Slashdot Mirror
TSA Now Investigating Boarding Pass Hacker
An anonymous reader writes "A week after the Justice Department cleared him of any wrongdoing, Chris Soghoian, the Indiana University PhD student who created an online boarding pass generator for Northwest Airlines to highlight security holes is on the government's 'no-fly' list. The Transportation Security Administration has now launched its own investigation, says Wired blog 27strokeB. The TSA is claiming that Soghoian 'attempted to circumvent an established civil aviation security program established in the Transportation Security Regulations,' violations of which carry fines of up to $11,000 per violation. That could be a steep fine, says Washingtonpost.com's Security Fix blog: 'Something like 35,000 people viewed and possibly used the boarding pass generator during the less than 72 hours that it was live on his site in November. Soghoian told WaPo: "If they decide that the only safe way for me to leave the country is by boat, then that's pretty much the end of my career here in the States. It's one thing to harass researchers, but if they can chase them out of the country, then that's a real chilling effect."'"
I wonder how many of those were Slashdot users. Shame on us! Shame!!
What's the fine for making TSA look stupid?
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Enjoy your stay.
Technology -- No Place For Wimps! Grateful Dead and Jerry Garcia Chatroom -- http://www.wemissjerry.org
The people responsible within the TSA need to be dealt with. These fuckheads have some nerve harrassing a researcher for bringing their errors to wider attention.
The fine seems reasonable, will they accept cash?
There are no karma whores, only moderation johns
WTF was Congress (not) thinking when they created the Dept. of Homeland Security?
From what I've been seeing over the last few years, they can do pretty much anything they want and unless you have a Whitehouse contact or are a Senator, you have to bend over and take it.
And it's a "Brazil" reference, of course, which is nicely appropriate in this context...
you had me at #!
As long as they don't fix the flaw, he can still exploit it and circumvent any extra scrutiny they try and put on him.
-- Don't Tase me, bro!
So, what's the message these kind of reactions from the authorities send? To me it seems: "We don't really care if the system is really secure, there are always some friends might need to sneak in, one day. You just let yourself be searched and stay well put during the flight, cause if you don't we call you a terrorist. Trust us or else."
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
because they CHASE THEM AWAY!!
0 7/0419259
http://science.slashdot.org/article.pl?sid=06/12/
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
What is the actual value and goals of his research? A responsible researcher could have created a proof-of-concept, and raised awareness through media channels, research paper, blog etc. He should have also presented his research to the TSA and the airlines. Instead what he did was not research. He created a website to create fake boarding passes and released it to the public. There was no academic benefit. If I created forged passport software and released it, that's not research. Let's call this for what it is: trouble-making, not research.
Airport security is a joke, and all he did is point that out. I will point something else out. When I was waiting in the immensely long line for United Domestic Check-In, I noticed they controlled access to the door behind the ticket counter with a simple mechanical combination lock. I observed several United Airlines employees entering and every time I could clearly see the code being entered. I felt very secure.
If these people think that they're making air travel safer by suing/investigating someone who makes a blatant security hole public, they're diminishing my trust in their methods. Jail time doesn't scare a suicide bomber.
>The blog is "27B Stroke 6"
>And it's a "Brazil" reference, of course, which is nicely appropriate in this context...
Suggestion for Rule #1 in LUO: No good deed shall go unpunished.
His blog (http://slightparanoia.blogspot.com/) has scans of the letter.
Reading the letter makes it sound much like the case the FBI was workign on against him (and subsequently droped).
All of the legalease (as well as I can read it) states is that you can't make these or higher some one else to make them.
Well, he didn't, he just created a program that COULD. In this case (as with the FBI one) it all seems about intent...
Do Or Do Not, There Is No Spoon, There Is Only Zuul. Everything in the above post is probably opinion.
This is the same problem with all kinds of security systems/programs. How does one point out the error/flaws in said system without falling afoul of the law(s)?
In this case, he would have been better off just telling people it could be done IMO. Just the same, if Kazaa isn't guilty, how can this guy be held responsible for what people did with his demonstration? If he personally used the fake boarding passes to fly and thus circumvent TSA rules, then he's guilty, should be punished. To demonstrate that its possible doesn't make him guilty. Even making it possible for others to do so doesn't make him guilty of anything except making the TSA look stupid.
Printing counterfeit money is not illegal... using it is. Normally, nobody would print it without the intent of using it, but in this case, the whole effort was to prove that it could be done and show that a fake boarding pass ruins security measures. If he can print fake boarding passes, any reasonably savvy group can. The manner used to demonstrate this flaw surely makes it impossible to not fix the problem?
I hope that he is not slapped with huge fines...
Support NYCountryLawyer RIAA vs People
I *so* wanted to mod this post "troll," but that is unfitting - your ideas are not meant to provoke, but to unprovoke, and breed grudging contentment with the sad status quo. So no troll moderation for you. Sadly, there is no "defeatist fucktard lemming" moderation available. That would be fitting.
Eloi are stupid, throw morlocks at them!
Exactly, of course this is against the law.
I'd also say it's deserving of a fine of around $100 or so, nothing more.
And immediate job loss without privileges for several of the highest ranking managers responsible for letting the insanely lacking security system live for so long.
I believe posters are recognized by their sig. So I made one.
"$11,000 per violation is ludicrous... he can't be held responsible for all those downloads by others."
Follow this recent thread on Slashdot and replace 'Kazaa customer' with 'Chris Soghoian'.
Wired doesn't mention it, but in the kid's blog, he links to a re-implementation of his boarding pass generator, this time using html & java.
. tar.gz
Coralized Archive of the mirror: http://geocities.com.nyud.net:8080/j0hn4dm5/forge
The mirror:
-http://j0hn4d4m5.bravehost.com/
(Coral CDN didn't seem to work on it)
Maybe now the TSA will actually do something about their security hole.
Actually, I doubt it, but we can hope.
[Fuck Beta]
o0t!
>He wrote a tool to exploit a federal system, and he used it
Did he use it? a fake boarding pass? I gave just a brief look at the story (sorry, should never RTFA) but I missed it.
"Homeland Security: We can't secure any of our borders, but we'll inconvenience hijackers by making sure they can't brush their teeth!"
This whole airline TSA thing is a crock of BS. Over Kill.
... expected.
So, a bunch of terrorists captured a couple of airplanes and flew them into buildings. Yeah, a bunch of people died, which is tragic. And the Economy Burped, which is
However, we've learned our lesson, and have secured the airplanes better. In addition, I doubt, HIGHLY DOUBT, that they could get anywhere close to doing the same thing, given the same circumstances, mainly because the passengers wouldn't stand for it.
Screening 80 year old grandmas of their knitting needles is stupid. Taking off shoes is stupid. Banning Liquids is stupid. For all the inconvenience of it all, it will not prevent someone from trying to by-pass whatever security is setup, and eventually they will succeed.
I know for a fact that I could bring a knife on board a plane even today, even passing through all the security. They can't stop me if they can't see it. And there are such knives available.
The point is, all this "security" isn't really designed to prevent hi-jackers, it is designed to placate the masses. See my sig for more info
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
The thing is, Americans cannot understand how someone could possibly just "want to help" and not "want to make money". If such a thing happens, then surely they must be up to something, they are probably a terrorist and should be locked up anyway.
No, if he was a criminal he'd have kept it quiet and sold it. How do we know a criminal's version of this scheme wasn't already running? We don't, but we know that now it won't work. For every security researcher there are 3 self-serving fiscally-motivated elitist assholes and it is the security researcher's moral obligation to practice full disclosure (after giving the company notice and time to fix the hole).
I am one of many. My idea is not unique, nor do I expect my voice alone to sway you. I speak in a chorus of opinion.
It seems to me that the whole point of terrorism is to disrupt the normal lifestyle of those who are terrorized. The US government has often stated that they don't negotiate with terrorists. That's apparently true - they don't negotiate - they just capitulate and let them completely destroy the American way of life. BTW - I'm posting this anonymously so that I don't wind up on the no-fly list :-)
Like how ABC news had permission when they showed that they could sneak box cutters onto a plane, just 1 year after 911?
Molog
So Linus, what are we going to do tonight?
The same thing we do every night Tux. Try to take over the world!
Is that their latest pre-emptive penalty, sticking people they don't like on the no-fly list? While not legally in the same category as house arrest, by infringing on his right to travel, have they or have they not already imposed a civil penalty?
I didn't actually see a citation of where he'd been placed on the no-fly list, can anyone find one and post it? Probably not, since the list doesn't even technically "exist" except as an abstract concept... sorta.
I have to strongly disagree with the dude above who insists that what CS did was "wrong." He neither invented the method of subverting a broken access control system (it had been possible to alter boarding passes with a $50 scanner and a cheap inkjet printer for who-knows-how-long) nor did he encourage anyone to break the law. Worse, TSA's head-in-anus response only even more strongly points up the problem with DHS overall: we can't fix our problems, but we CAN harrass people who point the problems out to the world in the hope we might actually do something.
They're too busy making old ladies take off their shoes.
---------------------------------------
Rotate the pod, please, HAL....
This may fall under double jeopardy
Hm I could swear I once heard something along the lines of government of the people, by the people, for the people.
It's our obligation to watch the government, question it, and try to fix it when it's not doing its job. The airlines and the government were clearly aware of this problem as it had been "exploited" by a congressman a couple years back. This is a case of government employees covering their asses instead of fixing the problem. Soghoian publicized the problem because no one was doing anything about it.
I'm glad to know there are some people who won't roll over saying the government always knows what's best for us. WE run the government and write their checks. Don't forget it.
Do you think the flaw ever would have been brought to attention had he gone through the proper channels? I for one am happy he did this and brought it to everyone's attention, once it's out like this it's hard to down play and ignore.
So when normal attempts at bringing a problem to light fail because they are to lazy to fix what is found he should just drop it till someone with malicious intent finds it and then start screaming "I TOLD YOU SO!!!". Great idea, I'm sure that would console everyone who was hurt or lost friends and family because of the problem. Pardon him for not wanting people to get hurt first.
You mad
Nice Flaimbait...But i'll bite.
Your argument is simply foolish. The TSA is inept at running a dept, so they are also inept at hiring researchers or security folk to check up on their stuff. This is a government agency. This person committed no actual crime -- he didnt use one, and didnt even print one.
The criminal would have kept this secret, and used it to his/her benefit by selling it to terrorists, criminals, or whatever. Those types of actions should be punished, SEVERELY!
What did he do? He made us all safer. He did it by exposing how ridiculous the TSA is, and gave them all the knowledge to fix the problem. He did not personally gain from this experience. If anything, he has suffered already for it much more than he ever should have. I would feel differently if this was a private company and not a public-oriented service (like AIRLINE travel), to which my tax dollars go (both to bail out airline bankruptcy, as well as to operating the TSA).
IU needs to stick up for their researchers, and foot the legal bill. I doubt they will, however, having been a past student, the administration at IU is pretty much inept equivalent to the TSA in my eyes.
God forbid someone try to HELP the world...
The difference between a black hat and a white hat is one simple thing: PERMISSION. He wrote a tool to exploit a federal system, and he used it without permission. He is not a hero, he is not the good guy, he is a criminal. I'm sorry, but you need signed permission to do stuff like that.
Wouldn't asking permission defeat the purpose?
Ever heard of whistleblower laws to protect people who serve the common good?
Don't you think we should be free to examine the system on our own?
When nobody listens, soemtimes you ahve to make a stronger statement. Thats what he did and should be commended for it. I would guess that you think Dieboold's e-voting machines are a good thing as well...
I hear and I forget. I see and I remember. I do and I understand. -Confucius
So, this whole "who watches the watchmen" bit doesn't wash with you? How does it feel to be so servile?
It's Twenty Seven B Stroke Six YIC
cat
Well, his intentions were obviously meaningless, since I can apparently still print out my own boarding passes, legit or not.
It's a shame the TSA people think just like you, if people would quit trying to kill the messengers, we might start seeing something that looked more like security and less like cronies securing contracts.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Although you might need some grizzly bear rifles and a big sign that says, "I do not want to marry a homosexual man!"
The TSA will not bring any real charges against Soghoian. This entire exercise is pure simcurity, simulated security. The TSA runs a hollywood show for its political stakeholders, in Congress, the White House and in the media, to generate PR showing they're "tough on terrorists, strong on security". Without making us safer. In fact, putting us in danger, by ignoring real security requirements, creating security holes, suppressing serious research, and wasting time on this whole charade, when there isn't enough time, money, people, or actual resources to work on the real security work.
Soghoian is being sacrificed to this simcurity charade. As is the confidence of the public, ironically the only worthwhile product of simcurity.
The whole fake, yet lethal Bush simcurity apparatus has to be ripped out by the roots. We need more security than on 9/10/2001, not less. Congress should grab hold of the BS TSA next year and remake it according to our ranks of real security experts. Along with the rest of the leviathan Homeland Security Department, with its flagship FEMA. When Bush stands in the way, that will be even more reason to rip that terrorist incompetent, and his designated successors, out of the path of securing America.
--
make install -not war
I didn't actually see the site while it was up, so maybe the guy actually DID this, but.
To avoid being arrested, why not make the boarding pass have VOID VOID VOID printed all over it in such a way as it exposes the problem, but doesn't actually create a valid boarding pass. Then he would have violated no laws, AND exposed the poor security procedure at the same time.
Once the story broke he could create a boarding pass that's given to someone that's authorized to test the fake boarding pass, or others others could independently confirm that the fake pass would work by comparing it to a real boarding pass.
Anyone know if the site did anything to show that the pass was actually invalid?
It seems a bit foolish to put up a working system and not expect the government to go all apeshit.
AccountKiller
Uh, why should he pay a fine? He wasn't attempting to circumvent anything. If he's guilty of anything it's violating the airline's copyright on their logo.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
They're just not going to leave the poor guy alone. He embarrassed them, and they're going to make him pay and pay and pay. It looks a lot like getting on the wrong side of the RIAA. They can be entirely wrong, but it costs you a fortune and year(s) of your life to win, and then they only pay a pittance for all their unwarranted grief at best.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Does that mean he is grounded for being naughty?
That's unfair. Obviously he did his homework.
"Hannibal's plans never work right. They just work." Amy/A-Team
No, I strongly disagree. The DOJ has already decided he is not a criminal, or at least decided not to procescute. TSA seems to be getting their panties in a wad because he pointed out that the system is flawed, and did it in such a way as to force them to fix it. However, he didn't defraud anyone. He didn't use the tool to fly or to even bypass security. Seems to me, that after 4 years of TSA "Security" (more actually, but lets count from 9/11) stupid holes like that one should have been fixed.
A positive attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.
I'll probably be on the no-fly list soon for this, but it's worth pointing out that what Chris did to NWA's boaring passes could be duplicated by just about anyone without special software. While I don't agree with how he exposed the issue (he should have used a fake airline/pass to show the risk), it is worth exposing some very very bad software design. The real criminals here are the coders who developed the boaring pass system for NWA.
The NWA online boarding pass generator uses HTML to render the boarding passes. There's no image processing or anything special involved in changing values on these. Just save it to your desktop, open it in your favorite text editor, and change the text. Bingo. You're flying first class.
There's no reason to believe he even might endanger any airplane that he boards. There's not even the thread of suspicion you'd get from guilt by association. There's no allegation that he has violent tendencies or has threatened violence.
He's there because the no-fly list is a tool for control and coercion at the whim of the authorities without the restraint of statute or jury.
I'm not saying that what the TSA is doing to this guy (or any of us) is right. I think it's blatant sour grapes! But, I don't condone Chris Soghoian's actions either. He should have "done the right thing" and approached the TSA *BEFORE* he made his findings public, and he certainly *NEVER* should have made his web app public. What he did was dumb and irresponsible, period. Was it illegal, ummm, that's up to the courts to decide.
BS.
White hat hackers do things like this pro bono all the time. Perhaps you might recall when a security researcher found a critical flaw in the Cisco OS that could have potentially been exploited to bring down half the internet's backbone infrastructure? Or perhaps you might recall the time that a security pro found a rootkit on a Sony CD? If I went up to you and told you your fly was down, that is a white hat hacker exploit report. If I went up to you and stuck a red hot pocker through your open fly, that is a black hat exploit.
Though, I'm tempted to do that to you anyway, despite the color of hat I wear.
This guy didn't exploit the issue, he immediately made the responsible party aware of the problem. I don't recall him ever flying on a bogus boarding pass. Learn the difference and stop preaching blindly.
Raging in an online forum won't do anything for the world around you. To see change, you must take action.
Avoid Missing Ball for High Score
that's pretty much the end of my career here in the States.
So what?
Most Americans who have never lived anywhere else, or who immigrated from third-world countries, think the USA is the best place in the world to live.
But if you travel to any pleasant country, you will find that lots of Americans have chosen to live there.
YMMV, of course. But living in a country where the language is different from the one you grew up with is one of the most educational experiences there is, and you might eventually be grateful for the event which prompted you to leave the USA.
The idiots here at Slashdot have modded you troll, but you are right.
Legally, what he did was wrong. And it doesn't require a degree in law to know that.
Second, what did he think was going to happen? It's one thing to state what everyone already knows: The security is a joke. But to demonstrate it in a way that makes the security easy to circumvent so that any idiot can do it is stupid. It serves no purpose. Consider the only three possible outcomes of this fiasco: 1) We can no longer print boarding passes at home, which really would annoy those of us who try to be as efficient as possible. 2) The security checkpoints would need scanners to scan the boarding passes to make sure they are real which is costly and just one more thing to slow down lines. 3) No change. It looks like we made it with #3, which was what I was hoping for myself.
And as a traveler, what he did was wrong. Yes, we know the security is worthless but the last thing I want is more security on planes. We have too much as it is. Make an effort to make sure no firearms, explosives, or unusually sharp objects are let into the secure area and call it done. I don't want more security, I want less. And drawing undue attention to the weakness of the current system only serves to increase the probability of them implementing real security that is going to make air travel so inconvenient as to be useless. Sorry, I don't want that.
So, basically, the guy that put up that boarding-pass generator is an idiot. Is he really a threat such that he should be on the no-fly list? No, of course not. But in this particular case, do I care? Nope. His little exercise had (and still has) the potential of making traveling less convenient for millions of people. So forgive me if I don't really care if his travel convenience is impacted.
You seem to be forgetting that that had already been done, up to and including having the information on how to create a fake boarding pass published on a congressman's web site for a year or so prior to his arrest. And yes, there had already be newspaper articles on it, and the TSA was either well aware of it and doing nothing or unaware of it even though it had been reported to them multiple times.
Ok, fine. It was trouble making. But for whom? It didn't lower airport security one iota. Anyone who cared about it already new how to do it. What it did do, though, was make trouble for the fake "security" providers at the TSA, and point out the fact that they are ripping us (the taxpayers) off.
We saw the same sort of misleading argument come up when people started pointing out that US Military personnel were being given ineffective bulletproof vests; somehow the people who were trying to raise awareness of the issue were supposedly "helping the terrorists." Which is just nuts. What they were doing is making things uncomfortable for the crooks selling the defective jackets, and having zero impact on the people wearing them unless and until they could raise enough awareness of the issue to get things changed--in which case their actions would have helped the roops, not hurt them.
--MarkusQ
Really? The story made headlines for a day or two at most. Then nothing. It's very easy to ignore and that's exactly what the government, TSA, and airlines appear to have done. And I for one am glad that was the reaction.
...it's illegal to make the TSA look stupid?
The enemy is RADICAL MUSLIMS*
/N ???
*Possible redundancy detected, please confirm. Y
(-1, bigoted asshole)
Really? Come on, I'll bet he printed one. I have no doubt he destroyed it, but if I were writing a system like that I know I'd at least print it to make sure it still looks good on real paper.
What did he do? He made us all safer.
How are we safer? I'm not aware of any changes to policies regarding home-printed boarding passes. And I'm glad there haven't been any changes to policies. But how did he make us safer? Even with his little system it was impossible to get on a plane anyway... it was just possible to go buy lunch at the McDonald's inside the security area instead of the one on the corner.
Really? He forced the TSA to fix the system? Exactly how was it fixed? I can still print boarding passes at home and last time I was at the airport, the security checkpoints still weren't scanning them. So exactly how did he force them to fix it? The whole issue was swept under the rug, and I'm glad.
We don't want real security. As it is now, we complain about the fake security because it's a hassle. Do you know what real security would be like??? Seriously, I'd just start driving anywhere on this continent and leave air travel for intercontinental travel--and only because my car doesn't travel well over oceans.
I agree.
The U.S. is a country of laws: we believe in the rule of law (before anyone comments, this is a standard question covered in Texas police training under the TCLEOSE module "The History of Policing"). Whether it was right or not, it was against the law. It is up to governmental authority whether or not to punish the individual.
They have to weigh the fact that a) it was illegal, it was known by the individual that his actions were illegal, and he intentionally violated the law, and b) his actions publicized a major flaw in national security and personal safety, exemplifying how security could be circumvented even when the flaw was previously known.
In hindsight, what he should have done was got in touch with the entity responsible for security of the airport and presented his evidence. This is analogous to the scientist that invents some "cure", skips FDA approval, injects himself, and it ends up harming himself and others. It also reminds me of the ST:TNG episode Force of Nature.
While what he did was "noble" or "right", he went about it the wrong way.
I don't reply to Anonymous posts; if you have something to say to me, identify yourself or I won't reply.
People have been saying it for years. Last I checked, with E-tickets, you didn't even need a boarding pass---a printout of an email message was enough. (This should be changed if it hasn't already been.) The proper channels have repeatedly ignored complaints about this. As such, this guy should be protected by something akin to whistleblower laws, but I don't think there are any at the federal level except between employers and employees, sadly.
The way I see it is this: the TSA gave the public their new clothes. All this guy did was take the blindfold off so they knew they were naked.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Well, it would be both. Any artwork you create is automatically covered by copyright. Now that you mention it though, fair use is probably a defense - he was constructing criticism which falls under fair use law. Trademark, on the other hand, would likely nail him.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
http://www.wired.com/news/columns/0,72045-0.html
Because they couldn't take down the big fish, that's why.
i suspect this is a locally initiated effort, not driven by hq.
I found a security hole in a "secrue" system used against pedophiles. I documented the system and submitted it thru channels to the proper authorities. I had to jump up a couple of levels before they could pay attention, but tha tis the way it is done.
What this guy did is not research, but *IS* criminal.
accountability, lol.
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
This is a little bit frightening to me, not because they're prosecuting him and all, because I've come to expect that, but because of where it could lead. We all know that security is never permanent. If there is a way to stop someone from doing something, there is a way around it. What happens when the government realizes this? Some of the cases that get pushed through, like this one (IMHO, anyways) are ridiculous, but what happens when the government realizes that it's just the tip of the iceberg? It sounds kinda funny now, but after seeing the ways in which the government has evolved over the last few years, I would believe anything of them. What happens when they start bringing cases against people who make a proof of concept? Once we know something can be done, the rest is relatively easy, right? So proving that something can be done is like telling the terrorists how to do it, right? Of course, once you think of an idea of how to do something, you've taken your first step on the road to making a proof of concept, am I right? I look at those last few sentences and it makes me shudder, how absurd the logic is, but it's all too familiar to me. It's very like certain justifications to get a hold on certain domestic phone records, or even records from your local library. I've always been of the opinion that America is the best place to live (for me, at least), but if thought processes like this continue to spread and grow, I don't know that America will continue to be a good place to live for very much longer. I like my freedom, and I am not willing to give up personal freedoms in order to lead a life filled with a false sense of security, under a tyrannical government that is unwilling to admit that it can and does make mistakes.
Okay, so it's not research. But he's also not at the center of some vast terrorist conspiracy to forge boarding passes and blow up the US. The trouble he made was not a serious threat to US security, and if it was we are in some deep fucking trouble because it's clear that the gatekeepers are asleep at the switch.
No, he has already been treated to the "troublemaker" gauntlet, had his brush with the government and his future almost turned upside down. He's still a kid, and kids will do things without thinking (yes, you can be 25 and childish - they guy has probably never lived outside of academia). The TSA is now practicing a little mafia style justice for losing face to this guy.
Is it just my observation, or are there way too many stupid people in the world?
was never convicted in criminal court. The IRS got him in tax court for not paying taxes.
So justice had there try. Now its TSA's turn. Next the IRS will look over his finances looking for undeclared paypal donations for his defence, student loan fraud, etc. Next the army will conscript him under some secret law, and send him to Iraq. If they still can't get him there is always the RIAA & MPAA.
If that printout of that email message contains a security code, what is the problem?
I suffer from attention surplus disorder.
Yep. Gave me the willies, too. But that was nothing compared to my shock that the whole country didn't rise up and shout their own horror.
We're surrounded by people who don't learn from history, or from reading at all. Presumably because their lips get too tired.
All you need is a couple of Christmas presents.
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
That's the United States today, unfortunately. If I had the financial resources I'd move to Europe, Russia, Asia, Australia, anywhere other than here. Anything is better than the $@&^ed-up crap our government is getting away with now. They are a bunch of psychopaths that can't stand to have anyone smarter than they are (which is any non-government employee) point out their flaws. I'll be glad when the common people of this once great nation are fed up and take it back. Terrorist attacks on the United States and abroad have brought out the worst in our government . . . so much so that we're hated around the world by everyone not a government scumbag. Losers!
At least with Continental's E-ticket, there's a bar code on the printout. They scan that and check it against your passport before allowing you on the plane. So not only do you need to have the printout, which could be easily faked, you have to have a barcode number that associates with a record in their database which matches your passport, which is a hell of a lot harder. You'd have to have a fake passport as well. Not impossible, but certainly less trivial.
They put the guy who can forge boarding passes on the no-fly list? does anybody else find that kinda... i don't know... retarded?
How about giving him a call and talking to him about this situation...
James A. Roberts
(317) 390-6916
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
I was reading Feyman's memoirs just before I read this, so please excuse it did affected me a little. What may be perfectly easy to understand to a game theorist and can be summed up in one dilemma can easily take a few dozen pages to describe to the uninitiated. Similarly there are years of courses to understand the basic foundation upon which theoretical mathematicians don't even have to think of consciously. And finally what to a hacker may be plain as day may be completely counterintuitive to the way the rest of the world thinks. (In this case, any output can be converted to input, and fed back out again.)
Further, because the concept is known by a vendor as a "possible" problem, doesn't mean they will address it. By creating an interface for even those unfamiliar with the theory, the concept became a reality. On top of which, there is innate skepticism from the part of the vendor (for the most part) that their product could be broken in such a "trivial" manner; or put another way big head smackers sometimes take simple examples.
Avoid Missing Ball for High Score
I think it's more then permission, the difference in a black hat and a white hat comes down to real intentions. Saying you're trying to inform people means bullshit because it's just that. If you want to inform people, inform people of the problem as well as the airline, meantion you have a working prototype but that's it. Don't start handing it out blindly to random people.
Just because you have a new technology doesn't mean make it available to everyone with out at least trying to inform those who should be informed. that means TSA, DHS or what ever group. If you did this for better security work WITH them. Acting like they should automatically know what you've done is just stupid, what ever his purpose it wasn't done the correct way, which means in the end it wasn't done for the right reason. If you honestly think it's something to expose, start by telling the company and if they insist it's unimportant that's when you announce it to the world. If it is still ignored then you should consider sharing instructions/devices/ or what ever with the world.
It's trademark infringement if it can be reasonably confused with the genuine article. These boarding passes purported to be genuine, so it is infringement.
Does NOBODY see the irony here?
The government is putting him on the No-Fly list, BECAUSE HE RELEASED A PROGRAM THAT ALLOWS PEOPLE TO CIRCUMVENT THE NO-FLY LIST.
So this helps, how?
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
What he did was illegal but it was not wrong. While this is a point of semantics, it is a very important one.
This sig intentionally left blank.
Shame on us! Shame!!
I'm ashamed to live in a country where so many idiots are in positions of authority.
(que up the "then leave" remarks in 3... 2... 1...)
--Phillip
Can you say BIRTH TAX
That would be an electronic boarding pass if it ha a bar code.... Maybe they've changed this since I last flew an airline that did this. Not sure. I just remember being able to get a boarding pass at the gate if you had no luggage. I'm pretty sure that was after 9/11/01, but I may be wrong.
Again, none of the things being discussed would get you on a plane, just into the terminal itself. The point is that requiring a boarding pass to access the terminal is basically a no-op security-wise. It neither adds to nor detracts from security. Similarly, requiring a photo ID effectively becomes a no-op as a result of checking it against a printed customer name rather than the ID on a computer screen after scanning the barcode on the boarding pass.
Check out my sci-fi/humor trilogy at PatriotsBooks.
That the security code is just a string of six letters and numbers, and that I've never seen the people at the checkpoint check that code against anything.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Victimless crime
Victimless crime
Victimless crime
The parent is NOT flamebait. I encourage the moderators to fly El Al sometime. That's real security. If TSA (or whatever agency replaces them when they implode) were to implement that level of security the American people would run to the ACLU. People want it both ways. Sure, banning water is ridiculous (and I have some understanding of the threat posed by liquid explosives), and TSA shoots itself in the foot on a regular basis, but truly effective regulations wouldn't be tolerated. (There you have it. Mod down at will. :-)
How do you avoid corruption in a democratic state, if the people themselves aren't able to audit the actions of the state? By asking permission from the corrupt?
That's what this is. A bunch of people taking paychecks from the people, while not actually doing their jobs, and then when someone blows the whistle, it is the whistleblower who gets punished. That sounds exactly like the situation in China, where---*surprise*---corruption is rampant.
http://outcampaign.org/
We now have a better understanding of the risks of airline travel; We have less of a false sense of security.
http://outcampaign.org/
Oh, and what idiot moderators moderated my original post as flamebait? I hope you get meta-moderated.
But, you don't actually buy boarding passes -- you buy the service. If you used this pass, you would get the genuine article -- a flight on an NWA-owned plane. It would be trademark infringement if you built a whole airline and used this logo for your planes. Selling these passes for the purpose of illegitimately receiving airline travel would just be fraud.
First of all, I think the rule of law is extremely important. The laws (at least in theory) represent the rules agreed to by the people and until the people choose to rewrite them, everyone should abide by them. This allows citizens and foreigners stability (as opposed to anarchy) while giving them control at the same time (as opposed to a dictatorship).
If the laws offend some citizens, they must pursue the legal process for changing them, but not violate them. I think most of the posts today complain that the laws aren't fair, etc. There are ways of having them rewritten. I'd like to see them rewritten. This farce where a well-meaning individual must risk their career to make a difference in the security practices of the TSA could result in a new bill that more clearly defines such things (cited in the TSA letter) as:
To see changes though, this would have to motivate the people. So far, the voters of the USA have chosen to leave things alone. Apparently, the TSA is doing just fine according to most Americans.
Further, I think the case can be made that Chris is innocent of the charges.
If a system fails to control access when its encryption becomes public knowledge, it is not a secure system, in the same way that DRM can never stop piracy. This is immaterial to the case, however, since Chris only provided a web page to generate encrypted data, and did not reveal the key.
I can see your point. However, what Chris has done is akin to publishing a Star Trek replicator's database entry for borg implants. He knows they are dangerous. He also knows that others (like Senator Schumer) have previously published the same information. If someone chooses to load the database entry into their replicator (they would have to intenti
Was it illegal? Obviously.
Was it wrong? Elsewhere in this thread I've already said why it was, but basically: 1) He risked causing an inconvenience to travelers if the governmental response was to reject home-printed boarding passes. 2) He risked increasing security checkpoint delay times because the security people would have to scan the boarding passes to make sure they were real. 3) He didn't publicize anything that anyone with an ounce of computer skills didn't already know.
So, basically, his exercise was pointless, accomplished nothing, and had the possibility of inconveniencing a lot of people. That's "wrong" as far as I'm concerned. If you're going to inconvenience people, there damn well be a better reason than making some headlines for your 15 minutes. And if you're going to make a public website that allows people to print bogus boarding passes in this political/security environment, forgive me if I don't really care if you later complain that you've been added to the no-fly list.
You're wrong :) I've tried this a few times since 9/11 at various airports since I usually just have a carry-on.
I did find it interesting that Alaska Airlines still has self-service kiosks at some airports (San Diego, for instance) in the gate area. When asked about that, they told me it would be too expensive to remove them in hopes they can use them again sometime, as well as the occasional traveler connecting through a non-partner airline could use it without going through security.
This comment does not necessarily represent the views and opinions of the author.
Or maybe he can dig a tunnel to Mexico. He can't use an existing Mexican tunnel, due to all the oncoming traffic...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
One of my favorite Archie-isms.
My mom says I'm cool.
Too Stupid for Arby's (USA fast food joint)
Too stupid to work there, so they're TSA instead. These folks are the lowest form of law enforcement, unable to even qualify as rent-a-cops. Don't you *feel* safer, citizen?
Seems to me this is all not about security. If it were, they would welcome the guy. This is really about dominating the population. ''You have an inconvenient opinion? Sorry, our software says you are a potential security risk. No airtravel for you....''
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Don't fuck with us, because we'll fuck with you.
It's disappointing how far things have gone off-track.
--
Don't like it? Respond with words, not karma.
The TSA guy aren't idiot. They do not want to investigate the kid to make the problem go away, they want to send a STRONG message to other kid , or heck, security researcher : "do the same stunt and we will make sure you will sooooo buried in shit that you can say goodbye to your carrier, flying/travel freedom, and peace of mind". In other word they are trying to implement self-censorship through fear.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
It goes without saying that for anyone gullible enough to think that they can get away with doing something like this under their real identity... (fill in the blanks)
This is the one time where I would categorically have advised to consult with an attorney beforehand, so that he could have understood the type of trouble he might be in for pointing this out the way he did, and releasing the software in the wild.
It really doesn't seem very smart to go about it headfirst like this, and he is paying for it now.
Maybe we need 'whistle-blower lawyers', or at least courses in responsible and perfectly safe whistle-blowing?
There has to be a better way to force the TSA to fix their flaws.
Z.
<conspearacy theory>
I know this is an extreme comparison, but how'd that sort of thing work out for Karen Silkwood? She went old-school public and got killed! Perhaps the immediate notoriety offered by the web is "safer".
</conspearacy theory>
It must have been something you assimilated. . . .
Well at least they are doing something proactive to catch kids wanting to see mom/dad at the gate.
I always thought they were strictly reactionary and look for things that have already happened?
When the only tool you have is a hammer, every problem looks like a nail
Certanly the act of embarassing the emperor has to be punished..
FRA: STFU GTFO
Yeah, I'm sure none of the terrorism in Ireland was due to radical Christians. And terrorism may have originated with the Zealots, a Jewish group, back in the first century.
Noo. Were he a criminal, he might have sold the technology to Hizbollah or somesuch without alerting anyone.
I didn't say they fixed it, I said he did it in a way that will force them to fix it.
When the media coverage of TSA goofs occur, they have to respond with a fix. Granted it's another media patch, and yes, you are quite right that SOMEONE doesn't want real security, but that's the Airlines that don't want to do the things like foot a security officer on each flight, add the bulletproof doors, and so forth.
Where "WE" don't want real security, is that "WE" don't want to pay for the upgrades needed. It's money, it's allways about the money here in the US.
A positive attitude may not solve all your problems, but it will annoy enough people to make it worth the effort.