Airport security is completely non-authenticated
February 1, 2007
Casey Muller

I don't really know how well airport security stops bad things from getting through; I haven't tried (except a large toothpaste container, which they didn't comment on one way and let me through with the other).

But I know this- they have no idea who's flying on their planes, and there're crucial steps missing from the authentication of the tickets themselves (at least sometimes).

Here's the sum total of my identity interactions flying from LAX to SEA on Alaska this evening:

  1. I print out my boarding pass at home. It's html, and I could easily change the name.
  2. I walk to security, where they compare my driver's license with the name on the paper ticket.
  3. I go to the gate, hand them my ticket. They don't scan the barcode, but instead hit two buttons on a touch-screen, I'm guessing my seat number. Maybe my name comes up to be matched against the paper ticket.

The two keys are that the only attempt at matching my face is to a piece of paper I printed out, and they never even verify the boarding pass beyond (at best) that the seat is taken and maybe is assigned to the right name (I don't think they even look that closely).

Beyond any terror scenarios, what we now have is a way to transfer tickets for free. Somebody should start arbitraging last-minute tickets; you'd just give the purchaser two boarding passes on the day of: one to show security, one to give them at the gate. Sounds like a money maker.

Or here's what would be fun if you had access to a lot of email (like if you were hotmail, yahoo, gmail): Find somebody flying a route you want to go on. Check-in using their confirmation code and print out an extra copy in your name. Go to the airport a few hours early and fly standby by talking to the people at the gate. Or give your victim a flat tire or mickey and fly in their place when they miss their flight.

Easy fixes:

  1. At security, scan the boarding pass, have a computer look up the name of the actual ticket purchaser.
  2. At the gate, scan the barcode and make sure the details are right and somebody at least had access to the full ticket data.
  3. At the gate, if you really don't want to make people show their ID again (I've seen plenty of people with their IDs out now), flash a picture of the person that you took at the security check point.

I'm serious, somebody should start selling used airline tickets, that would make them fix these things fast.

Today's photographic nomination is in Objects:

previous entry:

Los Angeles



Old-school comments:
This was a slightly different approach, but don't forget this guy: http://www.wired.com/news/technology/0,72023-0.html
Heexposed some of these weaknesses, and they still haven't fixed them.  I like your observations though.  

-divya