[00:00.000 --> 00:07.400]  And I think we're going to go with a very special panel on the TSA keys leak, government-backed doors, and the dangers of security theater.
[00:07.560 --> 00:12.580]  Please give a warm welcome to Johnny Xmas, Nite 0wl, and DarkSim905.
[00:17.570 --> 00:19.710]  Thank you to all you lovely people.
[00:20.330 --> 00:21.430]  And the rest of you.
[00:22.930 --> 00:28.630]  Quick thing to get out of the way, I know a lot of our previous panels we've encouraged people to speak up whenever.
[00:29.250 --> 00:34.230]  We are really going to be trying to compress this into the time that we have.
[00:34.970 --> 00:41.270]  So please, we are going to do a Q&A and a hands-on session down in Lockpick Village as soon as we finish up here.
[00:41.610 --> 00:49.670]  So if you have questions, I know they burn in your chest, but please save them, go downstairs, and we will tell you everything that we can.
[00:51.910 --> 00:54.850]  All right, should we do some basic intros of who we are?
[00:55.150 --> 00:55.750]  Sure, let's do that.
[00:55.750 --> 00:56.350]  For those who don't know?
[00:56.470 --> 00:58.070]  Who doesn't know who Nite 0wl is?
[00:59.070 --> 01:00.190]  This one guy.
[01:00.430 --> 01:00.910]  All right.
[01:01.290 --> 01:02.130]  I'm Johnny Xmas.
[01:04.330 --> 01:09.570]  I'm a penetration tester out of Chicago for Tradecraft Labs, part of Redleg International.
[01:10.770 --> 01:13.070]  And I have been coming to HOPE since H2K.
[01:13.310 --> 01:15.570]  So that's 16-ish years of HOPE.
[01:15.710 --> 01:16.790]  This is my ninth HOPE.
[01:17.790 --> 01:20.150]  I have always wanted to speak here.
[01:20.370 --> 01:26.550]  And this is my first time, and it's super exciting, because I'm in like the big room, too, my first time.
[01:26.790 --> 01:30.770]  So thank you so much, HOPE, for changing my life.
[01:30.950 --> 01:33.250]  Without HOPE, I would not be sitting up here at all.
[01:33.250 --> 01:34.090]  I guarantee it.
[01:34.310 --> 01:35.310]  So thank you, HOPE.
[01:40.160 --> 01:41.460]  I am Nite 0wl.
[01:42.840 --> 01:47.280]  I've already had to introduce myself up on the stage at least once so far this conference.
[01:48.660 --> 01:49.820]  And I will.
[01:50.200 --> 01:53.600]  This is my first conference, actually, ever speaking.
[01:53.900 --> 02:01.080]  And yet again, I find myself with bright spotlights in my face, so I can't see anyone except RenderMan over there with his nice little glowing goggles.
[02:03.400 --> 02:25.520]  This talk is the summation of over a year of work on my part, and months and months and months of work on the part of the two gentlemen sitting beside me, and many, many people who are not here today, some of whom may be in the audience, some of whom may be thousands of miles away.
[02:26.240 --> 02:34.920]  But all of this was ultimately a collaborative effort, and we want to make sure that you know really as much as we do.
[02:36.720 --> 02:38.720]  I am DarkSim905.
[02:38.960 --> 02:47.360]  I'm a sysadmin during the day, and I'm also the founder of Tool New Jersey, so if you guys are based out of New Jersey, you should check us out.
[02:48.340 --> 02:58.000]  The uniform that I'm wearing is actually one of the TSA shirts, so you guys can check that out after the talk if you'd like downstairs in the mezzanine.
[02:58.460 --> 02:59.820]  We've got pat-downs.
[03:00.220 --> 03:00.920]  Not quite.
[03:00.920 --> 03:04.300]  Oh yeah, we'll get some blue gloves for him from security.
[03:04.840 --> 03:05.560]  It'll be great.
[03:05.800 --> 03:12.340]  And this is also my first talk at HOPE, first conference talk ever as well, and let's make it a good one.
[03:13.660 --> 03:15.680]  I'm going to be live tweeting, that's what's going on.
[03:16.240 --> 03:16.600]  Okay.
[03:17.260 --> 03:18.900]  I love that shirt, it's incredible.
[03:20.700 --> 03:21.820]  Stand up, show it off.
[03:22.620 --> 03:23.180]  Come on.
[03:23.700 --> 03:24.280]  Do a little turn.
[03:24.620 --> 03:25.300]  Show them what you got.
[03:25.480 --> 03:26.680]  Show them what you got.
[03:27.380 --> 03:29.460]  I love the shoulder pads.
[03:31.720 --> 03:32.120]  All right.
[03:32.400 --> 03:32.540]  That's enough.
[03:33.040 --> 03:34.060]  Let's actually, you know.
[03:34.160 --> 03:34.860]  Throw us the keys.
[03:35.080 --> 03:35.380]  All right.
[03:35.520 --> 03:35.820]  Okay.
[03:35.820 --> 03:37.420]  So we're going to run through some disclaimers real quick.
[03:37.580 --> 03:39.820]  I'll give you guys about three-ish seconds per slide.
[03:40.040 --> 03:41.820]  Just make sure that you understand all of this.
[03:42.060 --> 03:44.160]  Literally everything, because this is now legally binding?
[03:44.500 --> 03:44.700]  Yeah.
[03:44.700 --> 03:44.720]  Yeah.
[03:45.020 --> 03:49.100]  By not leaving the room, you now agree to everything that appears in these disclaimers.
[03:50.240 --> 03:50.960]  Thanks, everybody.
[03:51.940 --> 03:52.880]  But wait, there's more.
[03:53.020 --> 03:53.100]  No.
[03:53.200 --> 03:56.220]  There's a lot of important things going on.
[03:56.440 --> 03:57.340]  Keys are dangerous.
[03:57.620 --> 03:58.520]  I don't know if you realize that.
[03:59.000 --> 03:59.360]  Seriously.
[03:59.600 --> 04:01.240]  Ignore the censored text.
[04:01.340 --> 04:02.500]  That's not important.
[04:02.640 --> 04:03.140]  You don't have to worry about it.
[04:03.140 --> 04:03.440]  Not at all.
[04:03.760 --> 04:03.920]  Yeah.
[04:04.080 --> 04:04.240]  Okay.
[04:04.340 --> 04:05.220]  So those are disclaimers.
[04:05.280 --> 04:06.300]  We got that out of the way.
[04:06.400 --> 04:07.260]  There's nothing dangerous about those redactions.
[04:07.540 --> 04:07.660]  Yeah.
[04:10.420 --> 04:11.980]  There's some gross stuff in here.
[04:12.360 --> 04:12.720]  Okay.
[04:12.720 --> 04:13.320]  Moving on.
[04:13.440 --> 04:13.800]  Thank you.
[04:15.160 --> 04:17.240]  So what are TSA-approved locks?
[04:17.480 --> 04:19.220]  You've probably seen them in the store.
[04:20.280 --> 04:31.120]  If you go down to the Statler Electronics, it's the store by the side entrance to the hotel, you're probably going to want to run down there and buy a bunch of their TSA-approved locks at the end of this talk.
[04:31.780 --> 04:33.840]  There's some fun tricks that we'll show you with those.
[04:35.580 --> 04:55.360]  So basically the thing is that when the TSA was introduced, it was established by the Transportation Security Act, which mandated that within two years of its founding, shortly after 9-11, of course, that they would have to have the ability to hand screen every single piece of luggage moving through the commercial aviation system.
[04:55.360 --> 05:04.060]  That meant that by the beginning of 2003, they had to be able to paw through your luggage without you being around there to help them.
[05:05.720 --> 05:14.180]  So what happened is, at first when they introduced this policy, basically all they did was they gave everyone a bunch of bolt cutters and started cutting people's luggage open.
[05:14.180 --> 05:15.240]  That was their master key.
[05:15.460 --> 05:16.720]  Yeah, that was their master key.
[05:17.580 --> 05:18.560]  It was effective.
[05:18.840 --> 05:24.500]  It was very effective and they, in fact, liked it so much, they still use it as their primary method.
[05:25.180 --> 05:29.000]  There was the one time when they tied Deviant's luggage to a truck.
[05:29.120 --> 05:29.420]  Yes.
[05:30.380 --> 05:34.980]  Because they couldn't get through his locks, so they just cracked the thing the locks were attached to off of his luggage.
[05:35.220 --> 05:35.440]  Right.
[05:35.940 --> 05:41.520]  And I believe Cory Doctorow got his subjected to a couple of crowbars and some sledgehammers.
[05:41.520 --> 05:44.760]  I think the ones he got crowbarred also were not locked, if I recall.
[05:44.760 --> 05:45.500]  Yes, that was the best bit.
[05:45.720 --> 05:46.140]  So...
[05:46.920 --> 05:50.920]  His unlocked luggage was crowbarred open because, you know, you can't be too safe.
[05:51.340 --> 05:52.000]  But anyway...
[05:52.000 --> 05:53.540]  I mean, if you have a crowbar...
[05:53.540 --> 05:54.660]  In response...
[05:54.660 --> 05:55.320]  Use it!
[05:55.440 --> 05:55.780]  Exactly.
[05:56.260 --> 05:56.960]  So in response to this...
[05:56.960 --> 05:57.960]  Half-Life 3 confirmed.
[05:58.280 --> 05:59.840]  In response to this...
[06:00.340 --> 06:02.260]  They gotta justify their budget somehow.
[06:02.580 --> 06:10.520]  In response to this, a couple of private companies came up with a system of essentially the physical equivalent of key escrow.
[06:10.520 --> 06:14.820]  They would produce master keys that would open every lock that they produced.
[06:15.040 --> 06:17.440]  And they would give those master keys to the TSA.
[06:17.580 --> 06:23.580]  So they didn't need to keep cutting open your luggage and ripping it apart and setting it on fire and crushing it in a compactor and whatever.
[06:24.860 --> 06:25.940]  As one does.
[06:26.320 --> 06:26.640]  Sure.
[06:26.840 --> 06:31.940]  And basically, the only publicly available information is the precious...
[06:31.940 --> 06:32.520]  The precious...
[06:34.040 --> 06:36.360]  To their patents on these systems.
[06:36.560 --> 06:40.720]  Which basically just say, yeah, these are locks that can be opened without the owner being around.
[06:41.080 --> 06:44.100]  That is basically the only useful piece of information there.
[06:45.680 --> 06:47.480]  So yeah, I think that basically covers it.
[06:47.740 --> 06:47.760]  Yeah.
[06:48.100 --> 06:48.460]  So...
[06:49.560 --> 06:52.940]  Travel Sentry is the biggest and best known.
[06:53.100 --> 06:55.820]  They have that little red diamond logo that you see off to the side there.
[06:56.280 --> 06:59.420]  They are not a lock manufacturer themselves.
[06:59.420 --> 07:01.720]  They are essentially a standards body.
[07:01.860 --> 07:06.500]  And they license those standards to basically every other lock manufacturer in the world.
[07:07.060 --> 07:18.480]  So everyone from the big names, Master Lock, ABBAs, down to some guy in China who has a couple of hand files and some brass.
[07:20.280 --> 07:22.680]  And yeah, TSA locks, those are the...
[07:22.680 --> 07:29.640]  Well, the Travel Sentry ones are the ones that are the TSA 001 through 007 keys that you're probably all familiar with and have seen forever.
[07:30.080 --> 07:33.620]  Who's familiar with the TSA keys leak, I'm sorry, from last year?
[07:34.680 --> 07:35.780]  Surprisingly low amount.
[07:35.880 --> 07:36.400]  I see at least some hands here.
[07:36.580 --> 07:37.660]  It gets a bit dark towards the back.
[07:38.260 --> 07:38.560]  Okay.
[07:38.740 --> 07:40.620]  Well, we're going to talk about it so we don't have to...
[07:40.620 --> 07:40.760]  Yeah.
[07:41.160 --> 07:41.300]  Okay.
[07:41.300 --> 07:42.500]  So we'll keep going.
[07:43.260 --> 07:47.160]  So their lesser known competitor is Safe Skies.
[07:47.320 --> 07:48.880]  They have this little red torch logo.
[07:50.180 --> 07:54.080]  This one, they manufacture their own locks to their own specification.
[07:54.460 --> 08:03.720]  So if you ever see a lock with a little red torch logo and it says TSA Safe Skies on it, that has its own separate master key.
[08:04.020 --> 08:07.660]  It is manufactured by the people who designed the standard.
[08:08.600 --> 08:12.760]  And they only use one master key for every single lock they produce.
[08:13.540 --> 08:16.020]  They don't have seven different keys.
[08:16.260 --> 08:17.220]  They have one.
[08:18.280 --> 08:20.060]  And how many different biddings do they have?
[08:20.600 --> 08:23.780]  Oh, they have lots of different biddings, but the master key only has one.
[08:24.200 --> 08:24.340]  Yep.
[08:24.800 --> 08:27.660]  And the locks come in different shapes and sizes, but same key?
[08:28.020 --> 08:30.580]  Lots of different shapes and sizes, lots of different styles.
[08:31.760 --> 08:32.020]  No.
[08:32.640 --> 08:33.500]  No, no.
[08:33.660 --> 08:36.480]  I think the biggest one weighs in about three ounces.
[08:38.820 --> 08:44.820]  So, key escrow is an important concept here because this is the physical embodiment of it.
[08:45.140 --> 08:55.540]  Yeah, and this is the whole point we're getting at, not just with the talk, but with why we've gone through this whole process of taking these TSA master keys and releasing them to the public.
[08:55.560 --> 08:59.860]  We're not trying to make it so that you can lick people's travel toothbrushes and steal their panties.
[09:00.800 --> 09:11.620]  We're trying to show the general public what the problem is with trusting a third party with master keys, including encryption keys, the keys to get into our text messages, etc.
[09:12.380 --> 09:15.340]  The media was not great at that, but we'll talk about that later.
[09:15.980 --> 09:21.260]  So, right now, we're just going to give anybody in the room who's not familiar with the concept of what key escrow is in general.
[09:21.960 --> 09:39.220]  So, just if you are having trouble, if you don't know what the definition of this is, really think about if you've ever lived in an apartment building, those big mailboxes that you have in the lobby usually, how does the mailman get the mail into your box?
[09:39.460 --> 09:51.440]  Well, they have one key that opens all of the boxes, and they drop the mail hopefully in the right slot, and then they lock it back up, and then you come along with your key to open your small box within that large box.
[09:52.320 --> 09:55.020]  The USPS has the master key.
[09:55.300 --> 09:57.800]  They can open it whenever they deem it necessary.
[09:59.360 --> 10:01.720]  You can only ever open your part of it.
[10:02.120 --> 10:04.460]  Everybody's probably had an apartment building in that situation, right?
[10:05.720 --> 10:06.240]  Sure.
[10:06.960 --> 10:10.080]  Yeah, that one guy in the back is really being snide.
[10:10.220 --> 10:10.800]  I'm glad he's here.
[10:11.320 --> 10:12.640]  Thank you for being honest.
[10:14.800 --> 10:15.820]  Can we make it long?
[10:16.720 --> 10:17.380]  Yes, moving on.
[10:17.540 --> 10:18.440]  Master keying.
[10:19.220 --> 10:23.980]  This is a diagram showing a more typical master key system.
[10:24.180 --> 10:26.500]  Lots and lots of levels, lots of sections.
[10:27.080 --> 10:35.660]  So you have keys that open certain parts of the building, and eventually you work your way up from the lowest level, your office.
[10:35.660 --> 10:45.560]  You can only get into your office up to, you know, the head maintenance guy who has a key to everything that can open every single door in the building.
[10:48.570 --> 10:50.790]  The TSA didn't want something that complicated.
[10:50.930 --> 10:53.090]  They didn't want to deal with hundreds of keys.
[10:56.060 --> 10:57.500]  Yeah, so they went with seven.
[10:58.060 --> 10:59.600]  They went with seven, eight.
[11:00.400 --> 11:09.080]  But the other thing that happens when you have a system like this becomes really, really important to protect those master keys.
[11:09.340 --> 11:10.840]  You cannot show them to anyone.
[11:10.940 --> 11:13.200]  You cannot let anyone get their hands on them.
[11:13.820 --> 11:17.500]  It turns out that the TSA really isn't good at information classification.
[11:19.880 --> 11:21.720]  Really, really not good.
[11:23.120 --> 11:25.540]  I want to point out the date at the top of that last one.
[11:25.800 --> 11:27.220]  May 1st, 2008.
[11:28.520 --> 11:29.080]  2008?
[11:29.400 --> 11:30.740]  That's eight years ago.
[11:32.100 --> 11:33.280]  Over eight years ago.
[11:34.120 --> 11:34.600]  Not...
[11:34.600 --> 11:35.620]  And nothing has changed.
[11:35.880 --> 11:37.800]  And note that like all these pictures are different pictures.
[11:37.920 --> 11:39.960]  This is a dude showing it off to a camera.
[11:40.120 --> 11:41.720]  This is literally a TSA officer.
[11:41.720 --> 11:42.520]  Clearly in a TSA shirt.
[11:42.840 --> 11:43.200]  Showing it.
[11:44.320 --> 11:47.720]  Showing it to a travel journalist to post on Twitter.
[11:48.080 --> 11:48.220]  Yeah.
[11:48.760 --> 11:59.360]  The leaks of these photos are very interesting because you see these pictures and there's obviously us in the community, we understand the severity of the impact of these keys.
[11:59.620 --> 12:02.840]  You know, you're taking a picture, you can replicate it somehow.
[12:02.840 --> 12:09.860]  If you have the right know-how, knowledge, and understanding of technology, key control, bidding, and all that fun stuff.
[12:10.620 --> 12:11.180]  There we go.
[12:11.320 --> 12:14.740]  But the general public and mass media, they don't understand.
[12:14.740 --> 12:18.000]  They don't see that these pictures of these keys are a big deal.
[12:18.000 --> 12:22.700]  And it's slowly getting more and more to a tipping point where people are realizing why.
[12:22.880 --> 12:24.020]  This is why we're doing this.
[12:24.080 --> 12:32.280]  Yeah, they're not understanding that it doesn't take 12 years of schooling to learn enough CAD to be able to recreate a 3D image from a picture.
[12:32.280 --> 12:36.340]  Much less, you know, half an hour with a file.
[12:36.620 --> 12:40.620]  I want to particularly draw attention to this one all the way on my left.
[12:40.880 --> 12:42.100]  Probably your right, I guess.
[12:42.680 --> 12:45.260]  That one... no, no, stop, stop, stop.
[12:45.900 --> 12:49.700]  This one was published in the Washington Post.
[12:50.940 --> 12:55.200]  It got copied out to a whole bunch of their affiliate papers.
[12:56.980 --> 12:58.920]  And it didn't get noticed for a while.
[12:59.200 --> 13:09.800]  And then as soon as a whole bunch of savvy physical security folks found it and started pointing out, hey, this is a really, really stupid idea.
[13:11.300 --> 13:18.880]  They went back and they replaced the photo on the original image with little black boxes over the tips of each of the keys.
[13:18.880 --> 13:19.600]  Yeah.
[13:19.900 --> 13:21.880]  Only on the Washington Post website.
[13:22.300 --> 13:22.640]  Yeah.
[13:22.920 --> 13:26.060]  Every single affiliate still has the original photo.
[13:26.320 --> 13:27.780]  We got that one in here somewhere, I think.
[13:27.820 --> 13:32.040]  Yeah, that one I think I actually copied off of the Herald or something.
[13:32.400 --> 13:34.180]  Like, that's not how this works, guys.
[13:34.600 --> 13:35.800]  Oh, my God.
[13:36.100 --> 13:38.880]  Yeah, so let's go through a few more terrible examples.
[13:39.400 --> 13:40.360]  Oh, the Y11.
[13:40.800 --> 13:41.200]  Yeah.
[13:41.500 --> 13:46.300]  This is the key to open any gas pump.
[13:46.520 --> 13:46.740]  Yeah.
[13:47.220 --> 13:50.120]  Hey, if you want to access a gas pump, here's how.
[13:50.800 --> 13:59.440]  There's a video we opted out of showing you, but it actually has the dude who owns the key showing it to the news reporter going, This is the key.
[13:59.800 --> 14:01.420]  This is the key that opens...
[14:01.420 --> 14:01.840]  Oh, there we go.
[14:01.840 --> 14:07.980]  Here, these are the keys that open every gas pump right in the camera.
[14:10.040 --> 14:11.380]  Shout out to Deviant.
[14:11.560 --> 14:13.460]  If you need an example key of anything...
[14:13.460 --> 14:15.540]  Who needs to open a gas pump later today?
[14:15.920 --> 14:16.060]  Yeah.
[14:16.080 --> 14:16.300]  Anyone?
[14:16.600 --> 14:16.720]  Hands?
[14:16.720 --> 14:17.820]  Two's taking a road trip back.
[14:17.940 --> 14:18.400]  There you go.
[14:18.840 --> 14:19.280]  This guy?
[14:19.460 --> 14:19.560]  You?
[14:19.700 --> 14:19.800]  Here.
[14:19.900 --> 14:20.300]  Throw him up.
[14:20.380 --> 14:20.760]  Here it comes.
[14:21.960 --> 14:22.660]  All right.
[14:23.100 --> 14:24.820]  And now let's see another terrible example.
[14:25.360 --> 14:26.480]  This is my personal favorite.
[14:26.740 --> 14:26.960]  Yeah.
[14:27.060 --> 14:29.600]  The $8 key that can open New York City to terrorists.
[14:30.260 --> 14:36.580]  Anyone who was here for Deviant and Howard's Elevator Talk two years ago?
[14:37.220 --> 14:37.700]  Yeah?
[14:38.000 --> 14:38.320]  Okay.
[14:38.620 --> 14:40.420]  I think you might remember this one.
[14:40.700 --> 14:41.180]  Yeah.
[14:41.420 --> 14:49.440]  This is my personal favorite because it was printed on the front page of the New York Post like that big and that quality.
[14:49.660 --> 14:50.800]  Literally half a page.
[14:51.440 --> 14:51.940]  Half a page.
[14:52.080 --> 14:53.320]  Beautiful dithering tube.
[14:53.380 --> 14:53.420]  You could see...
[14:53.420 --> 14:55.720]  You could pull fingerprints off the image.
[14:56.640 --> 14:57.240]  Oh, cheers.
[14:57.240 --> 14:57.880]  It was incredible.
[14:58.520 --> 14:59.420]  And this was...
[14:59.420 --> 15:07.000]  This came out way after all of the shitstorm of the TSA keys leak where everyone now knew not to print pictures of your keys.
[15:07.000 --> 15:15.420]  New York Post being the kind of publication that they are, was like YOLO key drop.
[15:18.040 --> 15:25.200]  Now I do want to point out that actually this is about every three years or so, the New York Post rediscovers this.
[15:26.080 --> 15:26.280]  Yeah.
[15:26.900 --> 15:28.520]  So every three years or so...
[15:28.520 --> 15:28.800]  They blow their own minds.
[15:29.060 --> 15:29.240]  Yeah.
[15:29.480 --> 15:29.960]  It's like, wait.
[15:30.180 --> 15:31.500]  This is totally new.
[15:31.720 --> 15:36.420]  We've never published this before except for three years ago when we did this exact same thing.
[15:36.660 --> 15:40.420]  I imagine it's because they have to have insane turnover at such a crappy publication.
[15:41.200 --> 15:42.320]  Uh, yeah, probably.
[15:42.480 --> 15:45.280]  Like every three years it's a totally new staff, like top down.
[15:45.560 --> 15:46.500]  It certainly can't help.
[15:46.640 --> 15:47.800]  Someone's like, did you see these keys?
[15:47.960 --> 15:49.480]  Maybe we should print them.
[15:50.680 --> 15:51.180]  All right.
[15:51.300 --> 15:53.240]  Or they think this is what 3D printing is.
[15:53.400 --> 15:53.560]  Yeah.
[15:53.740 --> 15:55.200]  It's like, it's like 3D.
[15:55.360 --> 15:56.160]  You can see the depth.
[15:56.460 --> 15:56.620]  Yeah.
[15:56.740 --> 15:56.840]  Yeah.
[15:57.100 --> 15:57.320]  You know.
[15:58.580 --> 15:59.800]  That's what the kids are into.
[16:01.080 --> 16:01.480]  Okay.
[16:01.480 --> 16:01.560]  Okay.
[16:01.800 --> 16:08.060]  So, not only is the TSA really not very good at keeping secrets secret.
[16:08.320 --> 16:08.960]  F*cking hurts.
[16:10.180 --> 16:13.240]  It turns out that Travel Sentry really isn't.
[16:13.980 --> 16:14.840]  Uh, okay.
[16:14.960 --> 16:19.560]  Some of this got cut off at the bottom and our heads are probably in the way, but if you can't see those few lines at the bottom.
[16:19.560 --> 16:31.540]  Um, so, uh, they left it at https colon slash slash www.travelcentury.org slash security slash pdf slash, dammit, I'm reading that.
[16:31.680 --> 16:32.240]  Oh, I'm sorry.
[16:33.840 --> 16:36.400]  I was trying to like, bring it up to the end.
[16:36.560 --> 16:37.800]  Hey, we'll post the slide.
[16:37.980 --> 16:45.580]  slash pdf slash guide to Travel Sentry underscore pass keys underscore one underscore October underscore 2012 dash en dash pdf.
[16:45.580 --> 16:49.440]  That URL no longer works, but it was excellent at the time.
[16:49.680 --> 16:49.820]  Oh, yeah.
[16:50.820 --> 16:52.660]  It took them a while to notice.
[16:53.680 --> 16:56.360]  It took them at least three weeks before they took it down.
[16:56.540 --> 16:58.380]  They're like, oh, we'll get to it eventually.
[16:58.600 --> 16:59.760]  Yeah, it was on a to-do list.
[17:00.020 --> 17:00.300]  Yeah.
[17:00.540 --> 17:04.600]  We will be posting the slides in the GitHub later so you guys can see all of this.
[17:04.700 --> 17:05.780]  We don't expect you to read all this.
[17:05.920 --> 17:06.540]  Uh, yeah.
[17:06.660 --> 17:08.620]  If you don't know, we've got links at the bottom.
[17:08.780 --> 17:12.760]  Just, or just search TSA keys GitHub and you'll probably find it.
[17:12.760 --> 17:13.080]  Yeah.
[17:13.580 --> 17:13.720]  Yeah.
[17:13.940 --> 17:14.220]  All right.
[17:15.420 --> 17:19.060]  So, uh, you know, photos aren't the same as handing out keys, right?
[17:19.540 --> 17:25.540]  Well, um, I think, uh, Joss Weir's two years ago might, uh, disagree.
[17:25.880 --> 17:35.140]  I think, uh, the Guardian, uh, story from 2008, uh, regarding the sneaky project, uh, might disagree.
[17:35.140 --> 17:36.200]  Oh, I forgot about that.
[17:36.200 --> 17:36.800]  I think Barry Wells.
[17:36.800 --> 17:37.940]  That was such a good name, the sneaky.
[17:38.240 --> 17:39.680]  Barry, are you in the audience?
[17:39.980 --> 17:40.100]  No?
[17:40.340 --> 17:40.720]  Barry Wells?
[17:41.200 --> 17:41.500]  No?
[17:41.740 --> 17:41.960]  Oh.
[17:42.380 --> 17:42.580]  Okay.
[17:42.920 --> 17:47.680]  Well, Barry Wells and, uh, Han Fei at The Last HOPE in 2008.
[17:48.700 --> 17:58.460]  Uh, LockCon 2014, Christian Holler's project, uh, originally Photo Bump, now Auto Key 3D, which also is a great GitHub project if you're into this sort of thing.
[17:58.460 --> 18:04.240]  All have spent years presenting, this is a really bad idea.
[18:04.600 --> 18:04.680]  Yeah.
[18:05.000 --> 18:12.160]  And, like, and it's not that it's that hard to grasp because creating a key is, like, borderline a Neanderthal process.
[18:12.400 --> 18:15.600]  Like, you just have, like, a grinder and you're, like, a file and you're just...
[18:16.060 --> 18:16.500]  Yeah.
[18:16.780 --> 18:20.800]  So anyone, like, most anyone with a picture can just file a thing until it looks like the picture.
[18:21.040 --> 18:22.100]  Not to mention...
[18:22.100 --> 18:23.200]  Like, this is a basic human thing that we can do.
[18:23.280 --> 18:32.120]  Not to mention, there are at least two businesses currently operating in the United States, which use that exact process as the core of their service.
[18:32.460 --> 18:32.540]  Yeah.
[18:32.720 --> 18:37.680]  It's, hey, use your smartphone to take a nice photo of your key and upload it in our app.
[18:37.900 --> 18:38.040]  Mm-hmm.
[18:38.180 --> 18:39.960]  And we will cut keys for you to order.
[18:40.600 --> 18:40.780]  Yeah.
[18:41.180 --> 18:42.540]  Nothing could go wrong there.
[18:42.780 --> 18:43.340]  Nothing at all.
[18:43.340 --> 18:45.320]  You literally do that as a business model.
[18:46.140 --> 18:46.620]  Seriously.
[18:46.940 --> 18:50.980]  This is their business model and somehow this escapes them.
[18:51.060 --> 18:51.200]  Yeah.
[18:51.200 --> 19:04.720]  So outside of the filing process, which is not too hard, the media lost its mind when the ability to 3D print these keys came out.
[19:05.400 --> 19:09.400]  And that was really weird for a lot of reasons that we're going to get into.
[19:09.540 --> 19:12.340]  Who here owns or has played with 3D printers?
[19:12.340 --> 19:14.520]  I'd have to imagine most of the room.
[19:14.860 --> 19:18.560]  Who here has had great success with 3D printers?
[19:20.920 --> 19:21.480]  All right.
[19:21.740 --> 19:22.000]  I'm watching you.
[19:22.300 --> 19:26.620]  Well, so everybody with your hands up currently, all these people are liars.
[19:27.340 --> 19:28.360]  Make a note.
[19:28.740 --> 19:29.660]  Moving on.
[19:30.960 --> 19:36.440]  So once we had like these images of these keys, we got to work.
[19:36.440 --> 19:40.720]  I'll let DarkSim talk about the whole timeline here because he was really good at keeping this all up to date.
[19:41.260 --> 19:56.420]  So this entire process was very interesting because I did some similar stuff like this at an old job where we dealt with SolidWorks and CAD and designing stuff in enterprise software and then sending it to a 3D printer.
[19:56.840 --> 20:01.040]  This is very common in like the cosmetic industry where you're doing rapid prototyping.
[20:01.640 --> 20:26.180]  When we came across the keys because they're so flat and so easy to recreate in a CAD program, you can just ray trace them or in some cases import the entire image into SolidWorks or whatever program of your choosing and then just trace over it and then you extrude that object out into a 3D file and then you can just send it to a 3D printer.
[20:26.440 --> 20:27.480]  Yeah, we didn't...
[20:27.480 --> 20:30.840]  It literally takes less than 20 minutes if you're a competent designer.
[20:30.840 --> 20:37.600]  I mean, short of getting the measurements correct, just tracing it and doing what you need to is the easy part.
[20:37.820 --> 20:41.900]  Yeah, and we didn't need... we don't mean competent designer like Disney Pixar here.
[20:43.560 --> 20:45.280]  We mean, can you draw a straight line?
[20:46.020 --> 20:46.140]  Yeah.
[20:46.900 --> 20:48.840]  Maybe took a semester in community college.
[20:49.680 --> 20:50.380]  Anyway, yeah.
[20:50.380 --> 20:53.280]  So, that's pretty much what we did.
[20:53.860 --> 21:01.060]  And up until the 3D computer-aided design part, it's pretty cut and dry.
[21:01.240 --> 21:03.220]  You either know if you screwed it up or not at that point.
[21:03.600 --> 21:08.020]  The fun came when you actually tried to print these keys.
[21:09.420 --> 21:11.940]  3D printing is awful.
[21:13.420 --> 21:20.060]  And it's kind of fine if you're dealing with things where precision and manufacturing tolerances aren't a huge issue.
[21:20.360 --> 21:30.220]  But when you're dealing with something that can need to be very precise, such as a key, you run into a lot of problems with 3D printing in general.
[21:30.220 --> 21:33.960]  And so... let's go through that, yeah.
[21:34.540 --> 21:37.060]  So, first off, keys are normally metal.
[21:37.340 --> 21:38.460]  And lock cylinders are metal.
[21:38.700 --> 21:39.540]  Like, everything's metal.
[21:40.060 --> 21:44.100]  And now you're taking plastic and trying to replace metal with plastic.
[21:44.560 --> 21:48.140]  And keys take a relative amount of force to turn.
[21:48.220 --> 21:49.400]  It doesn't feel like much to your hand.
[21:49.400 --> 22:01.420]  But when you're talking about something like a brittle plastic, like PLA, with a very low torsion strength, if it's even a short key, a lock can be really hard for that thing to open.
[22:01.580 --> 22:08.700]  And even if you are able to open it once, you get max three or four turns out of a PLA key.
[22:08.940 --> 22:10.960]  And then you have to throw it out because it's worn down.
[22:12.520 --> 22:20.580]  Also, inserting a plastic key into a lock full of metal pins grinds the teeth on your key right down.
[22:20.860 --> 22:30.540]  And so even if you don't break it from just the pure torsion, three, four, five uses, your key's not going to keep working because you've cut all the tips off the teeth.
[22:32.000 --> 22:38.700]  Another problem with 3D printing is that it deals with melting a material and then re-solidifying it through cooling.
[22:38.900 --> 22:46.460]  And based on the environment that you're doing this printing in, that material expands or contracts as it cools.
[22:46.860 --> 22:48.820]  Expands as it comes out, contracts as it cools.
[22:48.980 --> 22:54.560]  And like how much it expands and contracts is based on air flow around the machine, etc.
[22:55.300 --> 23:11.600]  And so oftentimes, nearly every time that you print anything, the product you pull off of the platform in that printer is not the exact measurements that were in the file that you gave the printer because it usually expanded a bit and stopped there or it contracted too much.
[23:11.780 --> 23:17.860]  And so when you're dealing with something like a more precision lock, a high tolerance lock, of which the TSA...
[23:18.520 --> 23:20.600]  They are not precision instruments.
[23:23.740 --> 23:29.060]  You risk having nearly all of your prints of keys be failures just by nature of that.
[23:30.220 --> 23:33.940]  And like I said, filing down your own keys is not that hard of a thing.
[23:35.240 --> 23:38.020]  And so I want to stop right now because...
[23:38.020 --> 23:39.640]  And talk about the media a little bit.
[23:39.960 --> 23:43.800]  Because the 3D printing, like I said, is really where the media lost its shit.
[23:43.900 --> 23:47.020]  And like, oh my God, anybody with a 3D printer now can sniff my panties.
[23:48.060 --> 23:48.620]  And like...
[23:48.620 --> 23:49.400]  Or lick your toothbrush.
[23:49.660 --> 23:50.460]  Or lick your toothbrush.
[23:50.620 --> 23:51.460]  It's like, that's not the...
[23:51.460 --> 23:52.160]  That's not the...
[23:52.160 --> 23:53.460]  Yeah, that's true.
[23:54.000 --> 23:54.400]  But...
[23:54.820 --> 23:55.780]  It was true before.
[23:56.040 --> 23:59.720]  And while I love licking toothbrushes, that's not what I'm trying to do here.
[24:00.180 --> 24:05.920]  We were trying to show the concept of what happens when you give a third party...
[24:05.920 --> 24:10.100]  When you trust a third party with your master keys of any sort, be them encryption or otherwise.
[24:10.300 --> 24:12.380]  And this was a really hard concept for the layman to understand.
[24:12.520 --> 24:14.640]  The muggles didn't understand the concept of...
[24:15.240 --> 24:17.860]  You know, if it involves a computer, everyone's like...
[24:17.860 --> 24:19.060]  Ah, no, I...
[24:19.520 --> 24:20.260]  Computers, I don't know.
[24:20.440 --> 24:21.080]  I just...
[24:21.080 --> 24:21.380]  Whatever.
[24:21.620 --> 24:22.460]  Just tell me what to do.
[24:23.560 --> 24:23.980]  Uh...
[24:23.980 --> 24:29.460]  But if you go physical lock, if you go USPS postal box inside of your apartment building, everyone goes, oh, well, yeah.
[24:29.680 --> 24:31.120]  No, I don't want someone to have that.
[24:31.260 --> 24:33.500]  Even though they do trust the government with that same master key.
[24:34.160 --> 24:34.280]  Uh...
[24:34.280 --> 24:36.640]  And so Meyer Gibbon has always been like, alright, say...
[24:36.640 --> 24:37.340]  Say...
[24:37.340 --> 24:39.580]  We trust the U.S. government.
[24:40.080 --> 24:47.600]  Say that we all accept that the U.S. government has our best interests in mind, and only serves to protect us.
[24:48.040 --> 24:49.460]  Let's assume that's true.
[24:50.500 --> 24:51.940]  Let's just assume that's true.
[24:52.240 --> 24:52.620]  Yeah, yeah.
[24:52.740 --> 24:55.660]  I understand there's gonna be a lot of growling and yelling and gnashing of teeth.
[24:56.580 --> 24:57.980]  Let's assume that's true.
[24:59.900 --> 25:02.980]  What happens when the bad guys get those keys?
[25:04.180 --> 25:07.540]  And that's the old InfoSec, you know, it's not if, it's when.
[25:08.220 --> 25:10.160]  What happens when bad guys get those keys?
[25:10.640 --> 25:13.900]  And so, yeah, that's implying that keys will always be leaked.
[25:14.000 --> 25:19.000]  And so that's another common philosophy, like all information will eventually be leaked, all companies will eventually be breached.
[25:19.000 --> 25:19.680]  So what happens?
[25:19.840 --> 25:20.440]  When that happens?
[25:20.620 --> 25:22.320]  What's your backup plan for that?
[25:23.000 --> 25:30.200]  And I thought like the TSA keys was a really good idea of like introducing people to that philosophy and concept, and the media was just like panty sniffers.
[25:30.860 --> 25:31.340]  Yeah.
[25:31.700 --> 25:41.320]  And so I really liked the old diehard, you know, now I have a machine gun, because what happens when your opponent takes the weapon that you're using from you?
[25:41.320 --> 25:43.200]  Now he has a machine gun.
[25:43.420 --> 25:47.020]  Good job handing a machine gun to an idiot to guard something.
[25:47.260 --> 26:05.220]  We can all easily relate to that because we know people like Deviant who flies in the skies with firearms and the like, and we can say, hey, if you trust this third party with a key or this key escrow idea, how do you know that you can trust that person with what they're doing with your stuff?
[26:05.520 --> 26:20.660]  That's easy to relate to all of us, but to the mass media and to the average person, it's very difficult to get that idea across because in the average person luggage, they got baby bottles, panties, soap, clothes, junk, who knows what else.
[26:20.820 --> 26:21.920]  Lickable toothbrushes.
[26:21.980 --> 26:23.200]  Lickable toothbrushes.
[26:23.400 --> 26:23.620]  Yeah.
[26:24.200 --> 26:29.880]  And trying to get that idea across to people, they just constantly miss the point.
[26:29.880 --> 26:31.740]  And you'll see plenty examples of that.
[26:33.520 --> 26:42.620]  Yeah, and so I went on like a media tirade and like started hunting people down.
[26:42.860 --> 26:44.400]  I just lost my shit over this.
[26:46.180 --> 26:54.140]  When what I found in trying to get the media to understand this is that, A, nearly regardless of publication.
[26:54.280 --> 26:56.040]  And by the way, I'm speaking about mainstream media here.
[26:56.240 --> 26:59.660]  There are some really great tech specific media out there.
[26:59.700 --> 27:01.560]  And I'll call a few people out in a bit.
[27:01.740 --> 27:06.380]  So when I say the media, I mean the media, capital T, casual M.
[27:06.540 --> 27:07.620]  We all know who I'm talking about.
[27:07.960 --> 27:14.940]  What I found was that the content that's published in most places is rarely, if ever, fact checked.
[27:15.600 --> 27:19.660]  And I found this out because I tweeted out some incorrect facts.
[27:20.900 --> 27:24.780]  Such as this one and this picture I had here and then another one.
[27:24.920 --> 27:26.180]  Maybe there was a better tweet I could have used.
[27:26.300 --> 27:30.100]  But I sent out a couple of tweets as soon as I had printed the keys.
[27:30.600 --> 27:32.140]  One of which was this one, right?
[27:32.280 --> 27:35.000]  I printed all the keys and I went, holy shit.
[27:35.920 --> 27:37.580]  We have all the... this happened.
[27:37.900 --> 27:39.340]  And I went to dinner.
[27:39.460 --> 27:41.260]  You can see like that's a menu underneath them.
[27:41.460 --> 27:42.240]  It says like tofu.
[27:42.900 --> 27:44.000]  I went to dinner.
[27:44.140 --> 27:46.480]  I was starving but I wanted for these keys to finish printing.
[27:46.480 --> 27:47.420]  And so I did.
[27:47.500 --> 27:48.640]  I took them to dinner and I took a picture.
[27:48.760 --> 27:49.560]  I was like, we got the keys.
[27:49.980 --> 27:53.740]  Then I went home from dinner, stuck them in some locks and I was like, none of these work.
[27:53.900 --> 27:55.620]  These are way too small.
[27:55.880 --> 27:57.540]  This is not the right measurements.
[27:57.920 --> 27:59.520]  These are... we don't have anything.
[28:00.020 --> 28:01.020]  But it was too late.
[28:01.620 --> 28:06.080]  Everyone was just publishing my tweet and every article that was out there like, oh no!
[28:07.300 --> 28:08.400]  The sky is falling.
[28:08.400 --> 28:09.820]  The sky is falling.
[28:10.180 --> 28:11.640]  People are stealing your underwear.
[28:13.060 --> 28:14.320]  Go take my underwear.
[28:14.880 --> 28:15.400]  Like it's fine.
[28:15.960 --> 28:18.640]  But like what happens when they want to take Deviant's guns.
[28:23.060 --> 28:27.500]  So most of the news outlets I found were nothing more than just Twitter aggregates.
[28:27.720 --> 28:37.340]  Like every article I'd find on the topic, like all they did was they found a bunch of us who tweeted about some TSA keys shit and then just regurgitated and extrapolated the information that was in there.
[28:37.340 --> 28:40.680]  Maybe they referenced one thing from eight years ago that happened.
[28:41.060 --> 28:45.680]  But there was like... it's just like long form Twitter.
[28:46.340 --> 28:54.500]  There's no reason for nearly all of the news websites that exist out there to even exist if you just get on Twitter and search for a term.
[28:55.200 --> 29:10.220]  And what else I found was that a lot of them were just literally copying stories from other news sources, sticking them on their website, or saying, you know, a quick byline like, hackers 3D print TSA keys.
[29:10.560 --> 29:11.700]  New stuff has happened.
[29:11.880 --> 29:12.920]  And that's their OC.
[29:13.100 --> 29:13.940]  That's their original content.
[29:14.060 --> 29:16.220]  And then the rest is like according to the Washington Post.
[29:16.500 --> 29:18.960]  And then six paragraphs that they took out of the Washington Post.
[29:19.100 --> 29:21.000]  And I'm like, how is this journalism?
[29:21.500 --> 29:24.160]  You didn't do anything here except read the newspaper.
[29:25.580 --> 29:27.380]  You're just being a civilian.
[29:28.160 --> 29:30.660]  You're just being a normal person.
[29:30.920 --> 29:32.280]  You're not... yeah.
[29:33.260 --> 29:35.720]  And then so I was like, well, let's get to work on fixing this.
[29:35.840 --> 29:38.020]  And I tried to contact like everybody.
[29:38.020 --> 29:46.080]  Well, it's specifically the people who were doing the toothbrush liquor FUD stories versus the...
[29:46.080 --> 29:47.420]  This makes me very angry.
[29:48.260 --> 29:56.860]  Versus the, you know, the, hey, hackers are showing the problem with providing a third party master keys for X, Y, and Z.
[29:57.880 --> 29:59.920]  And f*ck radio silence.
[30:00.460 --> 30:01.580]  Like zero response.
[30:01.760 --> 30:02.640]  Not even a form letter.
[30:02.760 --> 30:06.600]  Not a thank you for your concern and we'll consider this for our corrections column that comes out every Tuesday.
[30:06.600 --> 30:07.660]  Like nothing.
[30:07.900 --> 30:17.840]  Just to give you guys an idea, I have a running page of like the timeline of this leak and the different articles that we've all been featured in and that the keys have been showed in.
[30:18.240 --> 30:32.380]  And I want to say out of the 40 or 50 articles on that page, I want to say two or three of them were reporters that reached out to us personally in some capacity to verify facts and ask how did this go down?
[30:32.380 --> 30:33.740]  What's the proper timeline?
[30:34.120 --> 30:35.060]  Who did what?
[30:35.660 --> 30:39.380]  You know, would you like to be referred to by your handle or name?
[30:39.980 --> 30:41.220]  So on and so forth.
[30:42.240 --> 30:43.500]  That's very bad.
[30:43.740 --> 30:45.360]  Like that's a very small percentage.
[30:45.680 --> 30:45.720]  Yeah.
[30:46.080 --> 30:46.880]  Two, three out of 50.
[30:47.080 --> 30:51.540]  And one was one that I did contact and did respond and say, thank you.
[30:51.660 --> 30:53.120]  I have been looking to that already.
[30:53.260 --> 30:54.080]  I'm getting it changed.
[30:54.520 --> 30:55.700]  I called her out later.
[30:55.700 --> 30:57.600]  So yeah, the vast majority.
[30:57.820 --> 30:58.400]  Don't give a shit.
[30:58.580 --> 30:59.260]  Drop the story.
[30:59.440 --> 30:59.740]  YOLO.
[30:59.880 --> 31:00.200]  Move on.
[31:03.460 --> 31:08.600]  So there are there are good journalists, but there's a problematic common thing here.
[31:08.780 --> 31:10.400]  These are these are I wrote this list.
[31:10.500 --> 31:13.140]  This is my personal favorite off the top of my head list of journalists.
[31:13.340 --> 31:15.940]  I'm sure Nite 0wl and DarkSim have some favorites as well.
[31:16.020 --> 31:19.860]  This is just a slide I made at least a couple that I would add.
[31:20.000 --> 31:20.640]  But sure.
[31:20.640 --> 31:22.280]  And you can say their names if you like.
[31:23.480 --> 31:24.340]  I don't know if you want to know.
[31:24.360 --> 31:26.460]  Brady Dale who writes for The Observer.
[31:26.820 --> 31:26.980]  Yes.
[31:27.220 --> 31:27.560]  Good call.
[31:27.760 --> 31:28.260]  Great guy.
[31:29.140 --> 31:29.820]  Great guy.
[31:30.360 --> 31:30.900]  Cashmere Hill.
[31:31.700 --> 31:32.100]  Okay.
[31:32.380 --> 31:34.120]  We've got a recommendation from the audience.
[31:35.400 --> 31:38.120]  I need to call out Jenna McLaughlin.
[31:38.200 --> 31:38.640]  Are you here?
[31:38.860 --> 31:39.580]  Can you throw a hand up?
[31:41.240 --> 31:41.820]  Hi Jenna.
[31:42.140 --> 31:42.380]  Hello.
[31:43.120 --> 31:46.180]  Jenna was the one person I talked to who responded to me.
[31:46.300 --> 31:47.820]  And that was when I was talking when I stood up.
[31:47.980 --> 31:48.180]  I know.
[31:48.260 --> 31:48.760]  Already on it.
[31:49.700 --> 31:50.900]  Stand up and take a bow.
[31:51.220 --> 31:51.620]  Real quick.
[31:51.620 --> 32:02.400]  So thank you Jenna for being a real journalist and doing the work properly at the expense of possible, you know, the slight embarrassment that comes from maybe slightly incorrectly reporting something.
[32:02.520 --> 32:07.720]  Although, what was being reported was facts presented by me that were incorrect, that I later corrected.
[32:07.900 --> 32:09.800]  And then I went up and said, hey everybody, just heads up.
[32:10.520 --> 32:10.940]  So yeah.
[32:11.120 --> 32:13.040]  Hopefully Cory is somewhere still in the building.
[32:13.300 --> 32:13.540]  Yes.
[32:13.660 --> 32:15.960]  No, I think Corey had to get home to his family.
[32:15.960 --> 32:17.100]  I was talking to him earlier.
[32:17.100 --> 32:17.720]  I mean, that's fair.
[32:18.020 --> 32:18.900]  Corey's super cool.
[32:18.900 --> 32:23.180]  I know at least one or two other people on this list are hopefully watching.
[32:23.560 --> 32:23.780]  Mm-hmm.
[32:24.060 --> 32:25.020]  Steve Reagan, for sure.
[32:25.400 --> 32:25.540]  Yeah.
[32:26.440 --> 32:29.620]  But, so here's the problematic common denominator with this list.
[32:30.300 --> 32:31.880]  They're almost all tech journals.
[32:33.260 --> 32:34.600]  Outside of tech journals.
[32:34.600 --> 32:35.000]  And actual techies.
[32:35.280 --> 32:36.380]  And actual techs.
[32:36.500 --> 32:39.520]  These are all people that understand the problem we're getting at.
[32:40.480 --> 32:40.800]  Yeah.
[32:41.180 --> 32:44.940]  And the problem with that is that the muggles don't read the tech journals usually.
[32:45.220 --> 32:49.740]  I mean, you get the kind of geeky muggles that do, but they're sort of aware of the problem anyway.
[32:49.860 --> 32:52.340]  Because it's not a complicated problem we're talking about here.
[32:52.340 --> 33:00.400]  The problem is that you're not getting your NBC, your Fox News to report these stories properly because they still want the FUD.
[33:01.000 --> 33:01.460]  Oh, yeah.
[33:01.460 --> 33:06.900]  And they're not responding to any pushback and fighting from us to get that changed.
[33:06.900 --> 33:09.440]  The local Fox affiliate was particularly bad.
[33:10.280 --> 33:13.920]  I'm sorry we don't have a video of that, but it was super bad.
[33:14.320 --> 33:14.460]  Ouch.
[33:15.120 --> 33:15.840]  Really, really bad.
[33:15.840 --> 33:16.340]  Which one was that?
[33:16.580 --> 33:16.860]  What was...
[33:16.860 --> 33:19.260]  Oh, that was Fox 5 New York.
[33:19.480 --> 33:21.420]  I forget the call letters.
[33:21.500 --> 33:24.840]  I like how you just say Fox 5 New York and there's a bunch of chuckles in the audience.
[33:26.520 --> 33:32.480]  Really, outside of The Simpsons, that's really not a station worth watching these days, as far as I know.
[33:33.060 --> 33:33.640]  I don't know.
[33:33.760 --> 33:38.280]  I haven't been able to get broadcast TV in the city since we went digital.
[33:42.460 --> 33:44.320]  You kind of went down a weird tangent.
[33:45.040 --> 33:47.060]  You want to tell us the layout of your apartment?
[33:47.360 --> 33:47.740]  Yes.
[33:47.920 --> 33:50.800]  I live in a Faraday cage that was constructed in 1934.
[33:51.040 --> 33:51.460]  That's valid.
[33:52.100 --> 33:53.480]  Did Nikolai Tesla live there?
[33:54.100 --> 33:54.520]  No.
[33:54.660 --> 33:57.940]  He lived in a building owned by my current employer.
[33:58.980 --> 33:59.040]  Oh.
[33:59.360 --> 33:59.620]  Yeah.
[33:59.760 --> 33:59.820]  Okay.
[34:01.840 --> 34:03.460]  Weird shit happens in New York, okay?
[34:03.460 --> 34:05.260]  So, media rants over.
[34:05.480 --> 34:07.740]  I'm not going to sit here and make this like an anti-media talk.
[34:07.900 --> 34:08.310]  We don't have to.
[34:08.460 --> 34:09.120]  We all hate the media.
[34:09.930 --> 34:12.220]  So, back to like the testing and refining process.
[34:13.020 --> 34:20.980]  Aside from just like the problems with 3D printing in general, Xylitol, the guy, we have to give a shout out to Xylitol.
[34:21.240 --> 34:21.450]  Absolutely.
[34:21.450 --> 34:26.260]  He was the one who put out those very original first TSA keys.
[34:26.840 --> 34:30.060]  So, there's a lot to talk about with this testing and refining.
[34:31.080 --> 34:34.240]  How many of you guys have printed the keys here?
[34:34.520 --> 34:35.200]  Out of curiosity.
[34:35.540 --> 34:36.300]  Well, I know you did.
[34:36.390 --> 34:37.540]  That's significantly less...
[34:37.980 --> 34:38.140]  I saw your photos.
[34:38.480 --> 34:40.520]  That's significantly less hands than I was expecting.
[34:40.660 --> 34:41.000]  Wow.
[34:41.000 --> 34:45.100]  But, just so you guys understand, 3D printing is...
[34:45.100 --> 34:48.430]  There's a lot of iteriveness that goes into these things.
[34:48.700 --> 34:52.200]  There's a lot of calibration that goes into 3D printers.
[34:52.540 --> 35:03.910]  So, if you're printing the original files, they may not work as you expect them to because of the calibration of your printer settings and your firmware settings.
[35:05.240 --> 35:22.120]  Deviant, at the core group, he did a lot of fantastic research with us with a very nice pair of calipers and said, hey, you know, not all of these keyways are the same and not all of the results you get when printing these locks, these keys are the same.
[35:22.340 --> 35:32.000]  And I'd like to back that up a little bit and point out that we discovered that initially, right after the keys leaked and I had fixed the problem with the proportions and got keys out that were the right size.
[35:32.000 --> 35:32.840]  And that's what I was getting at.
[35:32.960 --> 35:36.280]  Like, Xylitol put the original designs out, but he didn't have any locks to test on.
[35:36.360 --> 35:37.000]  He's in France.
[35:37.410 --> 35:39.780]  Like, he can't go to the store and just buy TSA locks.
[35:40.040 --> 35:41.140]  But I had a few.
[35:41.960 --> 35:42.500]  Sort of.
[35:43.000 --> 35:43.910]  But I had a few.
[35:44.480 --> 35:48.820]  But anyway, so we put this out on Twitter and a lot of people came back with like, these keys don't fit at all.
[35:49.080 --> 35:50.360]  And I'm like, what do you mean at all?
[35:50.430 --> 35:56.340]  And they were off by an amount that was more than could be attributed to just like material expansion.
[35:57.160 --> 35:59.020]  And then we were like, wait.
[35:59.020 --> 36:03.240]  And we told people, could you get some calipers and give us the exact dimensions of these keyways?
[36:03.340 --> 36:06.620]  And they were posting some crazy, like significantly different measurements.
[36:06.860 --> 36:16.520]  And then Deviant sat down with all of these and gave us like this really cool hand-drawn document where he like listed all the keyway sizes that he had found.
[36:17.060 --> 36:18.680]  And that was incredibly helpful.
[36:18.680 --> 36:24.180]  And like, so for months and months and months, we continued to try and refine the keys that were in the repo.
[36:24.360 --> 36:25.320]  I'm not a tosser.
[36:25.340 --> 36:26.600]  They don't know what you're throwing out.
[36:27.950 --> 36:28.410]  All right.
[36:29.020 --> 36:29.680]  They continued to...
[36:30.720 --> 36:32.500]  Everybody who's catching a key, hang on to these.
[36:32.580 --> 36:33.800]  We'll tell you what these are in a second.
[36:34.430 --> 36:41.860]  And so we kept modifying the repo to try and get keys that were like an average of all the keyways that were out there.
[36:41.860 --> 36:50.680]  I was modifying a lot of them in my GitHub and then once I got enough confirmed kills with those, then I would send a pull request to Xylitol's repo.
[36:51.000 --> 36:55.890]  So there was a lot of points in time where you may have downloaded the keys and half of them didn't work.
[36:56.480 --> 36:57.300]  Try again.
[36:57.520 --> 36:58.800]  This was a constant thing.
[36:58.980 --> 37:01.460]  It's constant back and forth, constant improvement.
[37:02.340 --> 37:09.040]  At one point I had a Google form set up that anyone can fill out and say, Hey, what type of printer did you use?
[37:09.200 --> 37:10.620]  What firmware are you running?
[37:10.620 --> 37:13.430]  Did you print the regular keys or the stubby keys?
[37:13.600 --> 37:14.890]  Did they work or not?
[37:15.040 --> 37:16.450]  And what measurements did you get?
[37:16.640 --> 37:27.060]  And I want to say out of maybe hundreds and hundreds of retweets of the GitHub original files, I probably got six results on the form.
[37:27.320 --> 37:30.220]  So that tells you a lot of you guys are pretty damn lazy.
[37:31.080 --> 37:44.100]  I mean, a lot of these issues, yes, there are always scaling issues, particularly when you're trying to reproduce something without a reference to the scale of what you're trying to match.
[37:50.290 --> 37:51.230]  You know what to do.
[37:54.050 --> 38:01.810]  But it's also the fact that, you know, as we discussed before, there are so many variables involved in actually getting these dimensions right.
[38:01.950 --> 38:08.370]  And when you're dealing with something where the precision, despite the fact that most of these locks, the tolerances are abominable.
[38:09.050 --> 38:11.070]  Yeah, that was a huge part of the problem.
[38:11.210 --> 38:18.630]  The reason that the keyways were so significantly different was I bet that Travel Century set forth no tolerances, no manufacturing tolerances.
[38:18.790 --> 38:22.550]  So as long as this key we gave you works, f*cking do whatever.
[38:23.170 --> 38:29.530]  When we get you downstairs, I'll show you a couple of nice metal keys.
[38:29.830 --> 38:38.430]  And I will show you they work in half of the keys, in half the locks I have of this particular master key, and they don't work in the other half.
[38:38.770 --> 38:41.330]  And it's down to which manufacturer made it.
[38:41.890 --> 38:45.670]  Yeah, and that's down to just how shitty these TSA locks are in the first place.
[38:46.150 --> 38:55.210]  And another point I wanted to make about this that a lot of people I think didn't get, and we didn't talk about it much, was that, and to your point, I don't think it's that everybody's lazy necessarily.
[38:55.230 --> 38:57.610]  I think that a lot of us have imposter syndrome.
[38:58.050 --> 39:02.030]  And we feel like we don't know as much as these dudes know.
[39:02.290 --> 39:04.830]  Like, look at these kids doing, these guys doing the...
[39:05.910 --> 39:06.750]  We gotta speed up.
[39:06.970 --> 39:07.290]  Okay, yeah.
[39:07.690 --> 39:09.470]  So, like, these kids, like, they don't...
[39:09.470 --> 39:14.990]  Like, there's no way I know as much as Nite 0wl about, like, 3D printing keys, and he didn't actually know anything about 3D printing keys.
[39:15.650 --> 39:16.730]  Seriously, I know f*ck all.
[39:16.830 --> 39:24.950]  If there's a GitHub repo out there, and there's something going on in there that you think you can help with, even if, like, all you can add is, like, one line of code, f*cking do it.
[39:25.270 --> 39:26.170]  Just, like, do it.
[39:26.250 --> 39:27.030]  Add your one line of code.
[39:27.050 --> 39:28.570]  If it's garbage, they'll just forget you.
[39:29.550 --> 39:34.050]  This slide is just to show an example of the different variations of the keyways.
[39:34.050 --> 39:37.350]  Yeah, and so, like, and this is, this is the same lock.
[39:37.690 --> 39:41.150]  This is the same TSA, what is it, this is 007.
[39:41.350 --> 39:41.990]  For stealing your shit.
[39:42.070 --> 39:45.410]  All of those keyways in the middle are on 007 locks.
[39:46.010 --> 39:47.450]  That all use the same master key.
[39:47.450 --> 39:49.070]  Every single one of these keyways.
[39:49.270 --> 39:49.430]  Yeah.
[39:49.910 --> 39:51.370]  These are not different to you.
[39:51.930 --> 39:52.730]  One lock.
[39:52.870 --> 39:53.630]  I mean, it's sick.
[39:54.030 --> 39:54.250]  Yeah.
[39:54.690 --> 39:55.730]  That's all thanks to Deve.
[39:55.930 --> 39:56.590]  I shamelessly read them all.
[39:56.610 --> 39:58.150]  Everybody give it up for Deviants.
[39:58.350 --> 39:58.710]  Come on.
[40:03.160 --> 40:05.080]  A god among men in many worlds.
[40:05.460 --> 40:06.720]  And he's talking tomorrow.
[40:06.740 --> 40:07.820]  And he's talking tomorrow.
[40:07.840 --> 40:08.280]  About what?
[40:08.520 --> 40:08.880]  Again.
[40:09.260 --> 40:09.460]  Oh.
[40:09.800 --> 40:10.580]  The gas pump shit.
[40:10.680 --> 40:11.720]  All the key to light stuff.
[40:11.820 --> 40:12.760]  That's Howard and me tomorrow.
[40:12.960 --> 40:13.320]  What time?
[40:14.120 --> 40:14.820]  3 p.m.
[40:15.000 --> 40:15.320]  What room?
[40:15.580 --> 40:17.040]  Well, show up here at 3 p.m.
[40:17.140 --> 40:17.280]  Yeah.
[40:17.520 --> 40:18.020]  3 p.m.
[40:18.040 --> 40:21.760]  If it's not the right time, stay here and they'll come around eventually.
[40:22.180 --> 40:22.320]  Yeah.
[40:22.980 --> 40:24.960]  Vivian's one of my favorite speakers of all time.
[40:25.100 --> 40:25.820]  He's super entertaining.
[40:26.380 --> 40:26.860]  Love you, buddy.
[40:27.000 --> 40:28.300]  Highly recommend you come see him.
[40:29.060 --> 40:29.420]  Seriously.
[40:29.640 --> 40:30.600]  And he hooks us up.
[40:32.420 --> 40:35.480]  Seriously, I'm sorry for all the crap I stole from you.
[40:35.900 --> 40:36.500]  There we go.
[40:36.680 --> 40:36.880]  All right.
[40:37.380 --> 40:38.060]  All is forgiven.
[40:38.740 --> 40:39.920]  You guys like Howard too, right?
[40:40.080 --> 40:40.520]  Oh, yeah.
[40:40.700 --> 40:40.780]  Yeah.
[40:41.220 --> 40:41.940]  No, you're great.
[40:42.600 --> 40:43.220]  I don't like Howard.
[40:43.860 --> 40:45.280]  That was a ringing endorsement.
[40:45.700 --> 40:46.360]  Jesus Christ.
[40:46.520 --> 40:46.960]  2 out of 3?
[40:47.260 --> 40:47.780]  That's cool.
[40:47.880 --> 40:48.120]  Come on.
[40:48.200 --> 40:48.520]  Keep moving.
[40:49.400 --> 40:50.120]  All right.
[40:50.320 --> 40:56.980]  So let's get away from the whole 3D printing thing and get back to everything else and what's coming up.
[40:56.980 --> 40:57.560]  Yeah.
[40:58.280 --> 41:00.560]  So we've 3D printed all these keys, right?
[41:00.660 --> 41:01.540]  There's nothing left to do.
[41:01.920 --> 41:06.480]  Well, remember how we talked about the two competing standards?
[41:06.780 --> 41:11.000]  All of those keys were made based on leaked documents from Travel Century.
[41:11.080 --> 41:14.520]  That only covers their seven key standards.
[41:17.000 --> 41:21.160]  And we don't... and also people don't all have 3D printers.
[41:21.820 --> 41:22.760]  I mean, yeah, they're shapeways.
[41:23.160 --> 41:23.380]  Preposterous.
[41:23.380 --> 41:26.100]  I know, it's crazy, but also...
[41:26.100 --> 41:29.300]  The CEO of MakerBot said by now every one of us would have one in our homes.
[41:29.480 --> 41:30.980]  And amazingly, we still don't.
[41:31.240 --> 41:38.080]  But also, it's really expensive to buy printer time from a place like Shapeways or another service that prints it for you.
[41:38.320 --> 41:40.920]  So we fall back to classic techniques.
[41:41.240 --> 41:48.520]  You take some chunks of metal or plastic or something that you have to hand, you take some tools, and you cut and you file until it fits and it works.
[41:49.120 --> 41:56.540]  So, what we tried to do, that is myself, Iron Geek, who I don't believe is here this weekend.
[41:56.700 --> 41:57.040]  He is not.
[41:57.100 --> 41:58.160]  Lots of other people.
[41:58.840 --> 42:05.120]  We tried... we did our best to identify and source these blanks using classic locksmithing and impressioning techniques.
[42:05.720 --> 42:07.940]  And then we just impression the shit out of these locks.
[42:08.200 --> 42:08.580]  Yeah.
[42:09.320 --> 42:09.980]  And keep moving.
[42:10.380 --> 42:10.900]  Yeah, keep moving.
[42:11.060 --> 42:17.940]  So, SafeSkies probably was feeling pretty smug about the fact that Travel Century just totally got their shit run.
[42:18.220 --> 42:20.460]  Yeah, and there was never a leak of the SafeSkies key image.
[42:20.460 --> 42:21.160]  Yeah, no, no.
[42:21.520 --> 42:24.320]  Because, you know, they're... well, they're special.
[42:24.500 --> 42:29.240]  So, SafeSkies is the lock we should all use then, because hackers haven't released that key, right?
[42:29.240 --> 42:30.020]  Yeah, totally.
[42:30.020 --> 42:30.200]  Okay.
[42:30.280 --> 42:30.720]  All right, noted.
[42:31.140 --> 42:33.680]  Hackers totally do not have the key to SafeSkies.
[42:33.940 --> 42:34.040]  Cool.
[42:34.260 --> 42:34.460]  Okay.
[42:34.460 --> 42:36.320]  I am not being facetious at all.
[42:36.840 --> 42:38.160]  At this point in time.
[42:38.160 --> 42:40.120]  At this exact moment in time.
[42:40.300 --> 42:41.560]  I might know three people.
[42:43.940 --> 42:44.580]  Thereabouts, yeah.
[42:44.580 --> 42:46.180]  But we can talk to them in a bit.
[42:46.520 --> 42:46.960]  Yeah.
[42:47.020 --> 42:50.640]  So, what do we do if we can't find key blanks, though?
[42:51.640 --> 42:57.220]  Well, it turns out that you can totally go down to a hobby shop and buy something called sheet styrene.
[42:57.760 --> 43:01.820]  It's just polystyrene plastic and nice thin sheets used for model making.
[43:02.140 --> 43:06.280]  And it also is perfect with a bit of super glue for making your own key blanks.
[43:06.400 --> 43:07.740]  Making a model of...
[43:07.740 --> 43:09.060]  Making a model of a key.
[43:10.440 --> 43:14.340]  The hard way, which I also spent quite a lot of time doing, is...
[43:14.340 --> 43:29.040]  I want to interject and say that when I used to work in the computer repair shop like 20 years ago, and I would break little plastic bits of cases for people's laptops, I would use this polystyrene and super glue method to manufacture replacement support pieces to keep their hard drives and stuff.
[43:30.080 --> 43:31.900]  There's a lot of applications for this.
[43:32.020 --> 43:38.020]  But the other way is you find a key blank that is close, and you file it down until it fits.
[43:39.620 --> 43:40.100]  So...
[43:40.940 --> 43:41.860]  Here's the thing, though.
[43:42.740 --> 43:45.080]  Safe Skies, at first, very, very intimidating.
[43:45.080 --> 43:47.820]  You know, they have actual, like, master keying.
[43:47.960 --> 43:50.940]  They've got wafers in each chamber, and it's super complicated.
[43:50.940 --> 43:55.880]  And I don't know whether they're using total position progression or some other...
[43:55.880 --> 44:01.000]  Or what master keying scheme they're using for this, because they have keyed and unkeyed locks.
[44:01.180 --> 44:03.960]  But it turns out that they did something incredibly stupid.
[44:05.100 --> 44:08.820]  They committed the cardinal sin of any master key system.
[44:08.820 --> 44:19.640]  They sold to the public keys that had master wafers and wafer locks, which took the exact same master key.
[44:20.620 --> 44:26.500]  This produces a lock that gives you the exact bidding of the master key.
[44:27.360 --> 44:30.520]  Explain that in, like, encryption key terminology.
[44:31.820 --> 44:33.340]  Is Matt Blaze in the house?
[44:33.640 --> 44:34.540]  Okay, never mind.
[44:35.960 --> 44:37.100]  It's a lot easier for him.
[44:37.980 --> 44:39.880]  But you can see, hopefully...
[44:39.880 --> 44:39.960]  Yeah.
[44:40.980 --> 44:41.420]  So...
[44:41.420 --> 44:42.460]  Okay, you know what?
[44:42.540 --> 44:43.580]  We're gonna skip this.
[44:44.040 --> 44:46.020]  But hopefully you all understand the basic concept of master key.
[44:46.020 --> 44:49.820]  We'll post the slides so you guys can give yourself an education on how master keying works.
[44:49.900 --> 44:50.480]  You get the gist.
[44:50.540 --> 44:54.060]  I do have to give a shout out to David Nauer from Tool DC for those diagrams.
[44:54.420 --> 44:55.440]  He did great work.
[44:56.500 --> 44:56.940]  Right.
[44:57.160 --> 44:59.760]  So hopefully you can see all the photos down there.
[44:59.940 --> 45:03.960]  So, how did we get the Safe Skies master key?
[45:03.960 --> 45:09.920]  Well, with physical access and no monitoring or control, we can get really messy.
[45:10.220 --> 45:17.560]  You take a non-master key lock and you introduce a hammer or a Dremel tool or a crowbar.
[45:17.660 --> 45:17.780]  Introduce.
[45:18.100 --> 45:18.560]  Yes.
[45:18.760 --> 45:20.020]  You introduce them to each other.
[45:20.160 --> 45:22.120]  And they have great fun and make a big mess.
[45:22.120 --> 45:28.860]  And at the end of it, you have something similar to what's in the photo, which is a very simple...
[45:28.860 --> 45:29.080]  You can see that.
[45:29.660 --> 45:32.620]  ...the plug of the lock with all the wafers in it.
[45:32.940 --> 45:41.800]  And as I slowly file that key down until it exactly fits, I can check exactly how far off I am on every single bit.
[45:42.360 --> 45:44.660]  At that point, it's just guess, test, and revise.
[45:45.200 --> 45:45.580]  Exactly.
[45:45.820 --> 45:45.860]  Yep.
[45:46.280 --> 45:46.960]  Stick it in.
[45:47.140 --> 45:48.100]  Try to file a little more.
[45:48.220 --> 45:48.680]  Stick it in again.
[45:48.780 --> 45:49.280]  File a little more.
[45:49.380 --> 45:49.840]  Stick it in.
[45:51.900 --> 45:53.520]  And then babies are made.
[45:54.620 --> 46:02.020]  So, the TSA, when all of these things happened, this was really much more in the media response section.
[46:02.540 --> 46:03.320]  Uh, yeah.
[46:03.660 --> 46:03.760]  Yeah.
[46:04.040 --> 46:05.340]  Well, I mean, this is kind of like...
[46:05.340 --> 46:05.400]  Well, yeah.
[46:05.500 --> 46:08.500]  The TSA was just like, no, this doesn't really matter.
[46:08.560 --> 46:24.140]  We only intended to lend our brand, our grandeur as a federal security agency to give you peace of mind that people weren't licking your toothbrush and...
[46:24.140 --> 46:27.300]  Well, the bottom line was that the TSA said, hey, we're here to stop terrorists.
[46:27.460 --> 46:29.300]  And so, this allows us to inspect your luggage.
[46:29.300 --> 46:32.860]  We, we're not, we have no interest in securing a luggage.
[46:33.080 --> 46:34.500]  We don't give a shit about any other stuff.
[46:34.700 --> 46:36.200]  No, we don't care, and we do not care at all.
[46:36.320 --> 46:37.120]  That's what they said.
[46:37.260 --> 46:39.640]  I'm paraphrasing it, but they came out and said, no, we're not.
[46:39.780 --> 46:40.600]  In short...
[46:40.600 --> 46:41.360]  Security is not our interest.
[46:41.540 --> 46:45.720]  In short, they didn't care because it wasn't compromising their operational security.
[46:45.940 --> 46:49.980]  It was only compromising your personal illusion of security, as it were.
[46:50.140 --> 46:50.440]  Exactly.
[46:50.660 --> 46:51.820]  And at the same time they came out and...
[46:51.820 --> 46:54.460]  You know, if you just read between the Fnords, uh...
[46:54.460 --> 46:54.780]  Fnords.
[46:55.300 --> 46:56.880]  They came out directly...
[46:56.880 --> 46:57.940]  They came out and directly...
[46:57.940 --> 46:59.580]  I mean, we don't care about you little people.
[46:59.740 --> 47:00.980]  I don't even think you have to read between it.
[47:01.100 --> 47:03.220]  Well, no, they're pretty clear about it.
[47:03.360 --> 47:05.780]  Yeah, they said that we had no interest in securing anything.
[47:05.780 --> 47:07.960]  We just needed to make sure we could bypass the security.
[47:08.240 --> 47:10.060]  So, what about the future?
[47:10.680 --> 47:15.980]  Well, Stanton Concepts LLC wants to make the situation even worse.
[47:16.700 --> 47:18.320]  I thought this is my favorite.
[47:18.580 --> 47:18.960]  This is hilarious.
[47:19.100 --> 47:19.800]  This really is.
[47:19.960 --> 47:27.120]  This was when I was researching this, I was preparing this talk, and I came across this slide deck that Stanton Concepts had posted online.
[47:27.120 --> 47:29.020]  He showed this to me and I was just like, get the f*ck out of here.
[47:29.020 --> 47:29.980]  I don't know why they did this.
[47:30.080 --> 47:31.080]  I thought this was a joke.
[47:31.340 --> 47:33.140]  I thought somebody on Reddit made this as a gag.
[47:33.380 --> 47:33.560]  Yeah, this is serious.
[47:33.900 --> 47:34.940]  This is absolutely serious.
[47:35.060 --> 47:41.540]  This is a pitch deck from a major think tank to the TSA.
[47:42.960 --> 47:51.120]  Hey, you know, you've got all of these different keys, and it's a pain in the ass managing them, and your baggage screeners really just want to break shit.
[47:52.400 --> 47:52.760]  So...
[47:53.760 --> 47:55.320]  I want to reiterate, this is a pitch deck.
[47:55.420 --> 47:56.340]  We didn't make this slide.
[47:56.340 --> 47:57.160]  Not at all.
[47:57.440 --> 48:02.420]  I mean, we added the future little legend down that side there.
[48:02.880 --> 48:03.360]  That's it.
[48:03.780 --> 48:05.040]  SCI made these slides.
[48:05.200 --> 48:06.060]  Yeah, absolutely.
[48:06.480 --> 48:08.360]  To convince the TSA to buy their idea.
[48:08.680 --> 48:08.780]  Yeah.
[48:09.280 --> 48:13.300]  So SCI recognizes why this system is bad for the traveling public.
[48:14.060 --> 48:15.180]  Low security.
[48:15.500 --> 48:16.780]  No tamper indication.
[48:17.080 --> 48:18.160]  The keys have been copied.
[48:18.920 --> 48:19.440]  Cool.
[48:19.600 --> 48:19.980]  Sounds good.
[48:20.160 --> 48:20.400]  It's expensive.
[48:20.400 --> 48:21.180]  Yeah.
[48:21.360 --> 48:22.400]  So how do we solve that SCI?
[48:22.400 --> 48:23.580]  How do we solve this problem?
[48:24.020 --> 48:24.200]  Oh.
[48:24.200 --> 48:28.820]  Well, we just make it so that the TSA has no incentive to not just cut your lock.
[48:29.620 --> 48:31.600]  In fact, we make that the master key.
[48:32.640 --> 48:32.800]  What?
[48:32.980 --> 48:33.340]  Yeah.
[48:33.600 --> 48:33.780]  Yeah.
[48:34.100 --> 48:37.940]  No, it's literally just a nice big pair of diagonal cutters.
[48:38.280 --> 48:40.060]  You're staring into the future, folks.
[48:41.440 --> 48:42.920]  It is blinding.
[48:43.200 --> 48:43.240]  Yeah.
[48:43.420 --> 48:44.860]  And so what goes on here...
[48:44.860 --> 48:45.760]  Do the answer look very confused.
[48:46.000 --> 48:46.180]  Yeah.
[48:46.400 --> 48:52.160]  What goes on here is they cut the lock, check your shit out, lick your toothbrush, and then...
[48:52.160 --> 48:54.020]  And then they make it not cut anymore.
[48:54.020 --> 48:55.180]  And then they just stick it back in.
[48:55.220 --> 48:58.960]  And you get about five, six, seven uses out of a lock, and then...
[48:58.960 --> 49:00.000]  Oh, the shackle keeps...
[49:00.000 --> 49:00.560]  Yeah, the sh...
[49:00.560 --> 49:01.220]  Yeah.
[49:01.680 --> 49:03.460]  So you get a few uses...
[49:03.460 --> 49:04.220]  They've got a little...
[49:05.460 --> 49:10.540]  They have a little retaining cup, this little yellow bit, that slides up the shackle there.
[49:11.040 --> 49:11.440]  Right.
[49:11.440 --> 49:17.360]  That's actually part of a stack, and it's actually serrated where you are supposed to cut them.
[49:17.560 --> 49:21.560]  And then there's a little wheel that advances them up to replace it as they go.
[49:22.280 --> 49:23.600]  You get about ten uses.
[49:23.960 --> 49:24.860]  Oh, ten's pretty good.
[49:24.980 --> 49:25.300]  Yeah.
[49:25.600 --> 49:26.980]  I've got the full slide deck.
[49:27.080 --> 49:27.420]  That's good.
[49:27.420 --> 49:28.320]  I've got the full slide deck.
[49:28.360 --> 49:29.100]  I'll show it to you later.
[49:29.320 --> 49:29.560]  It is...
[49:30.160 --> 49:30.720]  It is...
[49:30.720 --> 49:31.920]  That's the appropriate amount of laughter.
[49:31.920 --> 49:33.840]  Anyone not laughing this hard is wrong.
[49:34.440 --> 49:34.880]  Yeah.
[49:34.880 --> 49:37.760]  And or off in another plane of existence.
[49:38.220 --> 49:38.360]  Yeah.
[49:38.840 --> 49:41.480]  So, unless you guys can keep mulling that over.
[49:41.660 --> 49:41.880]  Yeah.
[49:41.880 --> 49:43.660]  So, we're gonna try to give you the...
[49:43.660 --> 49:48.240]  I cannot believe I've been in sort of high-level business long enough.
[49:48.700 --> 49:49.440]  The takeaway.
[49:49.980 --> 49:51.260]  Your action items.
[49:51.460 --> 49:51.880]  Yes.
[49:52.160 --> 49:54.700]  Your action items as members of the traveling public.
[49:55.800 --> 50:00.600]  Don't put anything valuable or sensitive or important in your luggage.
[50:00.600 --> 50:01.060]  Yeah.
[50:01.200 --> 50:04.040]  A lot of people ask me, like, so I should just not use the TSA locks.
[50:04.340 --> 50:04.960]  It's like, no.
[50:05.160 --> 50:06.320]  Like, lock your shit up.
[50:06.840 --> 50:09.280]  Because you're trying to protect against the panty lickers.
[50:10.760 --> 50:14.000]  Like, those guys probably don't have, you know, 3D printed TSA keys.
[50:14.380 --> 50:14.500]  Right.
[50:14.500 --> 50:14.980]  That's not what we're saying.
[50:15.020 --> 50:17.320]  We're not saying stop locking your luggage at all.
[50:17.520 --> 50:17.700]  No.
[50:17.800 --> 50:18.120]  Keep locking.
[50:18.260 --> 50:19.800]  You have to use the TSA keys.
[50:19.800 --> 50:24.060]  Just be aware that they're not secure, you know, in certain circumstances.
[50:24.060 --> 50:26.080]  So don't put anything valuable inside your luggage.
[50:26.200 --> 50:32.140]  Recognize that even if you use a really good lock, your security posture is reduced.
[50:32.180 --> 50:37.180]  Because the security, the TSA, does not care about your security.
[50:37.780 --> 50:41.820]  The TSA cares about their job security.
[50:41.820 --> 50:42.900]  And that's by their own admission.
[50:43.600 --> 50:45.380]  That they have directly stated that.
[50:45.520 --> 50:47.580]  We're not, you know, just bashing them.
[50:48.000 --> 50:49.140]  Yeah, that helps.
[50:49.140 --> 50:50.140]  Or just don't travel.
[50:52.360 --> 50:54.940]  For the security community, you know what?
[50:55.220 --> 51:10.640]  Use this to, as a great way to explain to the non-technical public, to the non-security focused public, why key escrow in cryptosystems is dangerous.
[51:11.420 --> 51:14.240]  This is not a nerd harder problem.
[51:15.400 --> 51:17.360]  This is a nerd less hard problem.
[51:17.580 --> 51:17.860]  Yes.
[51:18.520 --> 51:19.500]  It's like P or NP.
[51:19.660 --> 51:20.100]  It's like N.
[51:20.380 --> 51:22.280]  It's like nerd, but not nerd.
[51:22.660 --> 51:29.680]  Don't, don't trust a black box security solution that promises to fix everything and magically solve all your problems.
[51:30.200 --> 51:33.680]  Can we show them the last few slides so they can have reasons?
[51:34.440 --> 51:34.580]  Yeah.
[51:34.880 --> 51:35.060]  Yes.
[51:35.320 --> 51:36.920]  So questions, too bad.
[51:37.540 --> 51:38.140]  Get them downstairs.
[51:38.140 --> 51:40.580]  Yeah, we'll be at the Tool Village immediately after this.
[51:40.720 --> 51:41.620]  Yell at us on Twitter.
[51:41.620 --> 51:41.740]  We'll talk to you forever.
[51:42.740 --> 51:43.820]  Oh, please yell at us on Twitter.
[51:43.920 --> 51:45.820]  There's way, way too many lines of disclaimers.
[51:45.820 --> 51:45.840]  Yeah.
[51:45.840 --> 51:47.400]  We'll post these slides like we said.
[51:47.500 --> 51:47.600]  Yeah.
[51:47.780 --> 51:48.300]  We're gonna put there.
[51:48.340 --> 51:49.820]  Oh, oh, oh, hang on.
[51:49.860 --> 51:50.520]  Before everyone runs away.
[51:50.540 --> 51:50.800]  Wait.
[51:51.140 --> 51:51.780]  We had a thing.
[51:52.040 --> 51:53.060]  Yes, we do have a thing.
[51:54.100 --> 51:54.580]  Hit it.
[51:54.800 --> 51:55.100]  Hit it.
[51:55.700 --> 51:56.680]  I want like a drum roll.
[51:57.600 --> 51:58.680]  Everybody, can we get a drum roll?
[52:00.180 --> 52:00.620]  And...
[52:01.280 --> 52:01.900]  Drop it.
[52:02.000 --> 52:02.320]  Boom!
[52:02.480 --> 52:03.560]  Who knows what this is?
[52:03.980 --> 52:05.120]  Anyone wanna guess?
[52:05.620 --> 52:06.240]  This is...
[52:06.240 --> 52:07.380]  Everybody hold your keys up.
[52:07.520 --> 52:08.500]  Safe Skies.
[52:08.500 --> 52:10.000]  If you got a key, hold it up.
[52:10.180 --> 52:11.900]  This is the final TSA key.
[52:12.040 --> 52:13.760]  Now all of them have been released.
[52:14.420 --> 52:16.340]  This is the Safe Skies TSA key.
[52:16.340 --> 52:17.200]  That is exactly this moment.
[52:17.840 --> 52:18.980]  You have it.
[52:22.340 --> 52:24.380]  We have all the measurements up in our slides.
[52:25.020 --> 52:28.660]  We will be posting the SDLT files where?
[52:28.940 --> 52:29.680]  The 3D files?
[52:30.020 --> 52:30.920]  I don't know.
[52:31.100 --> 52:32.020]  It's to be determined.
[52:32.160 --> 52:32.860]  I know that too.
[52:33.900 --> 52:35.460]  DocSim's website on his timeline.
[52:35.460 --> 52:37.300]  He's gonna be updating it as soon as he can.
[52:37.420 --> 52:38.400]  He will post links.
[52:38.880 --> 52:40.000]  You will get it.
[52:40.220 --> 52:40.660]  Yeah.
[52:40.660 --> 52:41.520]  You will have fun.
[52:42.100 --> 52:42.700]  That's us.
[52:42.800 --> 52:43.560]  That's our Twitter handles.
[52:43.720 --> 52:48.320]  We will definitely be tweeting out locations of these slides as well as all of the files for the Safe Skies key.
[52:48.320 --> 52:49.380]  As soon as we have them, we will tweet them.
[52:49.380 --> 52:50.020]  Yeah.
[52:50.160 --> 52:51.820]  Two last things before you guys get out of here.
[52:52.000 --> 52:55.680]  We are looking for help on revising these things because the keys are not perfect.
[52:56.120 --> 53:05.680]  And if you want to see more about keys working in applications that they shouldn't, Howard and Deviant are going to be giving a talk tomorrow on the same subject.
[53:05.820 --> 53:07.060]  I think you said 3 p.m.?
[53:07.060 --> 53:07.240]  Yep.
[53:07.840 --> 53:08.240]  Great.
[53:08.420 --> 53:10.060]  Can you put the picture of the key up real fast?
[53:11.960 --> 53:13.180]  Make it computer.
[53:13.760 --> 53:14.080]  That one.
[53:14.160 --> 53:14.580]  That one?
[53:14.640 --> 53:14.920]  No, no.
[53:15.980 --> 53:16.920]  Oh, you want that one?
[53:17.100 --> 53:17.400]  That one.
[53:17.400 --> 53:17.520]  Yeah.
[53:18.500 --> 53:20.260]  We think we know what that key is.
[53:20.380 --> 53:21.460]  It's an industry key, possibly.
[53:21.960 --> 53:22.340]  Excellent.
[53:23.500 --> 53:25.300]  The master key is an industry key.
[53:25.640 --> 53:26.500]  Even better.
[53:26.620 --> 53:27.960]  He thinks he knows what that key is.
[53:28.060 --> 53:30.380]  They didn't even make their own master key, possibly.
[53:30.900 --> 53:32.020]  Come to the talk tomorrow.
[53:32.280 --> 53:32.440]  Yeah.
[53:33.040 --> 53:42.480]  So, with just a couple minutes over, if you want to see more of this, if you want to yell at us, whatever, follow us down to the mezzanine.
[53:42.960 --> 53:43.600]  Thank you.
[53:43.680 --> 53:44.360]  Thank you, guys.
[53:44.360 --> 53:45.480]  But also, you've been a great audience.
[53:50.970 --> 53:52.210]  Give yourselves a big half.
[53:52.390 --> 53:53.730]  You guys are an amazing audience.
[53:53.870 --> 53:54.550]  This is fun as shit.
[53:54.670 --> 53:55.030]  Thank you.
[53:55.030 --> 53:55.790]  Thank you.
[53:57.310 --> 53:59.230]  My first talk at HOPE was not a failure.
[53:59.450 --> 53:59.810]  Do you have one of yours?
[54:00.950 --> 54:01.830]  It's too small.
[54:01.950 --> 54:02.450]  Take it downstairs.
[54:03.110 --> 54:03.210]  All right.
[54:03.450 --> 54:04.430]  It's, seriously.
[54:04.970 --> 54:06.390]  No, it's way too small.
[54:06.630 --> 54:06.850]  Oh, yeah.
[54:07.350 --> 54:07.530]  I know.
[54:07.530 --> 54:08.830]  Let's take this.
[54:08.970 --> 54:09.810]  You look at yours.
[54:09.950 --> 54:10.370]  Yep, thank you.
[54:10.610 --> 54:11.170]  Let's get downstairs.
[54:12.470 --> 54:13.790]  Do you have more from the fireman?
[54:14.250 --> 54:16.130]  Do you have more from the fireman?
[54:16.650 --> 54:17.130]  Yeah.
[54:18.150 --> 54:18.630]  Oh, yeah.
[54:19.490 --> 54:20.370]  Back to the back.
[54:20.790 --> 54:21.430]  All right.