Slashdot Mirror
TSA Luggage Lock Master Keys Are Compromised
An anonymous reader writes: As the FBI demand encryption master keys for Apple, Microsoft and Google made devices, photographs of the master keys for the TSA Travel Sentry suitcases have now been published in multiple places online (more links in later articles). Cory Doctorow points out this makes it much easier for thieves to open luggage undetectably, without leaving any signs of lock picking. Whilst many have argued that the locks aren't designed to provide real security, the most important thing is that this shows the risk of backdoors in security systems, especially since the TSA has not given any warning about this compromise, which seems to have occurred in 2014 or earlier.
I always just "lock" my luggage with a basic zip tie. Not meant to stop the TSA from getting in, but lets me know they did.
since 2003, i've shipped what i don't carry on. so far, so good.
Every time I hear a government official saying that we should trust them with secrets. I think to myself... but do I trust your 2 million other colleagues. Even in the classified space, there are going to be dozens of people with access to even the most classified information. To lesser classified information that number can be thousands or tens of thousands even. Our adversaries with any intelligence capabilities will almost certainly know a great deal more than the American public will. That doesn't mean secrets aren't important to keep. It just means if your system is relying on keeping secrets for any length of time that is a fundamental security risk and flaw in the system. With luggage you still have to have physical access to the luggage to gain access... which can be mitigated with security cameras in luggage handling areas. With software encryption for communications it is far easier to intercept without being observed.
FedEx's and the airline's shareholders thank you for their increased profit. However this is not a viable option for many people.
Also, it's not as if FedEx is much better than the airlines. Personally, I have had more problems with FedEx than with the airlines.
never put anything valuable in checked in luggage.
I have one of the old "non-TSA" locks on my suitcase. I have a label on it where it states "code is 0000 while in transit", since I want to set the code wheels to something else in order to avoid accidental openings.
I'd never dream of going on a flight with something of real value to me anywhere but in my carry on. If they want to steal my socks or razor, they're welcome to them.
.
When I got home, I looked at the lock and the flag was still green. When I opened the suitcase, there was a sheet of paper left on top of the contents. The paper said something to the effect, "this baggage has been inspected by the TSA".
So much for the red flag on the lock.
Of course they are compromised and this is by design. Why else would you purchase a combination lock with a master key?
The only reason I use these locks is because too many suitcases and travel bags are prone to opening when handled by the airline's gorillas that toss your baggage around. The locks can serve as one more item that needs to fail before the contents of your baggage cascades around the luggage carousel.
However, if the TSA thinks that the master key system was secure, why didn't they mention the breach earlier. All agencies have policies on handling sensitive information. If the TSA does not follow their own policies, they should be held accountable at the highest levels.
for those of us in locksport (the art of lockpicking purely for personal enjoyment and challenge) some of these key masters are just criminally bad...the TSA probably asked for masters because they didnt want to break the lock during picking. for example
TSA004: Just a tipped ward. you neednt make a master for this, its already in pretty much everyones kit or some old womans hair serving as a bobby pin. handcuffs have better wards.
TSA003: how many pins is this? who cares, it came off a chinese assembly line and some 7 year old is setting the mechanism. a longing glance is good enough to pop this, but a master is probably an exercise in compliance more than a tool the TSA uses.
TSA001: rinse and repeat, this pin set was determined by the cost of pot-steel, not the security of someones goods.
among the winners however we have...
TSA007: nice...bidirectional pinsets (albeit just 3) will occupy most people for another 2-3 minutes before they pull out a jiggler set/rake and just bitch pick it.
TSA006: I want this. TSA006 has something very, very nice in their luggage and they take it seriously. transverse (lateral) pins, probably a trap pinset in there somewhere. and those rails along the end? what are those, guides? do i have to pick THOSE too? NEAT!
then again, the TSA Dont seriously need masters because theyve been using the ballpoint zipper trick for decades now. its traceless, harmless, and quick. demanding masters seems like a power trip designed to test the limits of what consumers and manufacturers were willing to actually tolerate.
Good people go to bed earlier.
Airsoft pistols are not legally classified as firearms. I would recommend against declaring one and hoping to explain how you're scamming the system if your bag ever disappears. Why give someone (who is probably already annoyed to be dealing with a lost luggage report) a reason to figure out whether or not it's illegal to declare a non-firearm as a firearm?
There are plenty of options, for anyone who isn't a felon. Blank guns and black powder pistols are available via mail order with no additional paperwork. For anyone who is not adverse to filling out a 4473, there are many options in the ~$100 range, and many worth actually having and using for ~$300. Think of the cost as a one time investment in baggage insurance.
Every time I've flown with a firearm, it only takes me a few extra minutes to check my bag with one of the ticketing agents, fill out the declaration card, and have my bag x-rayed. Even flying out of California, I've never run into an airline employee that wasn't familiar with the process for checking firearms. East coast could be different, I've never flown there.
People will amaze you sometimes. https://www.youtube.com/watch?...
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
Declaring a firearm in your luggage has always gotten me first-class VIP treatment.
The last time the counter agent closed the line behind me so she could get her supervisor to make sure everything was handled correctly (and probably to keep the people behind me from flipping out, they want to SEE the firearm).
Then they usually walk me over to TSA where my bags are hand-inspected by the TSA before letting me apply my own, high-quality locks to my bag. I'd swear its saved line-standing time.
The only marginal experience was in Laughlin/Bullhead City, which is barely an airport.
There the gate agent wanted some county sheriff to verify the weapons were unloaded. Since I don't want to make anything easy for a thief, I use trigger locks AND cable lock through the action and/or cylinder, yet Deputy Fife wanted to try to open the cylinder on my revolver AND work the action on my Glock, despite the fact the loading or firing of the guns would have been physically impossible. I actually had to say "Careful, I don't want the action damaged from the locking cables!" before he realized how stupid he was.
Then I had to argue with the TSA agent who didn't want to let me lock my luggage with a secure lock. Fortunately I also carry a recent, laminated copy of the TSA web pages requiring secure locking of checked firearms. "You can't use your own lock." "Yes, I have to, it's your own TSA requirement. Read this." He was pissed, but less pissed than he would have been telling his future colleagues on the Laughlin casino janitorial squad about his past job as a TSA agent.
Strangely the Vegas airport seemed less interested in hand-inspecting my gun case and just ran it through the machine. I told the agent "Those firearms will glow like Christmas on the screen" and the TSA guy said "If we had to hand inspect all firearm luggage at this airport, the lines would extend into the parking lot."
The craziest experience of all traveling with a firearm was trying to check into the Venetian in Vegas. I wanted to check my weapon with security and asked the woman at the desk and she said "Oh, security is just across the casino floor." I wondered how far I would get across the casino floor with a locked aluminum case without being tackled or answering questions from Clark County Sheriffs. As it turns out, I made it with five feet of the entrance before being stopped by two armed guards. They were really nice and took my down to security, checked my weapon, gave me a receipt and let me ride the VIP elevator to my room. On check out, the head of security released my weapon and I asked him if I had broken any laws bringing it on property. He said it wasn't a problem at all, happens all the time but was concerned the check in desk wouldn't page security for me. I thought the armed escort to my cab was a bit much, but again, VIP treatment!
We really do need to take a page from Israel and the methods they use.
So dump all your carry on shit out on the table, look it over for banned items, then shove it all back in your bag, and do it to everyone.
The last I was over there they had you hold on to your checked luggage for as long as possible. Also there are various stages where various people quickly question you to see if you get nervous or have suspect answers. You only send your bag through the X-Ray machine right before you go through the metal detectors your self and if they do have a question about your bag they would make you take it over to some secondary screeners who make you open your bag dig the item out in question and then they question you about it. In my case it was my old Spotmatic F and lenses. They fired off a bunch of questions to try and trip you up like:
What is in the middle of your bag?
How long have you had the camera?
Did you get the camera from anyone in Israel?
Where did you get the camera?
Do they really take better pictures than a digital?
Also when going through Israeli security they don't have the huge lines of people that the TSA is great at generating. Also all they use are metal detectors and don't make you take your shoes off even if you are wearing safety toe footwear, but in that case they will have you go and step onto a foot X-ray machine for a quick check after the metal detector. Also the Israelis like to say the don't profile but instead reverse profile. That is if you don't fit the profile then you get extra screening.
Time to offend someone
Worse - if you have a stop over in a NY airport, and your flight is canceled, you can and will be arrested immediately upon taking possession of you bag, due to the NY SAFE Act. Which is in violation of the Firearm Owners Protection Act, which allows interstate transport of firearms through firearms unfriendly states.
Of course if you REALLY want to have fun, check an NFA item. Short barrel rifles, short barrel shotguns and suppressors....