Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TSA Master Keys

schneier.com

Post reply on HN
Print view View original

51–60 of 149 posts

Re: TSA Master Keys

#51

Post by andyjohnson0 »

Tepix wrote: post #39
brk wrote: post #5

I doubt these images really did all that much for people who wanted a set of TSA keys. The locks themselves are widely available and it's easy to reverse engineer a key if you have the lock (especially multiple copies of the lock to destroy and test on). If anything, this just made it easier for casual lazy people to get a set of images for keys they'll never make :)

Source needed.

Make a working key from scrap metal by reverse engineering a lock

http://www.instructables.com/id/Make-a-working-key-from-scra...

Re: TSA Master Keys

#52

Post by tptacek »

kabdib wrote: post #38
tptacek wrote: post #27

Was it ever possible to have a secure lock held by tens of thousands of people with a secure master key, even if the authentic master keys were never revealed?

This. One thing that kills escrow systems dead is the complacent spread of authority. You start with critical keys that are closely held. Over time other parties express the need for access ("Okay, if you promise to be good"). Nothing bad happens (that anyone can prove...) so over time more entities are brought into the circle of trust. Eventually the dog-catcher has access to your stuff. There's no way these keys ha…

I'm asking a different question.

Forget about leaks for a second.

If a mechanical engineer can get their hands on 1,000 sample locks and keys (for instance: by simply buying them) and then imaging them, is it that difficult to reverse engineer the skeleton key system?

Re: TSA Master Keys

#53

Post by hyperpape »

brk wrote: post #5

I doubt these images really did all that much for people who wanted a set of TSA keys. The locks themselves are widely available and it's easy to reverse engineer a key if you have the lock (especially multiple copies of the lock to destroy and test on). If anything, this just made it easier for casual lazy people to get a set of images for keys they'll never make :)

It seems like the real value of the picture was that it made it obvious how insecure the system was.

Re: TSA Master Keys

#54

Post by Vexs »

tptacek wrote: post #52
kabdib wrote: post #38

Earlier quoted context omitted.

This. One thing that kills escrow systems dead is the complacent spread of authority. You start with critical keys that are closely held. Over time other parties express the need for access ("Okay, if you promise to be good"). Nothing bad happens (that anyone can prove...) so over time more entities are brought into the circle of trust. Eventually the dog-catcher has access to your stuff. There's no way these keys ha…

I'm asking a different question. Forget about leaks for a second. If a mechanical engineer can get their hands on 1,000 sample locks and keys (for instance: by simply buying them) and then imaging them, is it that difficult to reverse engineer the skeleton key system?

It's very easy to do actually, you just need one lock actually. It's called key impressioning, and basically you put a blank in a lock, look for the scratches on it, file it down a bit, rinse/repeat.

Re: TSA Master Keys

#55

Post by michaelfeathers »

flavor8 wrote: post #11
tempodox wrote: post #6

Not only is this another impressive demonstration of incompetence, but by disseminating the idea that people's luggage could be “secure” and “backdoored” at the same time, they're actually destroying what security has existed before. They should pivot to be the “Transport Endangerment Agency”.

Most luggage isn't really secure in the first place. It takes less time to open up a suitcase with a good knife than it does to unzip many suitcases. The idea that a little padlock will protect your suitcase from thieves is laughable. Like physical mail, the system is based on trust, and trying to patch security onto it is difficult.

> Most luggage isn't really secure in the first place

Nothing is secure, really. I'm continually amazed that people want to see security as a binary thing.

Re: TSA Master Keys

#56

Post by mzs »

For luggage it's usually on a zipper with two sliders, which you just pull on the tape to separate, look inside, do whatever you like while in there, and then move the sliders back and forth twice to re-close, so it never really mattered.

Re: TSA Master Keys

#57

Post by Vexs »

stingraycharles wrote: post #32
hellbanner wrote: post #24

My google-fu is lacking, but recently (last year?) an inmate escaped thanks to their cellmate who was a master jeweler & had a full kit in his cell. A photograph of the guard's keys was smuggled in and the jeweler cut a key for the inmate to escape.

I think this is the story you are talking about: http://www.news.com.au/national/killer-escaped-prison-after-...

> THE design for a key that allowed a convicted killer to escape from a Territory prison was printed on the cover of a booklet given to all inmates, it has been revealed.

Pahahaha. That sounds like something you'd find in an ARG puzzle, but this was a prison. Kinda curious how the other prisoner had jeweler's equipment in his cell, it seems like that could be pretty dangerous. Good behavior?

Re: TSA Master Keys

#58

Post by tedunangst »

tptacek wrote: post #52
kabdib wrote: post #38

Earlier quoted context omitted.

This. One thing that kills escrow systems dead is the complacent spread of authority. You start with critical keys that are closely held. Over time other parties express the need for access ("Okay, if you promise to be good"). Nothing bad happens (that anyone can prove...) so over time more entities are brought into the circle of trust. Eventually the dog-catcher has access to your stuff. There's no way these keys ha…

I'm asking a different question. Forget about leaks for a second. If a mechanical engineer can get their hands on 1,000 sample locks and keys (for instance: by simply buying them) and then imaging them, is it that difficult to reverse engineer the skeleton key system?

I recall reading that it really only takes about one (maybe two) regular office keys to create the master key that unlocks them all. There were flaws in that system which made it easier (given only keys), but I would wager it's not too hard to make a master key given a few locks as well.

Re: TSA Master Keys

#59

Post by Vexs »

I'm kinda surprised that key number 2 on the imgur mirror is a dimple lock. Those are generally used for more high security things than crap tsa travel locks; they're expensive too. Key 4 doesn't surprise me though.

https://imgur.com/a/JQD7l

Re: TSA Master Keys

#60

Post by mangamadaiyan »

pfooti wrote: post #42
coldpie wrote: post #22

Earlier quoted context omitted.

> Seems like a ridiculous waste of money. The people paying for it (US citizens and those who travel into or through the US) would surely see it as a waste. But the people profiting don't, and the people profiting are the same people who make the laws mandating them. I opt out of the naked scanners every time I fly. Just tell the TSA clown trying to herd you into the naked scanner the magic phrase "I'm opting out." A…

I also opt out every time. At one point the FSM came to me in a dream and told me that I shalt not go through a pornoscanner. And who am I to doubt the word of noodle?

I don't know why you're getting downvoted.

Any religion is as good as the other, and you're just going by what your religion's deity told you. Nothing wrong with that, as far as I can see.

Post reply on HN