Support NeoGAF

[XiaNaphryz]

https://www.schneier.com/blog/archives/2015/09/tsa_master_keys.html

Someone recently noticed a Washington Post story on the TSA that originally contained a detailed photograph of all the TSA master keys. It's now blurred out of the Washington Post story, but the image is still floating around the Internet. The whole thing neatly illustrates one of the main problems with backdoors, whether in cryptographic systems or physical systems: they're fragile.

Nicholas Weaver wrote:

TSA "Travel Sentry" luggage locks contain a disclosed backdoor which is similar in spirit to what Director Comey desires for encrypted phones. In theory, only the Transportation Security Agency or other screeners should be able to open a TSA lock using one of their master keys. All others, notably baggage handlers and hotel staff, should be unable to surreptitiously open these locks.

Unfortunately for everyone, a TSA agent and the Washington Post revealed the secret. All it takes to duplicate a physical key is a photograph, since it is the pattern of the teeth, not the key itself, that tells you how to open the lock. So by simply including a pretty picture of the complete spread of TSA keys in the Washington Post's paean to the TSA, the Washington Post enabled anyone to make their own TSA keys.

So the TSA backdoor has failed: we must assume any adversary can open any TSA "lock". If you want to at least know your luggage has been tampered with, forget the TSA lock and use a zip-tie or tamper-evident seal instead, or attach a real lock and force the TSA to use their bolt cutters.

Posted on September 8, 2015 at 6:02 AM

 

[HariKari]

Aren't TSA agents the ones most likely to tamper with your shit to begin with?

 

[howdyjacker]

Not surprised.


Am surprised it took this long to come to light. Also I've been using regular old locks on my luggage forever.

 

[timetokill]

Transportation Security Administration

So Secure

 

[HammerOfThor]

I'm confused, does the TSA provide locks for people to use?

 

[BertramCooper]

This seems like an inevitable outcome for such a low-tech system.

Kind of surprising it didn't happen sooner.

 

[Squalor]

I never check luggage. Fuck that.

 

[Dai101]

Aren't TSA agents the ones most likely to tamper with your shit to begin with?

Both your stuff and your "stuff"

 

[timetokill]

I'm confused, does the TSA provide locks for people to use?

No they just have keys to all the locks luggage companies use

 

[Stumpokapow]

I'm confused, does the TSA provide locks for people to use?

If you use a lock they can't open, they'll cut it off. So if you don't want them to cut it off, you can buy any number of locks that has this master key system so they can open it without cutting it off

 

[Somnid]

I'm not convinced this matters. In fact I'm entirely sure it was easy to reverse engineer luggage locks, or just cut them.

 

[dave is ok]

The picture is still on this story

How stupid do you have to be to even pose for that picture? Let alone print it

 

[whitehawk]

I'm confused, does the TSA provide locks for people to use?

Every lock used during flying has, or should, have a place for a master TSA key so they can open your luggage easily to search, without damaging your lock or luggage.

 

[Hexa]

The TSA was a mistake. It's nothing but trash.
Seriously though. They were a terrible idea that need to be replaced.

 

[NeOak]

I always carry electronics as carry on, which leads them to grab my backpack and do "additional testing" because of so much shit I have.

I use like 10+ trays and take my sweet ass time picking everything up. By the time I'm done, the drone agent is noticeably tired of waiting, so they do the test quickly.

Waste of time because it always comes up negative.

 

[cirrhosis]

oops!

quite some mistake, sheesh

 

[kirblar]

The picture is still on this story

How stupid do you have to be to even pose for that picture? Let alone print it

I can understand the journalist's ignorance. TSA has no excuse.

 

[ElectricBlanketFire]

I'd rather wear the same clothes for a week than check my luggage.

 

[massoluk]

Seriously though, like it matters. TSA handler is as likely to steal my shits as anyone, so I really don't lock my luggage.

 

[BreezyLimbo]

....wait the TSA has keys that let them open any 'approved' lock from your luggage?

Fuck that shit.

 

[muu]

Checked luggage has been cheap shitty gifts and/or clothing storage for a while now.

 

[Squalor]

....wait the TSA has keys that let them open any 'approved' lock from your luggage?

Fuck that shit.

This has been the case since the TSA's existence as far as I remember.

That's why you have to have an "approved" lock on luggage now.

Checked luggage has been cheap shitty gifts and/or clothing storage for a while now.

Not good if you have expensive clothing, though.

 

[AMUSIX]

Wait...was it this shot?

Because this was posted by the Herald of Everett Washington a year ago...I can't see the Post picture showing anything different...


And. yes, the image is still in the slideshow with the article: http://www.heraldnet.com/article/20141130/NEWS02/141139966

 

[SimleuqiR]

....wait the TSA has keys that let them open any 'approved' lock from your luggage?

Fuck that shit.

Yes.

I traveled twice last year, within the USA, and my bag had a nice love note from the TSA stating they had open by bag as a random security check. Nothing was missing both times they did this to me.

 

[zeemumu]

They stopped me at security because of a souvenir wand that I had bought from Universal Studios in Orlando. Maybe they thought I'd use the imperius curse to hijack the plane.

 

[Zoe]

....wait the TSA has keys that let them open any 'approved' lock from your luggage?

Fuck that shit.

How else are they supposed to open it if you get flagged for inspection?

 

[BreezyLimbo]

This has been the case since the TSA's existence as far as I remember.

That's why you have to have an "approved" lock on luggage now.

Not good if you have expensive clothing, though.

Yes.

I traveled twice last year, within the USA, and my bag had a nice love note from the TSA stating they had open by bag as a random security check. Nothing was missing both times they did this to me.

Geez. This is a huge slip up if now people can practically make copies of keys. Holy shit.

How else are they supposed to open it if you get flagged for inspection?

Over my dead body.

 

[Patryn]

Geez. This is a huge slip up if now people can practically make copies of keys. Holy shit.



Over my dead body.

When you buy your ticket, I believe there's legalese stating your acknowledgment and approval for the TSA to inspect your luggage.

And as has been said, this picture had actually been floating around for a year before the WaPo ran with it.

 

[Zoe]

Over my dead body.

You've never had a choice even before the TSA.

 

[Prinz Eugn]

Over my dead body.

I think you are missing some basic tenets of modern US air travel.

 

[ReturnOfTheRAT]

Wait...was it this shot?

Because this was posted by the Herald of Everett Washington a year ago...I can't see the Post picture showing anything different...


And. yes, the image is still in the slideshow with the article: http://www.heraldnet.com/article/20141130/NEWS02/141139966

Yeah, not exactly full on individual imgur shots like what's linked in the other article.

 

[Syriel]

Up until this morning, the full manual was available direct from Travel Sentry's website.

https://www.travelsentry.org/security/pdf/Guide_to_TravelSentry_Passkeys_1_October_2012-EN.pdf

It is now disabled, but after hitting the media rounds yesterday, it's safe to say that copies are out there.

 

[Brannon]

Yeah, not exactly full on individual imgur shots like what's linked in the other article.

To be honest, it would probably take more time to make the key than to just pop the lock with anything you have in your hand. They are... subpar.

 

[Squalor]

Even master locksmiths would take a while to recreate the keys just from a photo like that.

It would be easier to pick it for a professional.

This is basically a non-issue.

Let's talk about how useless the TSA is instead.

 

[Kinyou]

http://i.imgur.com/8aC6snD/img]

To be honest, it would probably take more time to make the key than to just pop the lock with anything you have in your hand. They are... subpar.[/QUOTE]
lol, how could anyone think this would be a good idea

 

[Unknown Soldier]

lol, how could anyone think this woukd be a good idea

The belief that you are secure is more important than if you're actually secure or not

 

[Littlefang]

I'm sure a pair of bolt-cutters would be a lot more efficient.

 

[ryutaro's mama]

Over my dead body.

Then I guess you are never visiting America with more than a carry on bag.

 

[Piggus]

I think you are missing some basic tenets of modern US air travel.

Not just US travel.

 

[brisk tacos]

 

[sangreal]

couldn't a capable locksmith just buy a TSA lock and make a key anyway?

 

[Squalor]

couldn't a capable locksmith just buy a TSA lock and make a key anyway?

Not necessarily a "master," though.

 

[n0razi]

TSA004... yeah i think my grandma could pick that lock with a hairclip

 

[Slayven]

anyone with the the knowledge, skill, and the desire to copy these keys probably already has a set. And probably doesn't read the Washington Post

 

[AndyD]

If you want to at least know your luggage has been tampered with, forget the TSA lock and use a zip-tie or tamper-evident seal instead, or attach a real lock and force the TSA to use their bolt cutters.

Careful with zip ties as you can get to your destination and find that you don't have anything sharp to cut it off since you can't carry on knives, scissors...

 

[captive]

how bout, no one gets to open my luggage? Hmmm

 

[Brakke]

Pretty sure this doesn't change anything. A truly dangerous adversary already would've been able to bypass the lock with a pick or would've just cut it and not cared if you knew.

A regular guy could I guess now scoop a bag off a carousel, steal shit, and put the bag back? The intact lock will make the victim will think the TSA robbed them so throw the trail off the crook? I guess? How many times can you even do that before you're conspicuous af tho.

 

[Tadaima]

Pretty sure this doesn't change anything. A truly dangerous adversary already would've been able to bypass the lock with a pick or would've just cut it and not cared if you knew.

A regular guy could I guess now scoop a bag off a carousel, steal shit, and put the bag back? The intact lock will make the victim will think the TSA robbed them so throw the trail off the crook? I guess? How many times can you even do that before you're conspicuous af tho.

How is this even possible? There are security cameras everywhere.

 

[Slayven]

How is this even possible? There are security cameras everywhere.

he said they could do it, not that they would get away with it.

 

[Saint Gregory]

I gave up on the TSA locks after the bastards cut them off my luggage on successive flights

What was the point of me buying them if the last bastards just cut them off anyway??? Now I just don't pack anything valuable and leave my luggage unlocked. I'm assuming that the baggage handlers wear my underwear as hats though.