
Security experts have cloned all seven TSA master keys - sinak
https://techcrunch.com/2016/07/27/security-experts-have-cloned-all-seven-tsa-master-keys/
======
eridius
Luggage locks are basically only a deterrence against casual crime-of-
opportunity thieves or pickpockets. I've found it's much simpler to just use a
zip tie on my zipper. Very easy to put on, easy to take off again once you get
to your destination (nail clippers work well), and provides roughly the same
security as a TSA lock. And it has the added benefit that you can tell if the
TSA opened your suitcase because the zip tie will have been removed (whereas
with the lock the TSA can look through your suitcase without leaving any
indication).

~~~
Reason077
I don't think the TSA are going around opening bags in secret. There's a note
that they leave conspicuously inside your bag explaining it was opened for
security reasons.

When I travel with a large snowboard bag I used to get one of these every
single time. Presumably it was too big to fit in the security scanners so they
were required to open it.

~~~
Ma8ee
Someone has definitely been through my bag when I have been travelling in the
US without anyone leaving a note. I can of course not tell if it was TSA or
not.

------
williamscales
There's no point using a lock on a zipper. You can just shove a ball point pen
in between the zipper teeth and open the zipper itself. Then when you're done
just rezip it with the still locked zipper pulls.

~~~
j4kp07
That trick does not work with paired zippers that are also locked in parallel
with the luggage handle.

[http://thewirecutter5.wpengine.netdna-cdn.com/wp-
content/upl...](http://thewirecutter5.wpengine.netdna-cdn.com/wp-
content/uploads/2015/11/04-zippers-1-carry-on-luggage-630.jpg)

[https://www.amazon.com/Travel-Accessories-Lockdown-Triple-
Se...](https://www.amazon.com/Travel-Accessories-Lockdown-Triple-
Security/dp/B003EM3D6E/ref=sr_1_2?ie=UTF8&qid=1469665343&sr=8-2&keywords=tsa+lock+cable)

~~~
goldenkey
Please dont post affiliate/tracker links here. Its bad practice. Here is a non
cookied Amazon link:

[https://www.amazon.com/Travel-Accessories-Lockdown-Triple-
Se...](https://www.amazon.com/Travel-Accessories-Lockdown-Triple-
Security/dp/B003EM3D6E)

~~~
jlgaddis
Did _j4kp07_ edit his link? There's no affiliate tag in there.

~~~
maxerickson
People get concerned about the stuff like "ref=sr_1_2" in Amazon urls (but
it's just some internal thing they use to track searches or something).

It's also the case that making noise about occasional, topical referrers is
going to be less useful than the occasional, topical link. Of course it
shouldn't be okay to make work out of posting them, but who cares if someone
adds one to a link that is worth posting otherwise.

------
jlgaddis
> _These consumer products are ‘peace of mind’ devices, not part of TSA’s
> aviation security regime._ \--TSA

In my opinion, the TSA itself is nothing more than a "peace of mind" device.

~~~
djsumdog
They give me no piece of mind. In fact I hate flying in the United States
because out of the 20 countries I've flow in and out of, the US is the only
when where I still get molested.

Even as late as 2015, on returning to America after not having hands stuffed
down my pants in any other airport in the world, America still doesn't
disappoint.

Fuck the TSA. Airport security should be handed back over to the airlines and
airports.

~~~
kobayashi
The TSA was created for legit safety/security purposes. The organization
itself is assuredly a clusterfuck, but airlines and airports doing their own
security again isn't the answer.

A lot of it is about training. Many, if not most, of TSA's airport employees
are the same poorly trained security staff that were laid off (and
subsequently rehired) after the TSA's creation.

The answer is a better security organization, perhaps modelled after a
functioning organization, like Israel's (I've studied the country's security
practices, and it readily comes to mind). The answer is not regressing to
poorly trained and poorly organized DIY security operations.

~~~
syshum
>>The TSA was created for legit safety/security purposes.

No

>> The answer is not regressing to poorly trained and poorly organized DIY
security operations.

The answer lies in not giving up essential liberty for promises of safety

The goal of Terrorism is to scare people so badly they give up their own way
of life "voluntarily" because they are scared, in that the terrorist have won

------
matt-attack
I've never locked a checked suitcase in my life. And I've traveled all over
the world.

Of course it goes without saying that I only carry laundry in my checked
luggage. Laptop, chargers, camera, etc goes in a carry on backpack.

~~~
Zigurd
I would second this. The only time I have had anything stolen from luggage was
from my briefcase at a TSA checkpoint at JFK between foreign and domestic
terminals, where a couple of checks were lifted from my bag. Fortunately I
noticed shortly afterward and was able to get the checks stopped before
boarding my flight. Don't check anything pocketable and expensive. Locks do
nothing.

~~~
vacri
I have a similar opinion with my car. "The inside of your car is a public
place". By all means lock the car, but don't keep anything valuable in it.

And if you have a valuable thing in sight, then even with the fanciest locks,
you're running the risk of broken windows. Just easier to keep nice stuff out
of that 'public place'.

~~~
eru
I've seen lots of stickers on cars saying "the car is unlocked, and there's
nothing valuable inside".

The unlocking in the hopes of preventing a window smash.

~~~
talmand
To some people the unlocked car is the valuable item and not the crap inside
it. Not that door locks would stop them anyway.

Reminds me of a joke.

I leave my car with a sign hanging from the mirror that clearly states that no
valuables are inside.

One day I go to my car with a broken window and a new sign that says "just
checking".

~~~
eru
You can get into the unlocked car without a key, but you can't start it. At
least not without shenanigans. Yes, the door wouldn't really stop someone from
taking your whole car.

What I would be worried about when leaving my car open is eg other people
sleeping in it. (I wouldn't mind too much, as long as they are clean. But
that's too much to ask for.)

Fortunately, I do not own a car in the first place.

------
dougfarre
If you want to ensure no one can open your luggage, travel with a firearm. It
doesn't have to be a real firearm, but if you declare the firearm you are
required by the airlines to have a lock on your luggage that can't be opened
by TSA.

~~~
tomjakubowski
Is there a penalty for declaring a "fake" firearm?

~~~
kgermino
A lot of people who don't want to lie (which may not be illegal, but I
wouldn't recommend it personally) will get a starter pistol. They're cheap,
small, safe (don't fire rounds, just blanks) and legally have to be declared
as a firearm to fly. So you buy a starter pistol and stick it with your nice
camera when you fly. It will be locked with something only you can open and
will probably be handled more carefully in transit

------
cyphunk

        These consumer products are ‘peace of mind’ devices, not part 
        of TSA’s aviation security regime.
    

A bump key could open the majority of locks and yet we still put such locks
into new doors? These flawed locks just serve the purpose of forcing whomever
wants to enter to cross a psychological boundary from legal into illegal. And
that is still a good reason to use flawed locks.

    
    
        In other words, you might as well not use locks at all.
    

Simply not true

------
fotbr
The only reason I bother with a lock on my (zippered) luggage is to keep the
double-zipper ends together and keep it from working itself open as it bounces
around the baggage handling equipment.

Like most things concerning security in general and airport security in
particular, it's a sham, meant for appearances only.

------
sandGorgon
Wow...will this not pretty much screw hotel room security ? An employee can go
and open your lock in 30 seconds and relock your luggage after stealing. How
do you prove that someone from the hotel stole it ("sir we obviously can't
open locks that only the TSA can")

~~~
williamscales
No point...you disclaim liability for valuables left in the room.

------
kyleblarson
Seems like the plastic wrap they do at intl airports is a much more effective
measure than tsa locks.

~~~
yolesaber
Only if you leave a unique indicator of that particular wrapping or take a
photo. Otherwise they could easily slice through it, look at your shit, and
wrap it back up. They probably have a machine for this.

------
tuna-piano
Can anyone think of any ways where it would be possible to have the benefits
the TSA was hoping for (cheap locks that can be opened by TSA and the owner
but no one else)? Because I can't seem to think of any.

~~~
Spooky23
They prevent casual theft and tampering, and do so well.

Everyone loves to bust on the TSA, but small controls can add up. If you live
in a home without barred windows and a reinforced door and locks, anyone can
enter your home in seconds. Yet we still lock our doors, and they are still
effective.

The only purpose of the TSA key is to facilitate searches without damaging the
lock or bag. That's it.

~~~
douche
My position on this has always been that, if somebody wants badly enough to
steal my shit, they are going to. The only thing that locking doors is going
to do is ensure that, not only is all of my shit stolen, but I have a kicked-
in, busted, door to fix to boot.

~~~
BinaryIdiot
I never really understood this position. Are you saying you don't lock
anything? A vast majority of break-ins are thwarted by simply having a locked
door and being home. You don't want to prevent even those?

Security systems, chained doors, automatic lights and deadbolts are also a
huge deterrent that prevent plenty of break-ins. Yes all of those combined
will NOT stop someone who wants to get into your home really badly but at that
point I can't imagine they want to simply steal something. That's a lot of
effort to go through and would seem far more personal to me.

~~~
douche
My gun cabinet is the only thing that I lock.

To be honest, I don't own anything very valuable, and I value my convenience
more highly than the remote chance that somebody is going to clean out my
house. Particularly since the criminal element is almost nonexistent
hereabouts, and what there is tends to center on small-scale marijuana growing
and dealing - although maybe that will become a problem if the heroin epidemic
continues.

Locking and unlocking a door two or three times a day adds up to a
considerable amount of wasted time over the course of years. Not to mention
insanity like I've seen in Germany, where people lock the outer gate, lock the
outer door, deadbolt the door, lock the inner door, and then roll down huge
armored shutters over the windows - in an upper-middle class gated
community...

~~~
pavel_lishin
My parents don't lock their house doors or cars - but they live in a rural
area, where the odds of a crime-of-opportunity are basically nil.

Cruising house-to-house checking for unlocked cars and doors would take a
prohibitive amount of time; easier to do that in suburbia, where you can cover
a dozen houses on foot in five minutes.

But in NYC, I've always locked my apartment door, because it's trivially
simple to follow someone into an apartment building, and not much challenge to
go door to door, listen for signs of habitation, and try the door handle.

------
nsxwolf
Just cut them off, that's what the TSA does anyway. I stopped buying those
because apparently the TSA just cuts them off when they don't happen to have
one of their own keys handy. They threw the cut locks right back into my bags
along with the note declaring they had searched them.

------
holografix
I read a while ago that a good method of understanding whether something had
been tampered with or opened was to use glittery nail polish on the edges and
take a close up, photo on your phone. Even if someone repainted it they
wouldn't achieve the same pattern

------
arviewer
Isn't it better to use a cheap non-TSA lock on your luggage? If they open it,
the lock is destroyed, and you know for sure someone has opened it - either
personel or someone with criminal intentions. Or will this result in more
trouble?

------
raihansaputra
i just thought about this yesterday.. would there be a market for a logging
device for travel baggage? like a small camera and a mcu that activates when
sensors (probably magnets between the halves) indicate the baggage is opened?
preferably discrete. not to deter but to identify who opened it. logs time
also to know the rough position of the breach.

~~~
ceejayoz
There'd certainly be a market for the stolen logging devices.

------
kr0
At first glance I thought this was referring to the TLS master key certs.

------
tdicola
You can watch the talk where they announced it at HOPE here:
[http://livestream.com/internetsociety/hopeconf/videos/130717...](http://livestream.com/internetsociety/hopeconf/videos/130717705)
I saw it live and it was a pretty fun talk (also helped that it was midnight
and the alcohol was flowing freely). Definitely check it out!

~~~
zck
I was in the room for this talk; it was pretty electric. Some of the other
talks I liked were the Social Engineering talk, and Cory Doctorow's keynote.

The thing that crystallizes what HOPE is about, for me, was that their closing
ceremonies opened with a fifteen-minute talk about the network situation --
the cabling they had to run, the 1.5Gbps DDOS they withstanded, and then
chastised us for not using _enough_ bandwith, saying the ISP that donated a 10
gig line threatened to downgrade it next time.

------
vegardx
Put your luggage in a Pelican-case and use some relatively hard to pick, but
easy to cut locks. Should they want to open it they will just cut the locks.
Alternatively you can use a TSA approved lock and some zip ties as a simple
tamper evident seal.

~~~
15155
Alternatively, you can put your luggage entirely in a Pelican case, stick a
firearm or equivalent (starter pistol, flare gun, AR-15 lower, etc.) in there,
declare it, have the luggage inspected, and then use ASSA Abloy locks and fly
with absolutely zero worries that someone will pilfer your valuables.

~~~
brokenmachine
As an Australian I find it slightly amusing that people are suggesting packing
guns in their luggage in order to prevent (what are meant to be) "the good
guys" from stealing stuff from it.

"For security", we need more guns flying round everywhere.

------
BinaryIdiot
I thought this happened a while back and hadn't realized it didn't yet. Very
cool.

Not a big deal with the TSA because honestly these tiny, flimsy locks were
never about security but to ensure the casual encounter with someone unknown
doesn't get into your bag and possibly steal something (anyone who really
wants something from your bag can cut these with the tiniest of bolt cutters).
Also they can be handy with keeping annoying zippers together.

------
bogomipz
“These consumer products are ‘peace of mind’ devices, not part of TSA’s
aviation security regime,” England wrote.

"peace of mind" devices, that pretty much sums up the "security theater"
charade that is the TSA. If its not important why do they have master keys at
all?

Similar to how they randomly select people sometimes to use the pre-screen
lines.

------
dogma1138
The TSA were stupid but to be fair anyone with an access to a few suitcases
can build the key, not to mention that suitcase manufacturers and luggage lock
designers had access to the specs.

------
colemickens
Previous discussion from last September:
[https://news.ycombinator.com/item?id=10196197](https://news.ycombinator.com/item?id=10196197)

~~~
jrockway
In this case, they didn't use the pictures of the keys, they gathered a set of
locks and worked out what the master key would look like based on those
samples.

~~~
colemickens
Oh great, thanks for pointing that out; I missed that distinction and jumped
to a conclusion after seeing the old story and new story reference the same
GitHub repo.

I guess this is the relevant commit: [https://github.com/Xyl2k/TSA-Travel-
Sentry-master-keys/commi...](https://github.com/Xyl2k/TSA-Travel-Sentry-
master-keys/commit/5635ddb98c095a9ab36ff9548d87d5397d46cacd)

------
rhino369
Even a shitty bolt cutter would work on these locks right?

~~~
koenigdavidmj
The purpose of most locks of this size is to make it visible if somebody broke
it, and conspicuous to perform the act of breaking the lock. Sort of like a
bike lock: the purpose is not to make it impossible to steal; that's
impossible to do with anything lightweight. The purpose is to make it
impossible _with anything less noisy than an angle grinder_.

In this case, the greatest threat is still the TSA agent or hotel maid
entering your room, since you shouldn't be leaving your bag unattended with
anyone else.

~~~
hobs
Except that with a TSA lock you can probably just replace it after you break
it, most of them are very similar and brands are fairly obvious.

~~~
ggreer
The victim's key wouldn't work on the new lock.

~~~
hobs
Sure they would, just give them a key pinned to open with any key :D

------
kozak
So, the news is about the eights key being cloned, in addition to the seven
keys that were cloned before. The title is a bit misleading.

------
trhway
seven for the Dwarves, done. 10 to go. And the master of them all.

~~~
onetwotree
Er, 12 or 13 to go, depending on whether you count the one ring.

You probably forgot the elves. If I had a nickle for every time I forgot the
godamn elves...

