13 ms·
Security experts have cloned all seven TSA master keys
- vegardx 10y agoPut your luggage in a Pelican-case and use some relatively hard to pick, but easy to cut locks. Should they want to open it they will just cut the locks. Alternatively you can use a TSA approved lock and some zip ties as a simple tamper evident seal.
- 15155 10y agoAlternatively, you can put your luggage entirely in a Pelican case, stick a firearm or equivalent (starter pistol, flare gun, AR-15 lower, etc.) in there, declare it, have the luggage inspected, and then use ASSA Abloy locks and fly with absolutely zero worries that someone will pilfer your valuables.
- brokenmachine 10y agoAs an Australian I find it slightly amusing that people are suggesting packing guns in their luggage in order to prevent (what are meant to be) "the good guys" from stealing stuff from it. "For security", we need more guns flying round everywhere.
- rhino369 10y agoEven a shitty bolt cutter would work on these locks right?
- dmoy 10y agoThe ones that came with my luggage didn't even need a bolt cutter. The interior dull cutting edge on a pair of needlenose pliers worked on them :\
- peterwwillis 10y agoA shim might work too.
- koenigdavidmj 10y agoThe purpose of most locks of this size is to make it visible if somebody broke it, and conspicuous to perform the act of breaking the lock. Sort of like a bike lock: the purpose is not to make it impossible to steal; that's impossible to do with anything lightweight. The purpose is to make it impossible with anything less noisy than an angle grinder. In this case, the greatest threat is still the TSA agent or hotel maid entering your room, since you shouldn't be leaving your bag unattended with anyone else.
- alistairSH 10y agoYup. And suitcase zippers can be pried apart and put back together without any trouble[1], so the locks are pointless for actual security. I use them, but only for some protection from pickpockets, not for securing the suitcase while it's in the airline's hands. [1] https://www.youtube.com/watch?v=jW8SJZBVR9s https://www.youtube.com/watch?v=jW8SJZBVR9s
- williamscales 10y agoMost of these locks are attached to zipper pulls that you could just rip off with your hands.
- pwg 10y agoYes. But that's not the _point_ of the locks. The point is to keep the 'honest' baggage handlers honest by putting a small hurdle between them and freely rifling through one's bag looking for something of value to snag.
- vacri 10y agohttp://www.smh.com.au/news/National/A-baggage-handler-took-my-camel-suit/2005/04/07/1112815671754.html http://www.smh.com.au/news/National/A-baggage-handler-took-m... Trust baggage handlers about as far as you can throw them.
- tuna-piano 10y agoCan anyone think of any ways where it would be possible to have the benefits the TSA was hoping for (cheap locks that can be opened by TSA and the owner but no one else)? Because I can't seem to think of any.
- x1798DE 10y agoNo, this is the same problem as key escrow.
- halomru 10y agoThat depends on what you are trying to achieve with the locks? I think most cases where the lock would be actually useful could be covered with tamper-evident stickers. (You seal the zippers, TSA reseals with their own stickers)
- Spooky23 10y agoThey prevent casual theft and tampering, and do so well. Everyone loves to bust on the TSA, but small controls can add up. If you live in a home without barred windows and a reinforced door and locks, anyone can enter your home in seconds. Yet we still lock our doors, and they are still effective. The only purpose of the TSA key is to facilitate searches without damaging the lock or bag. That's it.
- douche 10y agoMy position on this has always been that, if somebody wants badly enough to steal my shit, they are going to. The only thing that locking doors is going to do is ensure that, not only is all of my shit stolen, but I have a kicked-in, busted, door to fix to boot.
- Spooky23 10y agoI grew up in a small town and felt the same way. But punks are savvy, and in some cases, which they are well aware of, criminal charges for stealing when a door is open are much less. So I lock my door, especially car doors, and I don't have problems anymore :)
- williamscales 10y agoThere's no point using a lock on a zipper. You can just shove a ball point pen in between the zipper teeth and open the zipper itself. Then when you're done just rezip it with the still locked zipper pulls.
- Sidnicious 10y agoDefinitely, but according to one of the linked articles, the goal of the project was to demonstrate why key escrow is broken in general, not just these locks: http://livestream.com/internetsociety/hopeconf/videos/130717705 http://livestream.com/internetsociety/hopeconf/videos/130717...
- j4kp07 10y agoThat trick does not work with paired zippers that are also locked in parallel with the luggage handle. http://thewirecutter5.wpengine.netdna-cdn.com/wp-content/uploads/2015/11/04-zippers-1-carry-on-luggage-630.jpg http://thewirecutter5.wpengine.netdna-cdn.com/wp-content/upl... https://www.amazon.com/Travel-Accessories-Lockdown-Triple-Security/dp/B003EM3D6E/ref=sr_1_2?ie=UTF8&qid=1469665343&sr=8-2&keywords=tsa+lock+cable https://www.amazon.com/Travel-Accessories-Lockdown-Triple-Se...
- gruez 10y agoWhat? The exploit works on the zipping teeth itself, not the moving thing that zips them together.
- colemickens 10y agoPrevious discussion from last September: https://news.ycombinator.com/item?id=10196197 https://news.ycombinator.com/item?id=10196197
- jrockway 10y agoIn this case, they didn't use the pictures of the keys, they gathered a set of locks and worked out what the master key would look like based on those samples.
- colemickens 10y agoOh great, thanks for pointing that out; I missed that distinction and jumped to a conclusion after seeing the old story and new story reference the same GitHub repo. I guess this is the relevant commit: https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys/commit/5635ddb98c095a9ab36ff9548d87d5397d46cacd https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys/commi...
- lilyball 10y agoLuggage locks are basically only a deterrence against casual crime-of-opportunity thieves or pickpockets. I've found it's much simpler to just use a zip tie on my zipper. Very easy to put on, easy to take off again once you get to your destination (nail clippers work well), and provides roughly the same security as a TSA lock. And it has the added benefit that you can tell if the TSA opened your suitcase because the zip tie will have been removed (whereas with the lock the TSA can look through your suitcase without leaving any indication).
- arcticfox 10y agoBut TSA won't reziptie it for you, so it seems worse in that respect if you're dealing with shady airports
- dredmorbius 10y agoSome security works by defeating access. Some by evidencing it. Seals and zipties help evidence access, though not perfectly as the many references to ballpoint defeats of zippers on this article show.
- ChuckMcM 10y agoThat's why I always have a highly encrypted flash chip hidden in a false compartment of my checked luggage[1]. Really easy to know if they went through my luggage :-) [1] Not actually true, but I did bring home a set of lock picks from a conference once that had been wrapped as a gift, and they had been unwrapped by "somebody" (and no, there wasn't the TSA leaflet in my bag)
- fotbr 10y agoThe only reason I bother with a lock on my (zippered) luggage is to keep the double-zipper ends together and keep it from working itself open as it bounces around the baggage handling equipment. Like most things concerning security in general and airport security in particular, it's a sham, meant for appearances only.
- matt-attack 10y agoI've never locked a checked suitcase in my life. And I've traveled all over the world. Of course it goes without saying that I only carry laundry in my checked luggage. Laptop, chargers, camera, etc goes in a carry on backpack.
- Zigurd 10y agoI would second this. The only time I have had anything stolen from luggage was from my briefcase at a TSA checkpoint at JFK between foreign and domestic terminals, where a couple of checks were lifted from my bag. Fortunately I noticed shortly afterward and was able to get the checks stopped before boarding my flight. Don't check anything pocketable and expensive. Locks do nothing.
- deleted 10y ago[deleted]
- vacri 10y agoI have a similar opinion with my car. "The inside of your car is a public place". By all means lock the car, but don't keep anything valuable in it. And if you have a valuable thing in sight, then even with the fanciest locks, you're running the risk of broken windows. Just easier to keep nice stuff out of that 'public place'.
- eru 10y agoI've seen lots of stickers on cars saying "the car is unlocked, and there's nothing valuable inside". The unlocking in the hopes of preventing a window smash.
- matt-attack 10y agoYep - very common with owners of convertibles. Preventing people from slashing the top to get in, which is of course a very costly repair.
- rahkiin 10y ago
- kyleblarson 10y agoSeems like the plastic wrap they do at intl airports is a much more effective measure than tsa locks.
- yolesaber 10y agoOnly if you leave a unique indicator of that particular wrapping or take a photo. Otherwise they could easily slice through it, look at your shit, and wrap it back up. They probably have a machine for this.
- jlgaddis 10y ago> These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime. --TSA In my opinion, the TSA itself is nothing more than a "peace of mind" device.
- baby 10y agowhich is funny because I do not have peace of mind when I go to an airport 3 hours before my flight in hope that the TSA lines won't make me lose my flight.
- djsumdog 10y agoThey give me no piece of mind. In fact I hate flying in the United States because out of the 20 countries I've flow in and out of, the US is the only when where I still get molested. Even as late as 2015, on returning to America after not having hands stuffed down my pants in any other airport in the world, America still doesn't disappoint. Fuck the TSA. Airport security should be handed back over to the airlines and airports.
- kobayashi 10y agoThe TSA was created for legit safety/security purposes. The organization itself is assuredly a clusterfuck, but airlines and airports doing their own security again isn't the answer. A lot of it is about training. Many, if not most, of TSA's airport employees are the same poorly trained security staff that were laid off (and subsequently rehired) after the TSA's creation. The answer is a better security organization, perhaps modelled after a functioning organization, like Israel's (I've studied the country's security practices, and it readily comes to mind). The answer is not regressing to poorly trained and poorly organized DIY security operations.
- CamperBob2 10y agoThe TSA was created for legit safety/security purposes. The organization itself is assuredly a clusterfuck, but airlines and airports doing their own security again isn't the answer. The answer was reinforcing and locking cockpit doors. Everything after that is just for show.
- kr0 10y agoAt first glance I thought this was referring to the TLS master key certs.
- raihansaputra 10y agoi just thought about this yesterday.. would there be a market for a logging device for travel baggage? like a small camera and a mcu that activates when sensors (probably magnets between the halves) indicate the baggage is opened? preferably discrete. not to deter but to identify who opened it. logs time also to know the rough position of the breach.
- ceejayoz 10y agoThere'd certainly be a market for the stolen logging devices.
- dougfarre 10y agoIf you want to ensure no one can open your luggage, travel with a firearm. It doesn't have to be a real firearm, but if you declare the firearm you are required by the airlines to have a lock on your luggage that can't be opened by TSA.
- tomjakubowski 10y agoIs there a penalty for declaring a "fake" firearm?
- dougfarre 10y agono
- kgermino 10y agoA lot of people who don't want to lie (which may not be illegal, but I wouldn't recommend it personally) will get a starter pistol. They're cheap, small, safe (don't fire rounds, just blanks) and legally have to be declared as a firearm to fly. So you buy a starter pistol and stick it with your nice camera when you fly. It will be locked with something only you can open and will probably be handled more carefully in transit
- 15155 10y agoI doubt it, but sometimes counter agents will want to see that (your real firearm) is unloaded and stowed in the proper kind of case (hard-sided - I use a very large Pelican). More often than not, the TSA will want to hand-inspect firearm-containing baggage (with you present), and I couldn't say what they'd do if they didn't find the firearm in the bag they were breaking their routine to check. Just buy a flare gun or a starter pistol and declare it if you don't want to or can't use the real thing.
- onetwotree 10y agoTIL if you want to get a bomb onto a plane, declare a gun! I'm kidding, of course. There are probably multiple reasons that wouldn't work. But this whole notion that by molesting passengers sufficiently and putting on a big enough show, we can significantly reduce casualties from terrorism is laughable. At some point there has to be a tradeoff between safety and convenience, or no one in their right mind would drive a car.
- nsxwolf 10y agoJust cut them off, that's what the TSA does anyway. I stopped buying those because apparently the TSA just cuts them off when they don't happen to have one of their own keys handy. They threw the cut locks right back into my bags along with the note declaring they had searched them.
- trhway 10y agoseven for the Dwarves, done. 10 to go. And the master of them all.
- onetwotree 10y agoEr, 12 or 13 to go, depending on whether you count the one ring. You probably forgot the elves. If I had a nickle for every time I forgot the godamn elves...
- tdicola 10y agoYou can watch the talk where they announced it at HOPE here: http://livestream.com/internetsociety/hopeconf/videos/130717705 http://livestream.com/internetsociety/hopeconf/videos/130717... I saw it live and it was a pretty fun talk (also helped that it was midnight and the alcohol was flowing freely). Definitely check it out!
- zck 10y agoI was in the room for this talk; it was pretty electric. Some of the other talks I liked were the Social Engineering talk, and Cory Doctorow's keynote. The thing that crystallizes what HOPE is about, for me, was that their closing ceremonies opened with a fifteen-minute talk about the network situation -- the cabling they had to run, the 1.5Gbps DDOS they withstanded, and then chastised us for not using enough bandwith, saying the ISP that donated a 10 gig line threatened to downgrade it next time.
- sandGorgon 10y agoWow...will this not pretty much screw hotel room security ? An employee can go and open your lock in 30 seconds and relock your luggage after stealing. How do you prove that someone from the hotel stole it ("sir we obviously can't open locks that only the TSA can")
- williamscales 10y agoNo point...you disclaim liability for valuables left in the room.
- moptar 10y agoThere's a saying "Locks are to keep out honest people". That's basically it with suitcase locks. To keep your kids from playing with your stuff or your friends who might accidentally open the wrong one.
- holografix 10y agoI read a while ago that a good method of understanding whether something had been tampered with or opened was to use glittery nail polish on the edges and take a close up, photo on your phone. Even if someone repainted it they wouldn't achieve the same pattern
- dogma1138 10y agoThe TSA were stupid but to be fair anyone with an access to a few suitcases can build the key, not to mention that suitcase manufacturers and luggage lock designers had access to the specs.
- kozak 10y agoSo, the news is about the eights key being cloned, in addition to the seven keys that were cloned before. The title is a bit misleading.
- bogomipz 10y ago“These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime,” England wrote. "peace of mind" devices, that pretty much sums up the "security theater" charade that is the TSA. If its not important why do they have master keys at all? Similar to how they randomly select people sometimes to use the pre-screen lines.
- arviewer 10y agoIsn't it better to use a cheap non-TSA lock on your luggage? If they open it, the lock is destroyed, and you know for sure someone has opened it - either personel or someone with criminal intentions. Or will this result in more trouble?
- BinaryIdiot 10y agoI thought this happened a while back and hadn't realized it didn't yet. Very cool. Not a big deal with the TSA because honestly these tiny, flimsy locks were never about security but to ensure the casual encounter with someone unknown doesn't get into your bag and possibly steal something (anyone who really wants something from your bag can cut these with the tiniest of bolt cutters). Also they can be handy with keeping annoying zippers together.
- cyphunk 10y agoThese consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime. A bump key could open the majority of locks and yet we still put such locks into new doors? These flawed locks just serve the purpose of forcing whomever wants to enter to cross a psychological boundary from legal into illegal. And that is still a good reason to use flawed locks. In other words, you might as well not use locks at all. Simply not true