TSA Luggage Lock Master Keys Are Compromised

An anonymous reader writes: As the FBI demand encryption master keys for Apple, Microsoft and Google made devices, photographs of the master keys for the TSA Travel Sentry suitcases have now been published in multiple places online (more links in later articles). Cory Doctorow points out this makes it much easier for thieves to open luggage undetectably, without leaving any signs of lock picking. Whilst many have argued that the locks aren't designed to provide real security, the most important thing is that this shows the risk of backdoors in security systems, especially since the TSA has not given any warning about this compromise, which seems to have occurred in 2014 or earlier.

Comments

I always assumed they were

[drinkypoo]

I always assumed that these keys had been figured out long, long ago. If there's people in Afghanistan who can make you an AK-47 by hand, there must be people in China who can just not assemble the locks and take the parts to a smith (where do you think TSA locks are made?) and get a key made. I'd be surprised if you can't just buy the keys on aliexpress.

Re:I always assumed they were

[Anonymous Coward]

I always assumed all luggage locks were vulnerable, unless you have a hard case with a real lock (e.g. for carrying a firearm... or cheap firearm plus actual valuables). The only reason to use the locks seemed to be as extra protection against the luggage becoming unzipped or or unclipped, and dumping your clothes out. It was a small protection against an inconvenience/minor loss, not a serious protection against potential large losses.

Re:I always assumed they were

[AmiMoJo]

The most annoying part is that luggage sold outside the US often has TSA locks on it. If they put a proper lock on there it would have some value to me, but instead I get to pay for a worthless one that I'll never need or use.

Once the warranty expires I usually fill the lock with epoxy (the main mechanism is a combination lock, the key is just for the TSA goons).

Re:I always assumed they were

[Anonymous Coward]

Me too. I always looked at TSA locks as something that just added a level of difficulty to prevent casual theft--and mostly keep things from accidentally opening.

I don't think a trip to china would be required to reverse engineer these locks... I could just hacksaw one or two open and see where the my key doesn't interface and make a master from that. Easy peasy. I know a key would let you open all of them without detection, but two 9/16" combination wrenches will always open them too.

Re:I always assumed they were

[Holi]

People will amaze you sometimes. https://www.youtube.com/watch?...

Re:I always assumed they were

[houghi]

I always assume that locks on luggage were to prevent accidental opening of said luggage. Never to keep anybody out, be it thieves or anybody else. Those mini-locks are shit and you can also steal the whole bag. It even has a handle to carry it as if it was made for that purpose.

So what I do is use zip ties. Anybody on this site will have plenty of them (or hand in you know what card). That way the luggage can not be opened by accident and I will know if somebody was in my bags. Not that I will do anything with that info, but still.

Re:I always assumed they were

[TheCarp]

A saw a video recently that took this a setp further. Instead of stopping the bag from opening, he took a cable lock, and attached everything in the bag to the cable lock, either directly, or with zip ties. Then any small things were put in another bag, zip tied, and added to the loop.

This way the bag could be opened and inspected, and if they cared enough to cut zip ties, they could look inside the smaller bags, but.... nothing would be easy to just grab and toss in a pocket quickly.

Re:I always assumed they were

[bobjr94]

Just like the story a few years ago about the ATM locks. The atm maker had a picture of a key on their website and click here to order keys. Someone just printed the key out, and filed a blank to match the picture and it worked. They posted the actual image of the master real key on their website. A good locksmith can look at a key and say ' thats a G87 blank with a 4,3,6,3,2 cut' .

Re:I always assumed they were

[blincoln]

Back in 2010, I needed to take my camera tripod with me on a flight, and there was no way it was going to fit in my carry-on. I used a cable lock and some padlocks to attach it to the inside of my suitcase so that it could be taken out and examined, but not detached from the suitcase without cutting the cable, a lock, or part of the suitcase. It worked fine for ensuring that my tripod was still there when I opened the suitcase, but a couple of other things were "accidentally" damaged by the baggage inspectors, so I always figured they didn't really appreciate the concept.

Re:I always assumed they were

[whoever57]

I've always assumed that the baggage screeners were not trustworthy. What's the point of a lock if the thief has a key?

Re:I always assumed they were

[TheGratefulNet]

I used plastic zip-ties the last time I traveled to europe (well over 10 yrs ago). brand new luggage, too.

fucking bastards used tin snips and cut THRU my zipper in order to remove the plastic wire-tie I used. expensive luggage, ruined, and there was no lock to cut, only some wire ties that I used to keep the bag 'safe' while in my posession (I could also tell if it was opened since I used a bright color of wire tie).

did not matter, the bag was cut open, I lost a power supply for my camera storage device (PSD, back in the day we used those..) and got a note in my bad saying 'we opened it'. yeah, like I didn't know.

no way to get them to pay for their damage either.

I would EASILY see how a more unhinged person than me would flip his lid and go al postal on anyone who did this to them. and I would not cry a tear if any TSA or related person was harmed because they fucked with a passenger's stuff or rights. if a TSA person was bleeding and needing help, I'd step over the body while walking away.

those people are lower than shark shit.

Re:I always assumed they were

[Anonymous Coward]

I flew on airlines entirely within the US last year, and had a TSA-approved lock on my checked bag. It was a crappy little lock, not secure at all, and I just used it to hold the two zipper ends together. I never put anything of value in my checked bags. Learned that long ago. TSA apparently didn't have the key for it. They cut through the zipper to open the bag, basically destroying the bag, and then taped it shut with box tape.

Re:I always assumed they were

[Anonymous Coward]

Any locksmith worth his/her salt knows how to impression a lock, so that even a TSA lock with a dimple key can have a key made for it.

Even without the master keys, those TSA locks are not exactly Abloy PROTEC2s, and a good rake pick can pop those open without issue.

Then, there is the issue of 3D printing. As soon as someone makes one key that fits their lock, the 3D file is easily spread Internet-wide for all to download.

If I were to give a TSA lock that combined both security and accountability, I'd probably mention something like Abloy CLIQ technology coupled with a Medeco, Assa, or Abloy cylinder. The CLIQ tech would allow for audit trails on what locks were open and when, as well as lock out keys that disappeared.

However, the CLIQ lock technology isn't cheap. $700+ for a cylinder, and that isn't factoring in the keys, programmer, and other infrastructure items. However, with an economy of scale, that should go down in price. Plus, with the government behind it, that easily will make the technology a lot cheaper.

I just hope the TSA can find a good balance.

I personally have learned the hard way, if it isn't carryon luggage, to put it in an ice chest (Brute/Bison comes to mind), padlock it [1], and have the ice chest FedExed to my destination. Ice chests can handle almost anything, and if Fed Ex loses it, I make an insurance claim, and call it done. This beats dealing with airlines who are only adept at one thing... giving you the middle finger in your face when interacting with them for anything meaningful.

[1]: I small, but secure Abloy locks. It isn't there to be theft-proof, but to function as a seal when the ice chest is padlocked.

Re:I always assumed they were

[jandrese]

Isn't this exactly why "TSA approved" locks exist? Customs has always said that if they want to inspect your bag, they're going to inspect your bag. Putting a lock on it just means you get a broken lock. Doing something weird and crazy with internal zip ties is just asking for it to be slashed open with a knife. It's not their job to give a crap about your luggage, their job is to find contraband.

Re: I always assumed they were

[nehumanuscrede]

Even with a hard case and real lock, they're vulnerable. I had a firearm going through with dual locks and the lovely TSA sticker on it that said " firearm inside ".

Both locks were present when TSA put it on the conveyer belt, only one came out the other side. My guess is some idiot was in the process of cutting them off when they noticed the TSA sticker :|

No way it broke off on its own without damaging the case.

Re:I always assumed they were

[Spazmania]

For anyone who knows how master keys are made, this article is full of "duh." Basically, the tumblers in your lock have two stops: the one that fits your key and the one that fits the master key.

So cut one key for each position, leaving one position not cut. Try the key. Cut the position by one unit. Try the key again. Continue until you find the unlock for that position which doesn't correspond to your key. That's the master key for that position.

Anyone with unfettered access to a lock and blank keys can quickly identify all keys capable of opening it.

Re: I always assumed they were

[Anonymous Coward]

No need to assume. TSA cut them off regularly anyway. The average life for me was about 2 weeks.

I except you will TSA gets cut for each one sold. Like the cost of TSA harassment is built into each ticket. And it is service not a tax. So no write off for most

Re:I always assumed they were

[Anonymous Coward]

The real solution is to just not travel to the US.

Re:I always assumed they were

[fuzzyfuzzyfungus]

It's no surprise that the TSA's physical security is utter shit(gee, hire a bunch of the cheapest flunkies who can pass a perfunctory background check to do thankless shit work for not much money; sounds like the recipe for ironclad loyalty to me!); but I'd actually be curious to know, if anyone here understands keys and bitting codes more deeply than I do:

The TSA joke-locks are sold openly to the public, so you can obtain as many samples of individual key/lock pairs as you wish(limited by cost, of course). We know that the locks can all be opened by the TSA's master key(or keys, though probably a fairly limited number or lookup times would be prohibitive).

In principle, how resistant can such a system be to inferential attacks based entirely on purchased key/lock pairs? Naively, I'd expect that (at least for cheap tumbler locks, the requirement for mass production at an attractive price point prevents us from getting too fancy) an inferential attack mounted purely from legitimately purchased keys and locks would be more or less impossible to resist even with a modest number of samples in the hands of an attacker.

Is this in fact the case, or are there practical master-keyed systems that are largely resilient to attacks that make use of samples of locks and non-master keys?

This seems like the sort of trick that would be much more tractable(if easy to screw up in subtle ways) with crypto, where you can add intricate wheels within wheels for the cost of just a little extra math, rather than a lot of additional fine tolerance machining; but I'm no locksmith.

Re:I always assumed they were

[fuzzyfuzzyfungus]

This is obviously overkill for most purposes; but they make neat serialized and tamper-evident zip ties for this purpose that are designed to be both difficult to remove without obvious damage and impossible to replace with off-the-shelf equivalents.

Re:I always assumed they were

[rahvin112]

Their job is NOT to find contraband.

Their job is to find hazardous materials that are not allowed on the flight. They want you to think their job is to find contraband, make it easier for them to cooperate with the DEA and do their job for them while they get to pretend to be law enforcement (which they aren't).

Re:I always assumed they were

[Anonymous Coward]

The problem is it doesn't require anything weird and crazy. Internal zip ties? How about external ones. After wasting money and having a TSA approved locks cut off, I just used zip ties, on the outside, and loose so there was plenty of room to cut. They still ended up one time taking a chunk out of the luggage, making me wonder how the person using the snips has any fingers left (or maybe that was the problem, they gave the job to someone without any fingers...).

Re:I always assumed they were

[Anonymous Coward]

And your point is that we should accept this behaviour?

Re:I always assumed they were

[Anonymous Coward]

It never occurred to you that they just wanted to send a message?

Re:I always assumed they were

[Anonymous Coward]

He said nothing about "internal" zip ties. You made that up.

If they really "needed" to open his bag (they almost certainly didn't), they could have cut the zip ties. They instead chose to commit vandalism and theft.

And no, that can't be justified by the fact that he did something mildly unusual (or as you dishonestly framed it, "weird and crazy").

Ask yourself why your rationalizations for this behavior require you to lie.

Re:I always assumed they were

[Anonymous Coward]

The job of customs IS to find undeclared contraband. Now if that's conflated into the shit TSA does for "safety" reasons that's another thing.

Re:I always assumed they were

[LiENUS]

Their job is NOT to find contraband.

Their job is to find hazardous materials that are not allowed on the flight.

I'm not sure you understand what the definition of contraband is. The traditional definition has nothing to do with the DEA. The common definition would include anything not allowed on the flight, drugs, weapons, explosives all that crap.

Re: I always assumed they were

[Anonymous Coward]

This is why I pack an armed bear trap. Inspect that . . .

Re:I always assumed they were

[Anonymous Coward]

if a TSA person was bleeding and needing help, I'd step over the body while walking away.

So, you're sure you won't need a piss?

Re:I always assumed they were

[Anonymous Coward]

IIRC it was even better, or it might have been a different story which makes it even funnier. It was an electronic voting machine used by many states in the USA.

Re: I always assumed they were

[Darinbob]

I always include an armed bear.

Re:I always assumed they were

[Obfuscant]

but they make neat serialized and tamper-evident zip ties for this purpose that are designed to be both difficult to remove without obvious damage and impossible to replace with off-the-shelf equivalents.

Neither thieves nor TSA care about replacing your serial-numbered tamper-evident zip ties with something that looks the same, nor do they care if they cause damage when they remove them. You are notified prior to checking your baggage that it is subject to search. If you try to hinder that search, they will simply cut their way in.

And having a serial-numbered tamper-evident zip tie isn't as good an indicator that your bag has been entered and something taken as the fact that something is missing. That zip tie will be in the waste basket of the departure airport, probably hundreds of miles away, doing nothing to protect your baggage. It's a waste of money. At best, it calls attention to your bag out of the hundreds of other possible targets as being more likely to contain something interesting.

Re:I always assumed they were

[tlhIngan]

The most annoying part is that luggage sold outside the US often has TSA locks on it. If they put a proper lock on there it would have some value to me, but instead I get to pay for a worthless one that I'll never need or use.

Once the warranty expires I usually fill the lock with epoxy (the main mechanism is a combination lock, the key is just for the TSA goons).

The purpose of a TSA lock is so the TSA can open and inspect your baggage. They have the right to do so (and many countries I presume use TSA keys as they have that right).

The reason we have TSA keys is because when they inspect baggage, they'll cut open any lock you have on it. And they will not relock it. So now your suitcase has been inspected, and the lock broken, which is how it will remain for the rest of the flight. Which means if someone else wants to go through your belongings, they're completely free to do so as it's now unlocked and easily unzipped, inspected and re-zipped.

The TSA lock means the TSA can inspect your bag, then re-lock it. On a lot of locks, doing this sets an indicator showing the lock was unlocked by the TSA key.

That's the whole purpose of a luggage lock. If you destroy the TSA unlock, then you're not really in a position to complain when you go to fetch your baggage and find it's basically open and its contents have been spilling all over the airport. If you're lucky, they'll use packaging tape to re-seal your bag, but that tape can easily split open.

Re:I always assumed they were

[AmiMoJo]

No, it's pretty much only the US opening bags like this. If they want to do it here they have to get you in and ask you to open it first.

Re:I always assumed they were

[Anonymous Coward]

The point is that you want the thief to have a key, otherwise they will damage the baggage while they are stealing what they want.

Re:I always assumed they were

[Solandri]

I gave up trying to comply with their requirements.

1) Checked baggage is for things like clothes, toothpaste, etc. Stuff that's easy to replace if it's stolen. The airline has been known to lose checked bags you know, even if TSA does their job perfectly.

2) Valuables go in my carry-on luggage. For me that's my laptop and all my camera gear. To save space, some of the cheaper accessories may go in my checked in bag (I put my laptop's mouse in my checked bag once because it was either that or a $700 lens - I can live with a trackpad for 8 hours).

3) Anything that's valuable and won't fit in my carry-on luggage gets shipped via a courier like FedEx who flies their own planes and doesn't have to deal with TSA. Insured. (This is not a 100% guarantee - FedEx, UPS, etc. sometimes put cargo on passenger airliners, where it's subject to TSA inspection. But hopefully the insurance will still cover any damage/theft.) This also saves you a ton of hassle getting into and out of the airport - normally I just have one carry-on bag and one carry-on sized suitcase that's checked. Sometimes shipping stuff like this is actually cheaper than the checked bag fee most airlines now charge.

Re: I always assumed they were

[mysidia]

Even with a hard case and real lock, they're vulnerable.

Until someone secures their luggage with a $200 hardened padlock that even 36" boltcutters can't even put a scratch in?

But Yeah; someone could just swipe the entire luggage case at the luggage pick-up, and now it's "lost" to never be seen again, regardless of how good the lock was

Re:I always assumed they were

[wvmarle]

Once in Korea I was picked out from the passport line: there was a ticking alarm clock in my luggage, and I had to come with them to open my luggage and show what's in. They didn't open it. The TSA destroying bags to inspect them is just sickening and reeks of arrogance and laziness. These "TSA-locks" are just one of the many symptoms of ineffective air traffic security theatre imposed on the world by the arrogant US government.

I never bother to put a lock on my luggage when flying. Those common tiny locks are ineffective anyway. If someone wants to open your bag, they can do anyway - just like the TSA - and you have no way to prove it was a thief, not the TSA, or that even anything was stolen. There's no insurance for checked luggage for that very reason, and it's always advised to not put any valuables in checked luggage. I just make sure my bag is zipped up properly, if a thief (either one working for airport or one that doesn't) wants to open the bag, they will do so no matter what lock you put on it. No lock is maybe even better than a backdoored lock.

Re:I always assumed they were

[ne0n]

You don't need a key for 99% of luggage since they have zippers. 3 seconds with a Bic pen and it's done. Another 15 seconds to zip it closed, Bic it open again, zip closed to make it undetectable.

Re:I always assumed they were

[mjwx]

I always assumed that these keys had been figured out long, long ago. If there's people in Afghanistan who can make you an AK-47 by hand, there must be people in China who can just not assemble the locks and take the parts to a smith (where do you think TSA locks are made?) and get a key made. I'd be surprised if you can't just buy the keys on aliexpress.

Far more likely that they just made a copy of the keys, they wouldn't be that hard to get a hold of. Like you said, chances are they're made in China.

Re:I always assumed they were

[jrumney]

The purpose of a TSA lock is so the TSA can open and inspect your baggage. They have the right to do so (and many countries I presume use TSA keys as they have that right).

No, in most countries the equivalent of TSA request that you open the luggage yourself in front of them if they want to inspect it. Only in the US are they given master keys and the power to open suitcases behind closed doors for the purposes of planting phoney evidence or whatever it is law enforcement agencies do these days.

Re:I always assumed they were

[Vlado]

That is not the case.

I once checked in luggage in Munich, Germany. In the (locked Samsonite) luggage I had a scuba diving flashlight. When I reached my destination, the flashlight was missing and there was a note saying that it will wait for me in Munich upon my return.

I was angry as hell at that time, since a lot of dives required use of a flashlight. But I was also angry, that this happened completely without any interaction with me. Someone could have gotten on the PA system and located me to sort this out.

And I also think that this should be possible in the US as well.
1. If the bag was checked in somewhere then it's reasonably safe at the destination airport as well.
2. If there is an issue during check-in, call me and let's solve that issue.

I do not want people to open my luggage when I'm not present. How can then the question "Did someone put something in your luggage?" be answered?

Re:I always assumed they were

[Anonymous Coward]

The most annoying part is that luggage sold outside the US often has TSA locks on it. If they put a proper lock on there it would have some value to me, but instead I get to pay for a worthless one that I'll never need or use.

Once the warranty expires I usually fill the lock with epoxy (the main mechanism is a combination lock, the key is just for the TSA goons).

The purpose of a TSA lock is so the TSA can open and inspect your baggage. They have the right to do so (and many countries I presume use TSA keys as they have that right).

That's the whole purpose of a luggage lock. If you destroy the TSA unlock, then you're not really in a position to complain when you go to fetch your baggage and find it's basically open and its contents have been spilling all over the airport. If you're lucky, they'll use packaging tape to re-seal your bag, but that tape can easily split open.

My luggage is ancient and I use their combination locks. Only recently did I get one with the TSA keylock, and it's not used for international travel. I travel from Europe to the USA and/or Canada at least 3 times per year with the non-TSA locks on a couple of bags (two bags because I don't travel economy class). I also travel within the USA and Canada by plane, and within Europe and to the Far East (never been to South America, though). How many times have my bags been opened? That's right: none. They've never been opened, even when they've been "lost" temporarily by airlines, and I had to say that US customs could open them, but without handing over any combinations.

Re: I always assumed they were

[rpstrong]

I had a firearm going through with dual locks and the lovely TSA sticker on it that said " firearm inside ".

Where were you traveling? For domestic flights, the TSA puts a tag inside your suitcase, but federal law prohibits them from putting any such identifier on the outside.

Re: I always assumed they were

[anyGould]

Slightly off-topic, but related - is it possible to buy/make a piece of luggage that is TSA-resistant? (Defined as "they don't have easy access to the necessary tools, so it's easier to ask you to open the bag")

Re:I always assumed they were

[Anonymous Coward]

They are quite flimsy and I purchased some and found that all the keys were able to open all the locks even though I had three locks and the keys weren't the same. It would probably be easy to insert a screwdriver to open it up. Since these locks are so cheaply made, you could just insert a screwdriver and turn it forcing the lock to pop open. They would be unable to protect your luggage from anyone who wanted to break into it even if they don't have the special key the TSA has which renders them useless for protecting your luggage. You might as well not even use a TSA approved lock leaving your luggage unlocked since you cannot use a real lock without them cutting it off.

Re:I always assumed they were

[Agripa]

What else is there to do? Anytime we vote for a Democrat or Republican we support these laws and this behavior.

Re: I always assumed they were

[Agripa]

I except you will TSA gets cut for each one sold. Like the cost of TSA harassment is built into each ticket. And it is service not a tax. So no write off for most

It is a tax supporting a job program although since money is fungible it really supports everything and is better called extortion.

if "married with children" were made today

[Anonymous Coward]

al bundy would be a tsa screener...

seriously - is there ANY job you'd be more embarrassed to say a spouse, child (they actually BREED?!?), etc had? "hey, joe, did I see your boy in a blue shirt at o'hare the other day" "naw, man, my boy cooks meth! he's the next jesse pinkman!"

Re:if "married with children" were made today

[CeasedCaring]

al bundy would be a tsa screener...

Al? or Ted?

Re:if "married with children" were made today

[Agripa]

al bundy would be a tsa screener...

You give to much credit to the TSA screeners and everybody above them.

Zip tie

[FerociousFerret]

I always just "lock" my luggage with a basic zip tie. Not meant to stop the TSA from getting in, but lets me know they did.

Re:Zip tie

[Anonymous Coward]

Unless you modified the tie in some fashion that only you would know (for example flattened a few teeth near one end or something) they could simply just put a similar zip tie back on it. I know if I was a thief, that is what I would do.

Re:Zip tie

[Anonymous Coward]

you always carry around zipties in various sizes and colors to re-ziptie peoples luggage that you break into?

the majority of people don't use zipties to lock their luggage.

Re:Zip tie

[Anonymous Coward]

I always just "lock" my luggage with a basic zip tie. Not meant to stop the TSA from getting in, but lets me know they did.

That won't work unless the zippers are fixed to a part of the luggage, if the zippers can move around the luggage together then it's trivial to open and close it without breaking the zip tie. See: https://www.youtube.com/watch?...

Re:Zip tie

[pz]

Have you not seen the videos that show how trivial it is to get into most suitcases which have a zipper, bypassing any locks?

Re:Zip tie

[Anonymous Coward]

Thieves in big corporations generally don't even care about being found out. This is generally a group of accomplices protecting each other, and they're even often protected by the hierarchy for some time (at the least to avoid bad PR, by trying to deny the problem, even internally), as long as it's not becoming too big, and stays within the few percents of "accepted losses", which are simply budgeted in.

Re: Zip tie

[Anonymous Coward]

When i've used zipties, TSA has always left me a note saying they opened the bag. They also used a new zip tie to relock the baggage.(I keep a ziplock bag of zipties in the top compartment of my luggage.)

When I've used keylocks, TSA has never left me a note, but have always opened and examined the contents.

Re:Zip tie

[shabble]

I always just "lock" my luggage with a basic zip tie.

Have you not seen the videos that show how trivial it is to get into most suitcases which have a zipper, bypassing any locks?

Zip *tie*, not zip. You probably call them cable ties.

Re:Zip tie

[Anonymous Coward]

Yep. It's come to that. All I largely care about is keeping the honest and stupid honest and knowing when the TSA (Which probably counts as "stupid" *AND* "dishonest") rifles through the luggage. I've had them leave cards indicating they'd rummaged through all of my stuff 3 out of 10 times the luggage has been gotten into- and I've had a few things "TSA-ed".

Re:Zip tie

[Anonymous Coward]

I always just "lock" my luggage with a basic zip tie.

Have you not seen the videos that show how trivial it is to get into most suitcases which have a zipper, bypassing any locks?

Zip *tie*, not zip. You probably call them cable ties.

A cable zip tie is easier to undo without detection than the zip... you just need a paper clip.

Re:Zip tie

[jabuzz]

Some years ago I got a box of assorted random colour cable ties. Had like 20 each of about 10 different colours. Good luck matching those.

Re:Zip tie

[Anonymous Coward]

Good luck trying to re-zip a zipper that has been locked....

If you don't care about being discovered, and have access to the luggage... seriously, we don't consider electronic devices safe if you have physical access to them, why would you consider physical things being safe? They are called box cutters. Or if you're a kid... a sharp pair of scissors.

Re:Zip tie

[gstoddart]

I'm sure the GP knows that.

Splitting open a zipper isn't rocket science ... googling tells me you just need a pen.

Zip tie, padlock ... easily bypassed with a pen and popping the zipper open.

I'm pretty sure your use of zip tie wasn't missed.

Re: Zip tie

[kuperman]

When i've used zipties, TSA has always left me a note saying they opened the bag. They also used a new zip tie to relock the baggage.(I keep a ziplock bag of zipties in the top compartment of my luggage.)

I've actually used a variation on this. I'll use a green ziptie to close the zipper on my luggage, but the bag of zipties that I have in the luggage are all red. I carry the green zipties in my carryon (along with nail clippers to help remove it if needed) so I can replace it as needed. If the TSA opens it up, they'll either use no zipties or one of the red ones.

Re:Zip tie

[codeButcher]

Some years ago I got a box of assorted random colour cable ties. Had like 20 each of about 10 different colours. Good luck matching those.

Unless the thief got the same sort of box....

Re:Zip tie

[Anonymous Coward]

Every time I fly I find their "We searched your luggage" card at the very bottom of my suitcase, as if they want to remind me that they fondled all my stuff. And I carry any valuables on my person because I know they'll end up on eBay if I check it.

(captcha: 'rectum'. lol.)

Re:Zip tie

[codeButcher]

I always just "lock" my luggage with a basic zip tie. Not meant to stop the TSA from getting in, but lets me know they did.

Earlier this year I had my first visit to the USA since 2001. Not usually having to bother with all things TSA on my side of the ocean, I enquired from an US-based travel agent about the desirability of a TSA-logoed locking device. She also recommended the ziplock/cable tie approach, which I followed without problems (nail clipper to trim, extras in the top of the bag).

The ziplock alone of course does not prevent loss. But it does look cheap (in the derogatory sense of the word), especially if used in combination with some older cheap generic worn-in luggage. Don't make it look worthwhile to see what can be pilfered from it. Lastly of course you don't pack anything in it that will set you back a nontrivial amount to replace or even some serious sentimental heartbreak - you've got carry-on for those items (scanners can see through locked bags after all, so what do you show them?). So it's more an exercise in risk lowering rather than risk elimination.

Where I come from, the saying is that you don't need to run faster than the lion - only faster than the slowest guy in your hunting party. I imagine the slowest guy being the one trying to show off with material possessions, and having that super-expensive TSA lock on his shiny underpants container.

Re:Zip tie

[jandrese]

If someone actually cared enough to try to be sneaky with this, it's pretty easy to remove most zipties with a spudger or really any flat object. Even just a fingernail in some cases. Back when I was a poor college student I would reuse zip ties several times for different tasks because I couldn't afford to buy new ones. I'm sure you could make ones that are harder to defeat, but those won't be the ones you find 100 in a bag for $5 at Big Lots.

Re:Zip tie

[jandrese]

If someone is popping the zipper they could just pull out a knife and slash the luggage instead. Don't check valuable easy to steal objects. That stuff is for carry on.

Re:Zip tie

[Anonymous Coward]

And this is why I don't bother to lock my case.

Lets thieves know that there isn't anything worth their time.

Re: Zip tie

[mlts]

I also use a variation. On eBay, one can buy 50 of the padlock style seals, each with an individual number. I toss one on, log the number somewhere, and call it done. Yes, the seal -could- be duplicated, but it wouldn't be a casual effort, and if someone has the cash to duplicate the seal and its serial number exactly, I'm hosed anyway.

Of course, I've found that I'm best off using FedEx and sending all but my carryon stuff that way. I use a padlockable cooler, toss my stuff inside that, make sure it is well packed, padlock the corners, and let FedEx handle that. That way, the only thing I have to get at the destination airport is out of there.

Re:Zip tie

[fuzzyfuzzyfungus]

There are more sophisticated variations(assorted microdots and customized taggant DNA sequences and other such stuff); but the DIY suggestion is to pick up some of the 'glitter' nail polish with little shiny bits floating in it.

Apply a glob of that to whatever you want to be tamper evident, photograph from several angles(ideally with and without flash/direct illumination). Trivial enough to break through; but duplicating the distribution and orientation of little flakes of glitter suspended in transparent lacquer is...less than entirely trivial...and you have to get it right or the pattern of reflective and non-reflective areas at various angles will be notably different.

Given that the TSA could probably open your bag and defecate in it and you'd get nothing but, possibly, a form-letter apology after six months of wrangling it isn't clear that it's worth the trouble; but you'd have to annoy some moderately serious spooks for such a mechanism to be cloned after opening your luggage.

Re:Zip tie

[Loconut1389]

I just use the normal combo suitcase locks we used to use before the TSA. They're not immune to anything particular, but the TSA will have to cut them off if they want into the bag. It's tamper evident and keeps the bag more secure up to the point they decide they want in. I've only had it cut off maybe 1 in 3 flights, so in general I think I come out ahead. Of course, I'm also aware that the lock is only there for tamper evidence- there's always the old zipper meets bic pen trick.

https://youtu.be/wpIJVWXsBBI?t...

Re:Zip tie

[gstoddart]

Well, if it's a self healing zipper, which it likely is ... I can pop open the zipper, and close it back up and you will never know.

If I cut the luggage, that's pretty much impossible to miss.

Which means I can steal your stuff, and until you get home and unpack your suitcase, you'll never know.

Obviously don't check expensive stuff. But this lock being easier to open than we thought doesn't make you any less secure than it already was.

Re:Zip tie

[Impy the Impiuos Imp]

I can pop open the zipper, and close it back up and you will never know.

If you pop open my zipper, you will know!

Haw haw haw!

Re:Zip tie

[koyangi]

I was flying home from a martial arts tournament and had all my dirty gis and rash guards in my carry-on because uniforms are not cheap. The TSA guy stopped me after the X-ray and asked if I minded if they searched my bag. I told him to be my guest but described the contents and told them I was on my way home not heading out at which point they thanked me and sent me on my way...

Re:Zip tie

[bloodhawk]

So what exactly does the zip tie offer you? it isn't like you can do anything about them opening it, so knowing gives you nothing, zip tie is zero protection from a thief as they don't even need the masterkey and even if it is cut you have no way of knowing it was TSA or thief so not sure exactly what you achieved. At least with a TSA lock you prevent the opportunistic thief.

Re:Zip tie

[chihowa]

Well, if it's a self healing zipper, which it likely is ... I can pop open the zipper, and close it back up and you will never know.

If the zipper is locked, you'll have a hard time re-zipping it. The point of the lock is to make surreptitious entry to the bag more difficult.

Re: Zip tie

[Agripa]

When i've used zipties, TSA has always left me a note saying they opened the bag. They also used a new zip tie to relock the baggage.(I keep a ziplock bag of zipties in the top compartment of my luggage.)

I do this also however TSA has *never* used my included zip ties or their own to refasten the luggage and others report them cutting the luggage open instead of the zip tie.

Might as well use twisted piano wire as a fastener so you get the satisfaction of ruining their diagonal cutter or knife.

Wow ...

[gstoddart]

So this was kind of inevitable with a master key.

Now we have the choice between having our luggage effectively vandalized as the morons at TSA cut off locks ... or having massively insecure locks to prevent the morons at the TSA from cutting off the locks.

Thanks a lot, assholes.

And, now, tell us ... just how much scrutiny are the luggage handlers under while they work? Because between the opportunity for smuggling (which they've done) those guys have a better chance of putting a bomb on a plane than anybody else.

So much security theater, so little actual benefit.

Re:Wow ...

[MitchDev]

"So much security theater, so little actual benefit."

Nice to see someone else "gets it" instead of just cries "But the terrorists! Think of the children!"

Re:Wow ...

[i.r.id10t]

Actually, if you travel with a firearm - and the action from a sub-$100 single shot shotgun qualifies as such - you can use real locks on your luggage, it will be inspected in front of you, and then you can properly secure it. And, the airline can't flag it as having a firearm in it...

Bonus is if the luggage doesn't make it you get to ask "You gonna call the BATFE or am I?" and stuff gets found really quick.

https://www.tsa.gov/travel/tra...

Recommended to print out the policy for whatever airline you are traveling on as well... but this works for lots of folks.

Re: Wow ...

[Anonymous Coward]

I fly with actual

Re: Wow ...

[Anonymous Coward]

Sorry, mobile interface got me. I fly with actual guns when possible, but I've read that photographers commonly use starter pistols for this purpose. Beware though, often the TSA doesn't know the rules and will force you to let them violate federal law, or miss your flight.

Re:Wow ...

[Ol Olsoc]

And, now, tell us ... just how much scrutiny are the luggage handlers under while they work?

Dunno if you remember this little incident:

http://gawker.com/5852669/tsa-...

Short version, TSA agent finds a personal vibrator in a woman's luggage, and leaves her a note:

"Get your freak on girl!"

Unfortunately for the snoopy - probably sniffy - TSA agent the woman was a fairly well known blogger.

So not much oversight, it would seem.

Re: Wow ...

[Anonymous Coward]

Sorry, mobile interface got me. I fly with actual guns when possible, but I've read that photographers commonly use starter pistols for this purpose. Beware though, often the TSA doesn't know the rules and will force you to let them violate federal law, or miss your flight.

You can also use anything that looks like a gun for this purpose.
Even airsoft pistols suffice.

Re:Wow ...

[Scutter]

I don't think anyone (other than paid-for politicians) is saying anything other than "security theater". In fact, the TSA is pretty widely denounced as being expensive and useless.

Re:Wow ...

[Anonymous Coward]

The point of the locks isn't to make it impossible for your bag to be opened, it's to make it harder to open than the guy who didn't lock theirs. Even if you had a truly secure lock, someone could just take a knife and cut open most bags.

Re: Wow ...

[Anonymous Coward]

Plebs. I never fly commercial.

Re:Wow ...

[Jason Levine]

just how much scrutiny are the luggage handlers under while they work?

About the exact same amount that the TSA provides in actual security - which is to say effectively zero. There are multiple stories from multiple sources of equipment being checked in luggage and then disappearing during transit when the luggage is checked.

Previously, you could lock your luggage to help prevent this (or at least give visible evidence of tampering), but now the TSA mandates that you use their insecure locks or don't lock your luggage at all. That's like an organization requiring all computers to either use "12345" as the password or not have any password on them at all. So now if you want to bring expensive equipment with you, your best bet is to bring it in carry-on or to ship it (FedEx/UPS).

Re:Wow ...

[evilviper]

Now we have the choice between having our luggage effectively vandalized as the morons at TSA cut off locks ... or having massively insecure locks to prevent the morons at the TSA from cutting off the locks.

You didn't seriously think a lock provided any security, did you? I mean, you're locking the ZIPPER, of a CLOTH suitcase...

Do you also padlock paper bags so nobody steals your lunch?

Re: Wow ...

[qwijibo]

Airsoft pistols are not legally classified as firearms. I would recommend against declaring one and hoping to explain how you're scamming the system if your bag ever disappears. Why give someone (who is probably already annoyed to be dealing with a lost luggage report) a reason to figure out whether or not it's illegal to declare a non-firearm as a firearm?

There are plenty of options, for anyone who isn't a felon. Blank guns and black powder pistols are available via mail order with no additional paperwork. For anyone who is not adverse to filling out a 4473, there are many options in the ~$100 range, and many worth actually having and using for ~$300. Think of the cost as a one time investment in baggage insurance.

Every time I've flown with a firearm, it only takes me a few extra minutes to check my bag with one of the ticketing agents, fill out the declaration card, and have my bag x-rayed. Even flying out of California, I've never run into an airline employee that wasn't familiar with the process for checking firearms. East coast could be different, I've never flown there.

Re: Wow ...

[Anonymous Coward]

Just throw a cheap AR-15 lower or equivalent in the luggage. The BATFags consider it a firearm even though it...well, won't fire without other parts.

Re:Wow ...

[gstoddart]

You didn't seriously think a lock provided any security, did you?

Fuck no. You'll notice I said "TSA morons" twice, as well as security theater, and said this was inevitable. I hadn't thought I'd given any suggestion I had any confidence in the whole thing.

I mean, you're locking the ZIPPER, of a CLOTH suitcase...

Mine aren't cloth. ;-)

Do you also padlock paper bags so nobody steals your lunch?

Oh hell yeah, keep those thieving bastards away from my PB&J at all costs ... I even put a rabid squirrel in just in case someone gets past the lock.

I also keep my Lucky Charms in a safe.

Re: Wow ...

[Anonymous Coward]

Same rough procedures. And you're offering SOUND advice. And they have such NICE black powder cap-n-balls that you probably do want to have as luggage insurance.

Re: Wow ...

[Anonymous Coward]

If you fly out of New York without a permit for that firearm, you will be arrested in the airport.

http://www.theblaze.com/stories/2013/04/02/pregnant-mom-arrested-in-new-york-for-unloaded-handgun-in-checked-baggage/

Re:Wow ...

[swb]

Declaring a firearm in your luggage has always gotten me first-class VIP treatment.

The last time the counter agent closed the line behind me so she could get her supervisor to make sure everything was handled correctly (and probably to keep the people behind me from flipping out, they want to SEE the firearm).

Then they usually walk me over to TSA where my bags are hand-inspected by the TSA before letting me apply my own, high-quality locks to my bag. I'd swear its saved line-standing time.

The only marginal experience was in Laughlin/Bullhead City, which is barely an airport.

There the gate agent wanted some county sheriff to verify the weapons were unloaded. Since I don't want to make anything easy for a thief, I use trigger locks AND cable lock through the action and/or cylinder, yet Deputy Fife wanted to try to open the cylinder on my revolver AND work the action on my Glock, despite the fact the loading or firing of the guns would have been physically impossible. I actually had to say "Careful, I don't want the action damaged from the locking cables!" before he realized how stupid he was.

Then I had to argue with the TSA agent who didn't want to let me lock my luggage with a secure lock. Fortunately I also carry a recent, laminated copy of the TSA web pages requiring secure locking of checked firearms. "You can't use your own lock." "Yes, I have to, it's your own TSA requirement. Read this." He was pissed, but less pissed than he would have been telling his future colleagues on the Laughlin casino janitorial squad about his past job as a TSA agent.

Strangely the Vegas airport seemed less interested in hand-inspecting my gun case and just ran it through the machine. I told the agent "Those firearms will glow like Christmas on the screen" and the TSA guy said "If we had to hand inspect all firearm luggage at this airport, the lines would extend into the parking lot."

The craziest experience of all traveling with a firearm was trying to check into the Venetian in Vegas. I wanted to check my weapon with security and asked the woman at the desk and she said "Oh, security is just across the casino floor." I wondered how far I would get across the casino floor with a locked aluminum case without being tackled or answering questions from Clark County Sheriffs. As it turns out, I made it with five feet of the entrance before being stopped by two armed guards. They were really nice and took my down to security, checked my weapon, gave me a receipt and let me ride the VIP elevator to my room. On check out, the head of security released my weapon and I asked him if I had broken any laws bringing it on property. He said it wasn't a problem at all, happens all the time but was concerned the check in desk wouldn't page security for me. I thought the armed escort to my cab was a bit much, but again, VIP treatment!

Re: Wow ...

[Anonymous Coward]

Worse - if you have a stop over in a NY airport, and your flight is canceled, you can and will be arrested immediately upon taking possession of you bag, due to the NY SAFE Act. Which is in violation of the Firearm Owners Protection Act, which allows interstate transport of firearms through firearms unfriendly states.

Of course if you REALLY want to have fun, check an NFA item. Short barrel rifles, short barrel shotguns and suppressors....

Re:Wow ...

[ahodgson]

http://www.cnn.com/2015/04/13/us/airport-luggage-theft/
https://www.rt.com/usa/tsa-stealing-from-travelers-358/
http://www.huffingtonpost.com/news/tsa-thefts/
http://abcnews.go.com/Blotter/top-20-airports-tsa-theft/story?id=17537887#.UIa7fGmfHft

Re: Wow ...

[OverlordQ]

She didn't have a stopover in NY, she was flying out of NY.

Re:Wow ...

[amicusNYCL]

The worst experience I've had was, in all places, Texas. They didn't want to let me fly out of the airport with a shotgun case that was literally wrapped in heavy-duty chains, with a large lock. They thought the case was still able to be opened too much even with the chains wrapped around it (no matter that the only people who could take advantage of that, and have shotgun shells in their pocket just waiting for a weapon, would be their people). They made me go to the gift shop and buy a flimsy cable and lock to satisfy them. This was on the return trip, too. When I flew to Texas from Phoenix they looked at all the chains and just laughed at how ridiculous it looked.

Re:Wow ...

[Anonymous Coward]

Lets face it, anyone willing to go to the effort to create a TSA masterkey and has the required access to your bags and the desire to do bad shit was always going to get into your bag TSA key or not.

Re: Wow ...

[Agripa]

There are plenty of options, for anyone who isn't a felon. Blank guns and black powder pistols are available via mail order with no additional paperwork. For anyone who is not adverse to filling out a 4473, there are many options in the ~$100 range, and many worth actually having and using for ~$300.

"Antique" muzzle loading firearms meaning those produced before 1898 and replicas of such are not "firearms" for the purpose of federal law and even felons may own them unless state law says otherwise. I assume TSA would treat them as firearms however.

If I were doing this and did not have a suitable firearm already, I would use an old junk shotgun receiver.

Re: Wow ...

[Agripa]

She didn't have a stopover in NY, she was flying out of NY.

It would not have mattered although in both cases she should have been protected by federal law if she was just traveling through New York and was legal at her starting point and destination.

Hunters traveling to Maine with firearms are arrested by New York if their plane is diverted do to bad weather. New Jersey, Illinois, and Massachusetts do the same thing. This is despite the 1986 Firearm Owners Protection Act:

https://en.wikipedia.org/wiki/...

Re:Wow ...

[Agripa]

Then they usually walk me over to TSA where my bags are hand-inspected by the TSA before letting me apply my own, high-quality locks to my bag. I'd swear its saved line-standing time.

At some point thieves are going to catch on to this and high quality locks will become the new "steal me" tag like when they placed a tag indicating a firearm on the outside of the luggage.

Re:Wow ...

[swb]

Maybe, but it significantly ups the risk ante.

Stolen laptops, jewelry and other luggage content miscellanea ranges from forgetful fliers who lost their belongings elsewhere, insurance fraud by a flier or petty larceny by airport employees. These items pocket easy and walk out easy. You don't even know it's gone until you unpack your stuff, hours later. Call your insurance company, read our baggage disclaimer. Shit happens.

Stealing an entire locked piece of luggage is harder. A bag containing a firearms that doesn't make it to its destination will be flagged the second the baggage carousel stops turning. An immediate report will be made.

Stealing firearms in interstate commerce is a serious Federal felony. It's already proven and noted that the flier checked a firearm, so flier fraud isn't even a question. The chain of custody is established. He had it, the airline took it into their possession.

Anybody involved in the luggage chain at both airports is going to be scrutinized. Airport police, TSA and maybe even BATFE will perk up. Hard questions will be asked. Employees walking out with entire pieces of luggage will be remembered. Surveillance video will be reviewed. Searching will take place.

And the airlines won't like, it, either. People who travel legally with guns tend to be stand-up citizens with money to spend who know their rights, maybe with lawyers on speed dial. Cages will be rattled, PR will be in play. "We don't care if your earrings got stolen" plays bad already, "We let your gun get stolen" plays worse.

Re:Wow ...

[Agripa]

I wonder how well securing luggage with a firearm actually helps though.

They did not change the rule regarding putting the "steal me" firearm tag on the inside of the luggage without reason and the same penalties applied back then. I assume the smart thieves broke the luggage open after seeing the tag, stole the firearm, and put the luggage back. Certainly that happens with high value personal items now, so why would this be different from firearms except for the penalties? This would apply to handguns but not long guns though.

Offhand I do not know of any incidents where packing a firearm for extra security created a more thorough response when the luggage was reported stolen but my sample size is low. I would still do it if possible.

Re:Wow ...

[swb]

I wonder how they get away with stealing items from luggage at all.

Your typical baggage handler has too much work to do to spend a lot of time rifling luggage, and presumably opening passenger bags would raise questions with the other baggage employees.

I would guess the worst offenders were probably post-9/11 TSA baggage inspectors who were poorly supervised and had a reason (and some time) to open luggage at random. Small items that could be pocketed quickly and invisibly would be prime targets.

Locking those bags so they can't easily get into them is probably a decent deterrent -- even they have a schedule to keep up with, and an obviously jimmied and mangled bag is going to reduce down to a small number of possible culprits.

At this point, I would expect it to be pretty hard -- video surveillance is ubiquitous, employment screening even in heavily old-school unionized airports is probably a lot better than it used to be, so you filter out the obvious criminal element up front.

that's what FedEx/UPS are for

[turkeydance]

since 2003, i've shipped what i don't carry on. so far, so good.

Re:that's what FedEx/UPS are for

[Anonymous Coward]

Smart, because Fedex/UPS are cheap, completely secure and you get your luggage 1-2 days after you arrive as an added bonus.

Re:that's what FedEx/UPS are for

[jandrese]

I was just wondering how much you could ship via FedEx for the $25 airline baggage fee? Certainly not 23 kilos in a 1m x .6m x .4m bag. The checked bag fee starts to look almost reasonable when you consider the price of bulk shipping.

Re:that's what FedEx/UPS are for

[NetNed]

Well if you are not half an idiot you can do this think called "planning" and your luggage will be waiting for you at your final destination. Funny how that works, huh?

Re:that's what FedEx/UPS are for

[Anonymous Coward]

Yes, I have a lot of time to plan out my luggage logistics when a family member is ill or passed away and I'm on the next flight to wherever.

As if

[MitchDev]

... we needed another reason not to fly...

Government is inherently insecure.

[Anonymous Coward]

Every time I hear a government official saying that we should trust them with secrets. I think to myself... but do I trust your 2 million other colleagues. Even in the classified space, there are going to be dozens of people with access to even the most classified information. To lesser classified information that number can be thousands or tens of thousands even. Our adversaries with any intelligence capabilities will almost certainly know a great deal more than the American public will. That doesn't mean secrets aren't important to keep. It just means if your system is relying on keeping secrets for any length of time that is a fundamental security risk and flaw in the system. With luggage you still have to have physical access to the luggage to gain access... which can be mitigated with security cameras in luggage handling areas. With software encryption for communications it is far easier to intercept without being observed.

Re:Government is inherently insecure.

[Anonymous Coward]

Every time I hear a government official saying that we should trust them with secrets. I think to myself... but do I trust your 2 million other colleagues. Even in the classified space, there are going to be dozens of people with access to even the most classified information. To lesser classified information that number can be thousands or tens of thousands even. Our adversaries with any intelligence capabilities will almost certainly know a great deal more than the American public will. That doesn't mean secrets aren't important to keep. It just means if your system is relying on keeping secrets for any length of time that is a fundamental security risk and flaw in the system. With luggage you still have to have physical access to the luggage to gain access... which can be mitigated with security cameras in luggage handling areas. With software encryption for communications it is far easier to intercept without being observed.

That's how you know who the real enemy is.

I always figured

[itsenrique]

Since the 'TSA Approved' luggage locks came out, I always assumed they had had backdoor access of some sort. I mean, what else would that seal/approval even mean? It's important to note that most luggage locks look like a good whack or the flimsiest of bolt cutters would be their end, but having a master key lets them snoop on your luggage without leaving nearly as much trail. Good that its now out in the open completely for those who couldn't read between the lines. And no I'm not some grand conspiracy theorist, I just couldn't fathom why else we suddenly needed 'TSA Approved' locks to fly with.

Re:I always figured

[kimvette]

> Since the 'TSA Approved' luggage locks came out, I always assumed they had had backdoor access of some sort

What clued you in after the key cylinder and the instructions and diagrams which explain the "lock has been opened" indicator failed to? ;)

Re:I always figured

[Anonymous Coward]

Umm this is not and never was a conspiracy - it was 100% known from the start that the TSA approved locks had a master key specifically so the TSA could open your luggage. The point was a lock that non-TSA can not open your luggage but TSA can. The result is securing your luggage from other baggage handlers or if lost.

Have you never flown in your life? Do you not have your locked luggage handed back to you with a piece of paper saying checked by TSA?

Re:I always figured

[gstoddart]

I always assumed they had had backdoor access of some sort.

Why would you have had to assume anything ... that slot designed to push in a master key and be opened is pretty plain. That this can happen is printed on the instructions of any of them I've ever seen.

Good that its now out in the open completely for those who couldn't read between the lines. And no I'm not some grand conspiracy theorist, I just couldn't fathom why else we suddenly needed 'TSA Approved' locks to fly with.

Dude ... are you dense? They've flat out said those locks are designed to be opened by them with a master key.

You never needed to read between the lines, it's been printed on the instructions as long as these have existed. Their entire purpose is to be a lock they don't need to cut off if they want a closer look ... and that has been pretty well published.

How you're only now realizing they've had master keys or think they've been hiding this fact is kind of mind boggling.

This has always been out in the open. Which means apparently everybody except you has known this for over a decade.

I'm actually surprised it took this long to compromise the master key. Because that was pretty much always inevitable.

Re:I always figured

[advocate_one]

having a master key lets them snoop on your luggage without leaving nearly as much trail

this is why I use bits of cotton thread strategically laid inside so that if they rummage around, the threads get all mussed up...

Re:I always figured

[blincoln]

Not all of the TSA-approved locks have both of those features.

I have a Master padlock with a single keyway that will accept either the included key or the TSA key and no "opened" indicator.

I also have a combination lock that can be opened with the TSA 004 "key", but because the "key" is an L-shaped piece of metal, it might not be obvious to everyone that that's what the hole on the bottom is for. That one also doesn't have an "opened" indicator.

FWIW, the "opened" indicator is a bit of a joke anyway. On the one TSA lock I have which has it, it's pretty easy to prevent it from being able to pop up while the TSA part of the lock is picked, and as long as it's held down until the lock is closed again, no one would be the wiser.

Evidence of lockpicking

[phantomfive]

I didn't know it's hard to pick a lock without leaving evidence of lock-picking.....what kind of evidence are they looking for? Scratch-marks on the pins?

Re:Evidence of lockpicking

[Anonymous Coward]

Also dents on the pins.

When a lock is being picked, there is a fair bit of tension on the lock. It will give similar marks to as if someone inserted the wrong key and turned as hard as they could.

Re:Evidence of lockpicking

[thermowax]

I attended this talk at DefCon a few years ago- very interesting.

https://www.defcon.org/images/defcon-17/dc-17-presentations/Datagram/defcon-17-datagram-lockpicking_forensics-wp.pdf

So this is what it was...

[Anonymous Coward]

I saw this lock on my new new suitcase (bought in Bulgaria nonetheless), even asked the store where is the key... Made a point of the "TSA" label but just could not believe it was actually a master lock for the world's luggage, 'one key to rule them all' style.
Thanks TSA, for killing even the faint perception of luggage security I had!

FedEx's and the airline's shareholders ...

[mschaffer]

FedEx's and the airline's shareholders thank you for their increased profit. However this is not a viable option for many people.
Also, it's not as if FedEx is much better than the airlines. Personally, I have had more problems with FedEx than with the airlines.

Re:FedEx's and the airline's shareholders ...

[winphreak]

I worked for FedEx Ground and... yeah, you're right. Luggage gets the same treatment as any other box or thing that comes through. Suitcases filled with clothes and only clothes should be fine, but otherwise good luck.

Re:FedEx's and the airline's shareholders ...

[ArchieBunker]

At least with those companies you have tracking with packages to see when and where they went.

Lock enthusiasts have known since day one

[Anonymous Coward]

These locks or combination bypasses have three pins and just a few possible heights for each. In comparison the cheapest residential locks have five pins with five heights. If that was not easy enough there are a very limited number of combinations used and the TSA was kind enough to require a number indicating which one on every lock face. Finally these locks are of so poor quality just about anything that can apply light torsion and move in the keyway can be used to open them.

Despite popular belief lockpicking leaves very little trace at all. There are few experts available that even know what evidence looks like and just looking for evidence requires the destruction of the lock. For the curious. Don't be fooled into thinking that a lock returned to a closed state leaves signs of lockpicking that can be readily seen by a layman.

Re:Lock enthusiasts have known since day one

[mlts]

With a rake and a tension wrench, it would be almost impossible to detect picking, much less have evidence that would stand up in court.

This is why it is wise to use seals for TSA stuff, and for non-TSA items, to use high security locks. Nothing is unpickable, but something like a late model Medeco3, Abloy, or Mul-T-Lock is going to either force an intruder to use physical force (which insurance is a lot more likely to cover), or find an easier target.

Unless it's The Luggage,

[Mascot]

never put anything valuable in checked in luggage.

I have one of the old "non-TSA" locks on my suitcase. I have a label on it where it states "code is 0000 while in transit", since I want to set the code wheels to something else in order to avoid accidental openings.

I'd never dream of going on a flight with something of real value to me anywhere but in my carry on. If they want to steal my socks or razor, they're welcome to them.

Re:Unless it's The Luggage,

[gstoddart]

Pretty much this.

When I travel with my golf clubs I put tape on all the locks with the combination printed on it ... because I'd rather make sure they can easily get into it instead of having to do something more drastic.

And my carry on is where all of my electronics get carried. No way in hell I'd trust the luggage monkeys with that.

Will I stop using TSA approved locks? Nope, because I don't want them to have to cut it if they suddenly feel the need.

Do I think I trust the luggage handlers any more or less with those locks? Hell no. They've been caught stealing and smuggling enough to tell me I don't trust luggage handlers at all ... not to be honest and trustworthy, and not to do anything than not give a shit about my luggage. I've seen far too many of them in action.

What's really troubling is these guys aren't under nearly enough scrutiny to know if they're smuggling, stealing, or planting bombs. Because we know damned well they've been caught smuggling and stealing.

Sneaky bypass...

[QuietLagoon]

One time when I was traveling, I used the lock that had a green flag in a window. The flag was supposed to flip to red if the TSA opened the lock with their pass key.

.
When I got home, I looked at the lock and the flag was still green. When I opened the suitcase, there was a sheet of paper left on top of the contents. The paper said something to the effect, "this baggage has been inspected by the TSA".

So much for the red flag on the lock.

Don't even need a key

[Malc]

This is hardly surprising giving that there was always going to be a widely distributed short-list out there. There are many videos like this one on Youtube that show you how to open a case with no or little evidence of tampering without evening unlocking it: https://www.youtube.com/watch?...

Backup for suitcase latches & zippers

[mschaffer]

Of course they are compromised and this is by design. Why else would you purchase a combination lock with a master key?
The only reason I use these locks is because too many suitcases and travel bags are prone to opening when handled by the airline's gorillas that toss your baggage around. The locks can serve as one more item that needs to fail before the contents of your baggage cascades around the luggage carousel.

However, if the TSA thinks that the master key system was secure, why didn't they mention the breach earlier. All agencies have policies on handling sensitive information. If the TSA does not follow their own policies, they should be held accountable at the highest levels.

Re:Backup for suitcase latches & zippers

[shentino]

This just proves they don't care about our personal security.

Re:Backup for suitcase latches & zippers

[Holi]

Not sure why you bring just Hillary into it. Shows a very partisan stance. Nixon, Reagan, Bush, Clinton, Bush, Obama.... All have done things equivalent, some far worse.

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

Considering your chronology, how come you left out Ford and Carter? They were saints?

Re:Backup for suitcase latches & zippers

[U2xhc2hkb3QgU3Vja3M]

Well, Ford did bring us the affordable Model T...

Re:Backup for suitcase latches & zippers

[jandrese]

Traveling around South America recently I noticed that the airports down there have these services where they will wrap your luggage in cling wrap and put a giant sticker on it so you can tell if someone has gone through your luggage. It's an interesting take on the problem and also helps people with shitty suitcases that can't survive airport baggage services.

Re:Backup for suitcase latches & zippers

[andy carrol]

TSA thought that the master key will secure forever. But Nowadays, in the world has many of hackers and they can easily break by the backdoor. US Government should make a strong policies for every security based bag, car and electronics items which can be stolen. Just like this company help you in security items in US. http://www.locksmithsinscottsd...

Re:Backup for suitcase latches & zippers

[peragrin]

That doesn't work as well as you think. I routinely ship thing by pallet and trucking companies that are prone to damaging things will simply rewrap your pallet.

If you use shrink wrap put stickers on your package or leave inside the wrapping. When you cut it off later look for the stickers. If they are missing then you know it was compromised.

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

.... they should be held accountable at the highest levels.

You're dreaming. The highest levels should run for president.

Re:Backup for suitcase latches & zippers

[Known Nutter]

This just proves they don't care about our personal security.

I am certainly no TSA cheerleader, but lets keep things in perspective. The TSA has never claimed to care about your personal security. Their mission statement is pretty clear.

Protect the nation's transportation systems to ensure freedom of movement for people and commerce.

https://www.tsa.gov/about/tsa-...

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

Not that guy, but I'd say Ford wasn't in long enough to do much of anything, except take aggro for Nixon, and Carter was a real nice guy who meant well. Unfortunately that has nothing to do with being a good president, and he was really bad as a president, especially when it came to the Mid-East stuff. (Such as believing that Arafat was sincere, when he was ten times the crook that Nixon could ever dream of being, and is probably still believing it to this day.)

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

> . . .they will wrap your luggage in cling wrap and put a giant sticker on it . . .

Jesus Christ! The comment wasn't even that long.

Re:Backup for suitcase latches & zippers

[Coren22]

I'm pretty sure that everything the TSA does impedes the freedom of movement of people and commerce, that is kind of their job.

Re:Backup for suitcase latches & zippers

[Coren22]

You might not know this, but those services indicate quite clearly that they rewrap your bag after it is inspected as well, so it really isn't secure in any way.

Re:Backup for suitcase latches & zippers

[shentino]

Ordinarily not caring about our personal security woudln't be that bad.

Except that the TSA is *also* forcing us to accept their interference in our lives if we want to have access to the borders or to the air.

If you're going to impose something on a person you should do so with minimum collateral damage and do your best to avoid inconveniencing them.

Re:Backup for suitcase latches & zippers

[crow_t_robot]

Classified information was SENT to her e-mail address. Who was the fucking knob that took it off the SIPRnet systems to mail across the unclas internet?

Re:Backup for suitcase latches & zippers

[Coren22]

That is likely what the FBI investigation is all about. However, it is part of the job as head of the Dept of State to be able to say "that information is classified".

https://www.whitehouse.gov/the...

So, for her not to be able to say, "hey, this should be classified, perhaps I should report this", and instead forward the emails on, says quite a bit about her.

Re:Backup for suitcase latches & zippers

[Obfuscant]

The only reason I use these locks is because too many suitcases and travel bags are prone to opening when handled by the airline's gorillas that toss your baggage around.

I used to think this, then I realized that it costs much more to replace luggage which has had the zipper pulls removed and zippers damaged by TSA "inspectors" who didn't care that it was a TSA-approved lock and they just wrench the lock off the suitcase.

And if you complain, consider this: what's a great source of names for the no-fly list? Those complaint forms ...

However, if the TSA thinks that the master key system was secure,

What makes you think anyone in TSA believe(s/d) the master key system was secure? Are they the same ones that think searching Gramma to keep her from sneaking a nuke on board is the right way to find terrorists?

Re:Backup for suitcase latches & zippers

[mc551995]

Is TSA luggage bag not secure . Master key should be unique and protective. But I don't think so it is not enough to protect our things. Now i feel really angry bcos i have one.

Re:Backup for suitcase latches & zippers

[Coren22]

Wow, I guess the Hillary fans are out in force, marking a comment that is true as troll because it is inconvenient.

Even Hillary admits that she was wrong now:

http://www.bbc.com/news/world-...

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

They don't. You can put a normal lock on it and I've never had them open the bag. Things might change, though, since South America is importing Muslims now.

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

I don't like Hillary, but I dislike Obama even more, and think her husband & Obama have done far worse as president... just as the post you replied to said. I marked the post troll because pointing out a worse evil doesn't make the original less evil. The only reason to post something controversial and off-topic in a dumb, non sequitur way is to either stupidity or to troll, so I gave you the benefit of the doubt and modded it as a troll.

Re:Backup for suitcase latches & zippers

[Anonymous Coward]

Well, Ford did bring us the affordable Model T...

and John Carter went to Mars...

My Method

[Anonymous Coward]

As someone who has traveled the world -- literally, both for business and pleasure, I have a method that works for me. YMMV.

- If I travel for business, which is now, thankfully rare, I use a carry on only and iron my business clothes in my hotel room or have them serviced if such a service is available. Charged to the business, of course.

- If I travel for pleasure, which is now, unfortunately as rare as my business travel, I carry one carry on with enough clothes for one change. I use hotel services and also thoroughly enjoy buying a clothing item or two in the place I'm visiting. I'm not a fashion follower by any stretch, but I like to pick up a nice mens' button up whilst in Europe, since the quality is inevitably higher and they generally fit better. I also purchase things and mail them to myself -- cost be damned. It allows to purchase nice things and not worry about the goons in the airport hamfisting my goods and questioning me. I also never travel with a mobile phone or technology unless it's business travel.

Oddly enough, I get flagged for further inspection EVERY SINGLE TIME I fly. I'm white, middle-aged, nondescript. I don't get it. Meanwhile, the people I would be frisking are walking by me. Bizarro world. We really do need to take a page from Israel and the methods they use.

Re:My Method

[bickerdyke]

- If I travel for business, which is now, thankfully rare, I use a carry on only and iron my business clothes in my hotel room

Ah. So you're one of those who are always hogging the overhead bins with their suitcase-sized, so-called carry-ons.

I wish that at least cases with wheels would automatically NOT QUALIFY as carry-on anymore!

Well, I can't really blame anyone for avoiding paying extra to have their checked baggage destroyed, lost or stolen, which currently the three service options are that airlines are offering for that extra money they're grabbing. But it would be really nice if we could get back to a state where you had in your carry-on only what you needed during your travel and perhaps if your luggage was a day late. (Which, to me, includes a bottle of water!)

Re:My Method

[Anonymous Coward]

Oddly enough, I get flagged for further inspection EVERY SINGLE TIME I fly.

that isn't surprising...what kind of freak doesn't travel with a mobile phone or technology these days? if you want to blend in you need to look like everyone else and carry the same things everyone else does.

Re:My Method

[Holi]

You fly without luggage. Do you fail to see how that could raise some suspicions?

Re:My Method

[i.r.id10t]

Did a spur of the moment one way flight from N Florida to Denver CO a few weeks ago, only myself and a backpack with a change of clothes, a book, and my phone charger. No questions about any of it. Bought the ticket 36 hours before take off.

Re:My Method

[Bob the Super Hamste]

We really do need to take a page from Israel and the methods they use.

So dump all your carry on shit out on the table, look it over for banned items, then shove it all back in your bag, and do it to everyone.

The last I was over there they had you hold on to your checked luggage for as long as possible. Also there are various stages where various people quickly question you to see if you get nervous or have suspect answers. You only send your bag through the X-Ray machine right before you go through the metal detectors your self and if they do have a question about your bag they would make you take it over to some secondary screeners who make you open your bag dig the item out in question and then they question you about it. In my case it was my old Spotmatic F and lenses. They fired off a bunch of questions to try and trip you up like:
What is in the middle of your bag?
How long have you had the camera?
Did you get the camera from anyone in Israel?
Where did you get the camera?
Do they really take better pictures than a digital?
Also when going through Israeli security they don't have the huge lines of people that the TSA is great at generating. Also all they use are metal detectors and don't make you take your shoes off even if you are wearing safety toe footwear, but in that case they will have you go and step onto a foot X-ray machine for a quick check after the metal detector. Also the Israelis like to say the don't profile but instead reverse profile. That is if you don't fit the profile then you get extra screening.

Re:My Method

[Anonymous Coward]

I can pack 2 weeks worth of clothes and an extra pair of shoes and toiletries in a REGULAR size carry on. You just have to know how to fold. Given it now weights about 14-16kg, and Lufthansa will have a field day with it, so I don't fly them.

Re:My Method

[Anonymous Coward]

You probably get flagged because since you sound like an asshole, I'm guessing you are one in real life as well.

Re:My Method

[Anonymous Coward]

Also all they use are metal detectors and don't make you take your shoes off even if you are wearing safety toe footwear, but in that case they will have you go and step onto a foot X-ray machine for a quick check after the metal detector.

I would rather take off my shoes a thousand times than expose my body to X-rays for non-medical reasons.

Re:My Method

[Anonymous Coward]

OP here. Actually, I carry a black Swiss Army backpack of normal size. It goes under the seat in front of me. I never let my bag leave me sight, even though it contains nothing of value. I use a minimalist front-pocket wallet and wear a passport holder around my neck and tuck it in when not in use.
  Easy peasy lemon squeezy. One would think TSA would like people like me since I represent the least fussy and easy-to-manage passenger.

Re:My Method

[Anonymous Coward]

OP here. I don't travel without luggage. I'm a minimalist. I travel with a Swiss Army backpack only. I don't carry mobile devices or tech because I don't want them rummaged through. As a heavy encryption user, this alone would arouse suspicion from people with IQs no higher than room temperature. I was asked to boot into a Linux laptop once and authenticate. I typed the encryption passphrase so fast the guy was upset by that alone. I changed the passphrase on the plane and again when I got home. The laptop never left my sight. I have been know to purchase a burner phone upon landing and give it a homeless person on the way out. It's fun, keeps them guessing.

Re:My Method

[edtice1559]

The solution for carry-on is easy, but it would have to be mandated. Market forces won't work. Require that all airlines add a $35 carry-on fee to every ticket at the time of purchase. Give passengers a choice on travel day of a tag for their bag (so they can put it in overhead) or the $35 back in cash and check the bag. Guarantee that the overheads will be almost empty. Note that Frontier charges $35 to use the overhead and people absolutely hate it. Feels like a "gotcha" fee. On the other hand even people who would normally rather go face first through a piece of glass than check bags will suddenly be willing to wait at the carousel for their $35. The difference is huge for business travelers where the $35 line item means a separate expense report for the air travel (yuck) and no personal benefit from checking the bag (save the company money) but a $35 refund to the traveler is pure profit. I leave out the ethics here, but boarding would be super-fast and there would not be any overhead space issues.

What a joke

[The Grim Reefer]

I used to get the TSA "approved" locks. But realized years ago what a joke it was. Most of the time they either didn't put the lock back on the suitcase, or simply hooked it on and never bother to actually re-lock it. I found slips of paper in my luggage on several occasions that stated they had to cut the lock. I suppose it was too much effort to even check if they could unlock it.

I ended up having my luggage returned twice with the lock simply hooked on the zippers, but not latched. Usually on my next flight the lock was missing when I picked up my bag. So it either fell off from not being latched, or they simply didn't bother to even put it back. I haven't even bothered with a lock in ten years or so. Perhaps it's gotten better since then.

Re:What a joke

[Anonymous Coward]

Don't worry, it hasn't.

Recheck your luggage after transit

[Anonymous Coward]

There are good locks and bad locks. Most luggage locks are cheap crap, afterall an attacker can simply split the zip. TSA compliant locks are the worst of the bad locks because its so trivial to break in and leave no trace.

It means, even if you put a good lock on it, its no guarantee your luggage hasn't been tampered with, and you should have a good look at the contents before you walk through customs with it. Zip-Tie man below is probably right, its better to use a market zip-tie rather than a lock now.

You can't trust the lock manufacturers to make good locks when an agency has undermined the whole purpose of a lock.

What next, backdoors in Cisco products? backdoors in HP Storage Servers? Backdoors in IP cameras?.... Oh right, we had those already.

Re: Recheck your luggage after transit

[Anonymous Coward]

The lock is not trustable - so it is reasonable to assume that persons unknown opened the suitcase and added the heroin . . .

Re:Recheck your luggage after transit

[Obfuscant]

Zip-Tie man below is probably right, its better to use a market zip-tie rather than a lock now.

I can think of few better ways to get a TSA baggage inspector to rip the pulls off your bag and damage the zipper than to use zip-ties to close it. He gets to choose what to look into and he can't do them all, so what bag may contain more interesting stuff? (Yours!) Then he can either 1) cut the tie or 2) insert a screwdriver or other thin metal implement between the pulls and the bag and twist until something gives. (1) is more polite and less damaging. (2) is faster and teaches you a lesson. Hmmm, which one do you you think will be chosen?

You can't trust the lock manufacturers to make good locks when an agency has undermined the whole purpose of a lock.

If you think the purpose of a baggage lock is to securely lock your valuables so that they cannot be stolen, then it is you who has the misunderstanding of the purpose. The only real purpose of a lock on luggage is to keep the zipper from coming unzipped using a reusable device. (A zip-tie does the former, fails miserably on the latter.)

Not really designed for security

[Bill_the_Engineer]

I use TSA locks to keep the zippers on my suitcase closed. TSA know how to unlock them during inspection and they lock the zippers back in place when they are done.

gentlemen start your picking.

[nimbius]

for those of us in locksport (the art of lockpicking purely for personal enjoyment and challenge) some of these key masters are just criminally bad...the TSA probably asked for masters because they didnt want to break the lock during picking. for example
TSA004: Just a tipped ward. you neednt make a master for this, its already in pretty much everyones kit or some old womans hair serving as a bobby pin. handcuffs have better wards.
TSA003: how many pins is this? who cares, it came off a chinese assembly line and some 7 year old is setting the mechanism. a longing glance is good enough to pop this, but a master is probably an exercise in compliance more than a tool the TSA uses.
TSA001: rinse and repeat, this pin set was determined by the cost of pot-steel, not the security of someones goods.

among the winners however we have...
TSA007: nice...bidirectional pinsets (albeit just 3) will occupy most people for another 2-3 minutes before they pull out a jiggler set/rake and just bitch pick it.
TSA006: I want this. TSA006 has something very, very nice in their luggage and they take it seriously. transverse (lateral) pins, probably a trap pinset in there somewhere. and those rails along the end? what are those, guides? do i have to pick THOSE too? NEAT!

then again, the TSA Dont seriously need masters because theyve been using the ballpoint zipper trick for decades now. its traceless, harmless, and quick. demanding masters seems like a power trip designed to test the limits of what consumers and manufacturers were willing to actually tolerate.

Re:gentlemen start your picking.

[Anonymous Coward]

Most zippered luggage can be opened in seconds with a pen...just jam it in between the two sides of the zipper and unzip. When you are done rummaging, use the still-closed, locked tabs and re-zip. I always assumed this is how TSA does it...it would take too much time to actually unlock the bags they want to inspect.

Re:gentlemen start your picking.

[theskipper]

TSA008: Newbs. Here, stop screwing around and use my Langstrom 7 gangly wrench.

(click)

Re:gentlemen start your picking.

[Anonymous Coward]

TSA006 is just a dimple configuration. I have been doing this for decades and have never heard anyone, professional or amateur say the words "transverse (lateral) pins" outside of active key elements and certainly have never heard of "bidirectional pinsets". Did you mean double sided? They aren't even that. The key is just reversible because the keyway is symmetric. All the TSA locks shouldn't take more than twenty seconds with a modest amount of skill.

Analog Security Holes and Exploits...

[Jahat]

So we now have analog security holes and exploits to worry about. Makes you wonder if all the security holes in programs and operating systems have been there all along as a backdoor for governments and corporations.

Old news - 2014

[wonkey_monkey]

In a 2014 article in the Washington Post a picture of the special tools was included, and while this picture has was later removed it quickly spread. Security researchers have pointed out that it is now possible for anyone to make new master keys and open the locks without any sign of entry, and the locks can now be considered compromised.

Re:Old news - 2014

[GameboyRMH]

AT LEAST that old. I remember at least as far back as 2012, TSA master keys seemed to be easily available on the black market.

Forget the lock

[wickerprints]

I don't understand what the big deal is, considering that the failure point is not the lock, but the zipper itself. Zippers are a fastening device. They were never intended to be secure, and you cannot make one secure by attaching a lock on the pull. The problem is that people think that attaching a lock to anything makes it inherently more secure.

The answer is to never put anything in your luggage that has any value to those who might want to steal it. No electronic devices or jewelry should go in checked luggage. Anything valuable must fit in your carry-on. If you *must* travel with something valuable that cannot fit in your carry-on, ship and insure the parcel ahead of time.

Re:Forget the lock

[Anonymous Coward]

My father once told me "Locks are for honest people." And I see evidence of that nearly every day now.

Re:Forget the lock

[AmiMoJo]

Semi-hard luggage sometimes has a cover that makes it much harder to part the zip in the manner you describe. Not impossible, but difficult enough for any potential thief to simply move on to the next bag. Even just securing the sliders in place can be enough, because it prevents the thief from re-closing the bag and the staff at the airport won't want to leave it open.

A little bit of extra security is usually enough to deter opportunistic thieves.

Re:Forget the lock

[QuietLagoon]

...considering that the failure point is not the lock, but the zipper itself...

Maybe your suitcases have zippers, but mine do not.

Re:Forget the lock

[del_diablo]

Locks simply mean you don't want to be inconvenienced by stuff being stolen.
Its not a hard concept to understand.
Clean clothes, shampoo, maybe a towel. It does not need to be more than that.

Did anyone ever consider these locks "security"?

[Ihlosi]

It doesn't matter that the master key is compromised. A lock to which a third party has a master key is merely an additional safety against accidental opening, not security against unwanted intentional opening by another party.

It just means that even more people can rummage through my clothes. If I'm feeling generous, I'll have only fresh clothes in my suitcase.

One more blunder ...

[DaMattster]

In an agency riddled with stupidity. Sadly, I am Just. Not. Surprised.

Well, duh.

[c]

It's pretty much the definition of "master key" that if a master key exists for your lock, then your lock is compromised.

How much of a problem that is in practice depends on a whole whack of risk factors, but in order to make the TSA screening process any riskier, I think you'd have to outsource it to the prison system.

Warnings

[Translation Error]

To be fair, I don't think we can really blame them for not warning us about the leaks. I mean, this is the TSA we're talking about--they probably still don't know about them.

Use a tamper-detection canary

[Anonymous Coward]

A piece of light-sensitive paper should do the trick.

Another would be two peices of one-time-use adhesive paper or tape that stick together when the suitcase closes then rip apart when it opens.

Even simpler is tamper-evident sealing tape on the outside of the luggage but doing that may draw unwanted attention.

It took that long?

[JustAnotherOldGuy]

There's nothing surprising about this. Hell, I bet these things were compromised ("copied") within a month of deployment.

I've looked at the keys and although they're odd, they're by no means impossible to duplicate. You could 3-D print one in short order or cut one by hand without much difficulty. The whole thing was a bullshit boondoggle by lock and key manufacturers, and only the TSA could be dumb enough to think that it would provide any benefit to anyone.

To quote the write up

[nehumanuscrede]

" without any signs of lockpicking "

When done correctly, there are no " signs of lockpicking " unless you start analysing bits of trace metal left behind.

Besides, it doesn't matter if a pick is used or a compromised master key, locks are for honest folks. Don't put any trust in them to protect your valuables.

from the beginning

[Anonymous Coward]

the locks were compromised when just myself and several hundred thousand TSA thieves had the key to "my" lock

Next hot tech startup

[Rinikusu]

Luggage cams! Every time your luggage is opened, built-in cameras start rolling to capture who/what/how/when.

Beyond zip ties

[Anonymous Coward]

Swing by any friendly truck stop on your way to the airport and ask for a pack of seals. You'll get probably five serial numbered plastic zip tie kinda things. Truckers use them to tamper-proof their trailers, they work really well on luggage too.

Re: Beyond zip ties

[Anonymous Coward]

I did exactly as you mentioned, and now have two Pacific pinnipeds sitting outside in my above-ground swimming pool. Thanks a lot!

Reasons not to fly, courtesy of the TSA

[smooth wombat]

1) Can't make a snap decision to go somewhere and plunk down cash to pay for your flight

2) Lines

3) Having to arrive two or more hours in advance of your flight

4) Lines

5) Removing articles of clothing to prove your innocence

6) Lines

7) Being groped by the TSA agent who has hands like ham hocks and treats every body part like a punching bag

8) Lines

9) TSA and/or airport personnel rifling through your luggage to see what goodies they can find

10) Lines

11) TSA and/or airport personnel cutting locks off your luggage which you put there to prevent them from rifling through your luggage looking for goodies

12) Lines

13) In general, being treated like a criminal by your own government even though you've done nothing wrong

14) Lines

Re:Reasons not to fly, courtesy of the TSA

[Overzeetop]

Yeah. TSA sucks. Unless, of course, you are GOES approved. Did it this year, would never go back. (Note: I have been cleared in the past to TS-SCI, it's not like the government hasn't already crawled up my ass with a microscope).

Now I skip the millimieter, keep my shoes and belt on, the liquids never come out of my (admittedly small) overnight bag in my carry-on, and I have yet to wait in a line at the TSA checkpoints.

That doesn't keep them from rifling through my checked luggage, of course, but it clears up most of your objections.

The lock doesn't help soft luggage.

[Chas]

Just an FYI. You can have a TSA-approved lock on soft luggage and they can just go around it.

Stick a pen into the zipper track itself, pry the first couple teeth apart and it pops open.
To make it look like nobody touched anything, you just run the zipper back around and it rezips everything.

Re:The lock doesn't help soft luggage.

[Kavonte]

I'm not trying to claim that zippers are secure, but does that honestly work as easily as everyone thinks it does?

I've seen the video everyone else has seen, but I also know that when I have a zipper come apart on the wrong side of the slide, I have to spend 15 minutes carefully putting it back together by hand. If I try to just do what is shown in the video, the slide jams up on the two halves of the zipper.

Maybe with just the right zipper it works as easily as shown in the video (though it is on YouTube, so we can't rule out the possibility of deception), but I suspect that it isn't so easy that one can expect it to work every single time, and if it isn't that easy, then it isn't the best approach for anyone who wants to snoop through luggage since, if it doesn't go back together so easily, then they either have to spend 15 minutes fixing the zipper afterwards (which makes it obvious what they've done to anyone who finds them during this time) or they have to leave the zipper split apart which makes it obvious that someone is snooping through luggage.

Re:The lock doesn't help soft luggage.

[Chas]

Pretty easy:

https://youtu.be/tbpKhHwwtiY

Done it myself for practice on my own luggage. The first couple links are the hardest. Once it's moving, piece of cake.

Oh, the irony!

[Anonymous Coward]

Every time the TSA wants to search my carry-on luggage, they ask me to unlock it. My standard reply is, "you've got the TSA keys, feel free to open it." And of course, they reply back that they have no keys!

Re:Oh, the irony!

[Kavonte]

Interesting that they're kind enough to inspect your luggage in your presence. If they would just do that for everyone then we wouldn't have such a problem.

Thomas P. M. Barnett

[ThatsNotPudding]

TSA = "Thousands, Standing Around."

https://en.wikipedia.org/wiki/Thomas_P._M._Barnett/

Re:Thomas P. M. Barnett

[Anonymous Coward]

Actually if they juts stood around people would probably hate them less.

It's that they feel the need to be so pro-actively useless that pisses people off.

That lock is irrelevant

[RubberDogBone]

Look, the keys are one thing but focusing on them misses the big picture. The LOCK -any lock of any kind- is of NO VALUE AT ALL.

To open any luggage with plastic zipper, all you need is an ink pen. Try this. Take a plastic zipper on a backpack or suitcase (does not matter). Take the ink pen and the sharp end HARD into the zipper. POP it's open and you can pilfer ALL YOU WANT. Now, to hide the evidence, merely run the zipper slider around a few times to restore the seal. Done. No keys needed. No tools either which might be suspicious. Only an ink pen which everybody has.

One demo:

https://www.youtube.com/watch?...

Re:That lock is irrelevant

[amicusNYCL]

all you need is an ink pen
Take the ink pen
Only an ink pen

Ink as opposed to what other kind of pen, a pig pen?

Beat them at their own game

[chilenexus]

I just freeze my luggage in carbonite before the trip.

TSA locks are crap

[AaronW]

I put TSA locks on some hard cases and every time I did they were completely mangled when I picked them up, if they even survived to the other end. I've tried multiple brands, they're all crap.

*sigh*

[Mockylock]

And they want us to trust them with encryption keys.

best laid plans of mice and ... common carriers

[mschaffer]

Of course you can plan to have your luggage at your final destination.
What if your carrier doesn't deliver to your destination? (Ever go somewhere remote?)
What if your hotel's mail room didn't get the memo? (Your carrier tracks your package, but what about the destination?)
What if someone steals your stuff from your destination? (I mean, really, how hard is it to steal an unattended suitcase?)
Funny how that works.

TSA most likely to break in anyway

[Anonymous Coward]

The one and only time I've had my bag broken into between point a and point b it was the TSA. They didn't take anything and did leave a nice note saying they'd searched my bag (along with the remains of my padlocks, so no master key used I'm guessing), but still...

As for locks in general: I tend to assume that 99% of the time a thief will target the fanciest looking or least protected baggage, so an oldish bag with a decent looking lock, even if said lock has been compromised, still looks like reasonably good protection.

Comment removed

[account_deleted]

Comment removed based on user account deletion