I don't think the TSA wants to make security theater entertaining - it makes the accidental nature of the whole endeavor obvious.
mfukar 11y ago
But Mike, what good would Polymorph do in this scenario?
- mikeash 11y ago
  If you can't figure that out on your own, then you're obviously unqualified to be a TSA officer.
  - mfukar 11y ago
    Haha, bummer.

woodman 11y ago

If they aren't watching the line then they aren't doing it right, inducing a predictable behavior in an adversary is half the point. Remember all the hubbub several years ago around TSA behavioral profiling? I don't think I've ever seen the link drawn in the media, but that was around the time that technical failures were being uncovered in the detectors and scanners. Also, and I'm well aware of the fact that this makes me sound crazy, that is when the TSA employee that checks IDs and marks boarding passes started calling me by my first name. So they're watching the line. Anyway, with the level of uncertainty already high in queue fill rates - I don't think anybody is going to feel confident enough that they'd alter their diabolical plans. Oh and I just remembered something that renders all this pointless, the functionality for randomly alerting is already built into the metal detectors... undoubtedly a contract requirement for a feature that is never used.