Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TSA Master Keys

schneier.com

Post reply on HN
Print view View original

61–70 of 149 posts

Re: TSA Master Keys

#61

Post by tptacek »

Vexs wrote: post #54
tptacek wrote: post #52

Earlier quoted context omitted.

I'm asking a different question. Forget about leaks for a second. If a mechanical engineer can get their hands on 1,000 sample locks and keys (for instance: by simply buying them) and then imaging them, is it that difficult to reverse engineer the skeleton key system?

It's very easy to do actually, you just need one lock actually. It's called key impressioning, and basically you put a blank in a lock, look for the scratches on it, file it down a bit, rinse/repeat.

It shouldn't be quite that easy, because the engineer has locks A, B, and C, and needs to discern from them the skeleton key that unlocks X, which they do not have.

Re: TSA Master Keys

#62

Post by chrisBob »

flavor8 wrote: post #11
tempodox wrote: post #6

Not only is this another impressive demonstration of incompetence, but by disseminating the idea that people's luggage could be “secure” and “backdoored” at the same time, they're actually destroying what security has existed before. They should pivot to be the “Transport Endangerment Agency”.

Most luggage isn't really secure in the first place. It takes less time to open up a suitcase with a good knife than it does to unzip many suitcases. The idea that a little padlock will protect your suitcase from thieves is laughable. Like physical mail, the system is based on trust, and trying to patch security onto it is difficult.

His suggestion about seals is the most valid point. None of the locks are really locks. A TSA compliant lock that records the time when it was opened might be useful, but otherwise a seal provides a lot more value.

The zip tie idea is fine except that my checked bag is the only place I can put something capable of cutting one.

Re: TSA Master Keys

#63

Post by kitd »

brk wrote: post #5

I doubt these images really did all that much for people who wanted a set of TSA keys. The locks themselves are widely available and it's easy to reverse engineer a key if you have the lock (especially multiple copies of the lock to destroy and test on). If anything, this just made it easier for casual lazy people to get a set of images for keys they'll never make :)

Can you reverse engineer a master key from one sample lock though? Genuine question, IDK.

Re: TSA Master Keys

#64

Post by deelowe »

flavor8 wrote: post #11
tempodox wrote: post #6

Not only is this another impressive demonstration of incompetence, but by disseminating the idea that people's luggage could be “secure” and “backdoored” at the same time, they're actually destroying what security has existed before. They should pivot to be the “Transport Endangerment Agency”.

Most luggage isn't really secure in the first place. It takes less time to open up a suitcase with a good knife than it does to unzip many suitcases. The idea that a little padlock will protect your suitcase from thieves is laughable. Like physical mail, the system is based on trust, and trying to patch security onto it is difficult.

What about corporate travelers taking prototypes and other sensitive items in pelican cases or similar luggage?

Re: TSA Master Keys

#65

Post by seany »

Checking firearms has been my way around this. You are required by law to use a hard sided box that is properly locked with real locks.

Re: TSA Master Keys

#66

Post by numbsafari »

deelowe wrote: post #64
flavor8 wrote: post #11

Earlier quoted context omitted.

Most luggage isn't really secure in the first place. It takes less time to open up a suitcase with a good knife than it does to unzip many suitcases. The idea that a little padlock will protect your suitcase from thieves is laughable. Like physical mail, the system is based on trust, and trying to patch security onto it is difficult.

What about corporate travelers taking prototypes and other sensitive items in pelican cases or similar luggage?

Pelican cases offer durability, not security.

Re: TSA Master Keys

#67

Post by kabdib »

dragonwriter wrote: post #41
kabdib wrote: post #38

Earlier quoted context omitted.

This. One thing that kills escrow systems dead is the complacent spread of authority. You start with critical keys that are closely held. Over time other parties express the need for access ("Okay, if you promise to be good"). Nothing bad happens (that anyone can prove...) so over time more entities are brought into the circle of trust. Eventually the dog-catcher has access to your stuff. There's no way these keys ha…

Really, it doesn't matter if they've broadly leaked or not -- from very early on in the "TSA must have your keys" period, theft by TSA agents from luggage was a noteworthy problem. The spread of authority may be a problem, but when the original authority isn't trustworthy in the first place, problems start long before any spread.

I admit to thinking more broadly, about key escrow systems in general.

The whole idea of a small set of physical keys and a large number of publically available locks is, of course, utter horse poop.

The logical extension of this "security" and "industry needs to meet law enforcement in the middle" to digital keys is terrifying. And I'm guessing it's how quite a few people think about it in the TSA and other organizations.

Re: TSA Master Keys

#68

Post by scurvy »

There's a comment in the original post about bags with firearms requiring a non-TSA lock. Has anyone travelled with a firearm as a maneuver to secure their luggage? Seems lengthy, but probably works. I'd imagine you need to check-in in a different area and not the front desk?

Edit: I just watched the YouTube video posted below. Looks like we're just dealing with a flawed system.

Re: TSA Master Keys

#69

Post by kungfooey »

scurvy wrote: post #68

There's a comment in the original post about bags with firearms requiring a non-TSA lock. Has anyone travelled with a firearm as a maneuver to secure their luggage? Seems lengthy, but probably works. I'd imagine you need to check-in in a different area and not the front desk? Edit: I just watched the YouTube video posted below. Looks like we're just dealing with a flawed system.

There was a talk about this by Deviant Ollam at The Last HOPE in NYC in 2008. Mp3 Link: http://www.thelasthope.org/media/audio/64kbps/Packing_and_th...

More info: http://deviating.net/firearms/packing/

Re: TSA Master Keys

#70

Post by davrosthedalek »

It's sad that so many comments concentrate on whether luggage is secure in the first place. Of course it is not. The real issue is that having a backdoor makes a new class of attacks possible. A wilful or accidental leak, for example. Or you can reverse engineer the master key if you have enough locks.

The big impact is that one leak kills the security of all locks (of that type).

I don't think this would necessarily be the case when looking at (publicly) backdoored encryption. Here, you could have an individual backdoor key for each "lock". Of course, the mass storage of backdoor keys make a mass-leak also more probable.

Post reply on HN