Security experts have cloned all seven TSA master keys

[lilyball]

Luggage locks are basically only a deterrence against casual crime-of-opportunity thieves or pickpockets. I've found it's much simpler to just use a zip tie on my zipper. Very easy to put on, easy to take off again once you get to your destination (nail clippers work well), and provides roughly the same security as a TSA lock. And it has the added benefit that you can tell if the TSA opened your suitcase because the zip tie will have been removed (whereas with the lock the TSA can look through your suitcase without leaving any indication).

[chx]

Colored zip ties are even better because the TSA won't have those at hand even if they bother. Or use tamper evident stickers to fasten the "tail" of the zip tie to the suitcase (search eBay for numbered, hologram tamper evident seals). This doesn't interfere with TSA but makes any intrusion painfully evident. And the trick where they use a ball pen to open the zippers, if the counterpiece is fastened to the suitcase, it's harder / impossible to close it back.

[mannykannot]

The TSA notified me when they opened my bag a few years ago, with a polite leaflet placed in the bag. I would not have noticed otherwise - the contents appeared undisturbed. I don't know if this is standard or current practice.

[szemet]

Zip tie? Only a ballpoint pen is needed, and you will never know someone messed with your luggage. Definitely easier than any lock... https://m.youtube.com/watch?v=wpIJVWXsBBI

[kozak]

One of the reasons why we use the locks is to prevent the zipper from unzipping accidentally under vibration or rough handling. If they cut the zip tie open, and don't put a new one, the zipper won't have such protection for the second part of the trip. So a simple unsecure TSA lock and a tamper-evident sticker is probably an optimal combination.

[Reason077]

I don't think the TSA are going around opening bags in secret. There's a note that they leave conspicuously inside your bag explaining it was opened for security reasons.

When I travel with a large snowboard bag I used to get one of these every single time. Presumably it was too big to fit in the security scanners so they were required to open it.

[estebank]

> Luggage locks are basically only a deterrence against casual crime-of-opportunity thieves or pickpockets. I've found it's much simpler to just use a zip tie on my zipper.

You might want to see this (opening a suitcase with a ball pen):

https://youtu.be/9JvmAktLvFg?t=14s

[arcticfox]

But TSA won't reziptie it for you, so it seems worse in that respect if you're dealing with shady airports

[williamscales]

There's no point using a lock on a zipper. You can just shove a ball point pen in between the zipper teeth and open the zipper itself. Then when you're done just rezip it with the still locked zipper pulls.

[Sidnicious]

Definitely, but according to one of the linked articles, the goal of the project was to demonstrate why key escrow is broken in general, not just these locks:

http://livestream.com/internetsociety/hopeconf/videos/130717...

[j4kp07]

That trick does not work with paired zippers that are also locked in parallel with the luggage handle.

http://thewirecutter5.wpengine.netdna-cdn.com/wp-content/upl...

https://www.amazon.com/Travel-Accessories-Lockdown-Triple-Se...

[mahyarm]

They're great to make sure the zipper doesn't unzip during transport because of handling.

[MichaelApproved]

Here's a video of the exploit in action https://youtu.be/wpIJVWXsBBI?t=70

[jlgaddis]

> These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime. --TSA

In my opinion, the TSA itself is nothing more than a "peace of mind" device.

[djsumdog]

They give me no piece of mind. In fact I hate flying in the United States because out of the 20 countries I've flow in and out of, the US is the only when where I still get molested.

Even as late as 2015, on returning to America after not having hands stuffed down my pants in any other airport in the world, America still doesn't disappoint.

Fuck the TSA. Airport security should be handed back over to the airlines and airports.

[baby]

which is funny because I do not have peace of mind when I go to an airport 3 hours before my flight in hope that the TSA lines won't make me lose my flight.

[talmand]

The TSA has actually increased the danger by creating even larger targets of opportunity than just the airplanes. At busy times there are likely 5 to 10 airplanes worth of people standing in one spot before they get past security.

[dougfarre]

If you want to ensure no one can open your luggage, travel with a firearm. It doesn't have to be a real firearm, but if you declare the firearm you are required by the airlines to have a lock on your luggage that can't be opened by TSA.

[onetwotree]

TIL if you want to get a bomb onto a plane, declare a gun!

I'm kidding, of course. There are probably multiple reasons that wouldn't work. But this whole notion that by molesting passengers sufficiently and putting on a big enough show, we can significantly reduce casualties from terrorism is laughable.

At some point there has to be a tradeoff between safety and convenience, or no one in their right mind would drive a car.

[tomjakubowski]

Is there a penalty for declaring a "fake" firearm?

[matt-attack]

I've never locked a checked suitcase in my life. And I've traveled all over the world.

Of course it goes without saying that I only carry laundry in my checked luggage. Laptop, chargers, camera, etc goes in a carry on backpack.

[city41]

Even if you did lock it, the most likely people to steal something out of it are TSA employees.

[Zigurd]

I would second this. The only time I have had anything stolen from luggage was from my briefcase at a TSA checkpoint at JFK between foreign and domestic terminals, where a couple of checks were lifted from my bag. Fortunately I noticed shortly afterward and was able to get the checks stopped before boarding my flight. Don't check anything pocketable and expensive. Locks do nothing.

[cyphunk]

    These consumer products are ‘peace of mind’ devices, not part 
    of TSA’s aviation security regime.

A bump key could open the majority of locks and yet we still put such locks into new doors? These flawed locks just serve the purpose of forcing whomever wants to enter to cross a psychological boundary from legal into illegal. And that is still a good reason to use flawed locks.

    In other words, you might as well not use locks at all.

Simply not true

[fotbr]

The only reason I bother with a lock on my (zippered) luggage is to keep the double-zipper ends together and keep it from working itself open as it bounces around the baggage handling equipment.

Like most things concerning security in general and airport security in particular, it's a sham, meant for appearances only.

[nsxwolf]

Just cut them off, that's what the TSA does anyway. I stopped buying those because apparently the TSA just cuts them off when they don't happen to have one of their own keys handy. They threw the cut locks right back into my bags along with the note declaring they had searched them.

[sandGorgon]

Wow...will this not pretty much screw hotel room security ? An employee can go and open your lock in 30 seconds and relock your luggage after stealing. How do you prove that someone from the hotel stole it ("sir we obviously can't open locks that only the TSA can")

[kyleblarson]

Seems like the plastic wrap they do at intl airports is a much more effective measure than tsa locks.

[yolesaber]

Only if you leave a unique indicator of that particular wrapping or take a photo. Otherwise they could easily slice through it, look at your shit, and wrap it back up. They probably have a machine for this.

[tuna-piano]

Can anyone think of any ways where it would be possible to have the benefits the TSA was hoping for (cheap locks that can be opened by TSA and the owner but no one else)? Because I can't seem to think of any.

[Spooky23]

They prevent casual theft and tampering, and do so well.

Everyone loves to bust on the TSA, but small controls can add up. If you live in a home without barred windows and a reinforced door and locks, anyone can enter your home in seconds. Yet we still lock our doors, and they are still effective.

The only purpose of the TSA key is to facilitate searches without damaging the lock or bag. That's it.

[halomru]

That depends on what you are trying to achieve with the locks? I think most cases where the lock would be actually useful could be covered with tamper-evident stickers. (You seal the zippers, TSA reseals with their own stickers)

[eru]

If you are talking about more general key escrow for cryptography:

Use Shamir's secret sharing strategy (or similar) to share your private key with 500 other people, cooperation of an 400 people necessary to retrieve the secret.

This way law enforcement can look at your stuff with a warrant ('nothing to hide' after all) but not in secret: they will have to contact a few hundred people, that's hard to keep hush-hush.

[x1798DE]

No, this is the same problem as key escrow.

[holografix]

I read a while ago that a good method of understanding whether something had been tampered with or opened was to use glittery nail polish on the edges and take a close up, photo on your phone. Even if someone repainted it they wouldn't achieve the same pattern

[arviewer]

Isn't it better to use a cheap non-TSA lock on your luggage? If they open it, the lock is destroyed, and you know for sure someone has opened it - either personel or someone with criminal intentions. Or will this result in more trouble?

[raihansaputra]

i just thought about this yesterday.. would there be a market for a logging device for travel baggage? like a small camera and a mcu that activates when sensors (probably magnets between the halves) indicate the baggage is opened? preferably discrete. not to deter but to identify who opened it. logs time also to know the rough position of the breach.

[ceejayoz]

There'd certainly be a market for the stolen logging devices.

[kr0]

At first glance I thought this was referring to the TLS master key certs.

[tdicola]

You can watch the talk where they announced it at HOPE here: http://livestream.com/internetsociety/hopeconf/videos/130717... I saw it live and it was a pretty fun talk (also helped that it was midnight and the alcohol was flowing freely). Definitely check it out!

[zck]

I was in the room for this talk; it was pretty electric. Some of the other talks I liked were the Social Engineering talk, and Cory Doctorow's keynote.

The thing that crystallizes what HOPE is about, for me, was that their closing ceremonies opened with a fifteen-minute talk about the network situation -- the cabling they had to run, the 1.5Gbps DDOS they withstanded, and then chastised us for not using enough bandwith, saying the ISP that donated a 10 gig line threatened to downgrade it next time.

[vegardx]

Put your luggage in a Pelican-case and use some relatively hard to pick, but easy to cut locks. Should they want to open it they will just cut the locks. Alternatively you can use a TSA approved lock and some zip ties as a simple tamper evident seal.

[15155]

Alternatively, you can put your luggage entirely in a Pelican case, stick a firearm or equivalent (starter pistol, flare gun, AR-15 lower, etc.) in there, declare it, have the luggage inspected, and then use ASSA Abloy locks and fly with absolutely zero worries that someone will pilfer your valuables.

[BinaryIdiot]

I thought this happened a while back and hadn't realized it didn't yet. Very cool.

Not a big deal with the TSA because honestly these tiny, flimsy locks were never about security but to ensure the casual encounter with someone unknown doesn't get into your bag and possibly steal something (anyone who really wants something from your bag can cut these with the tiniest of bolt cutters). Also they can be handy with keeping annoying zippers together.

[bogomipz]

“These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime,” England wrote.

"peace of mind" devices, that pretty much sums up the "security theater" charade that is the TSA. If its not important why do they have master keys at all?

Similar to how they randomly select people sometimes to use the pre-screen lines.

[colemickens]

Previous discussion from last September: https://news.ycombinator.com/item?id=10196197

[jrockway]

In this case, they didn't use the pictures of the keys, they gathered a set of locks and worked out what the master key would look like based on those samples.