Community
Wiki Posts
Search

Hacked Boarding Pass QR code?

Thread Tools
 
Search this Thread
 
Old Oct 26, 2012 | 8:19 am
  #31  
All eyes on you!
20 Years on Site
 
Join Date: Apr 2005
Location: BOS,PIT
Programs: Marriott Lifetime Platinum, JetBlue Mosaic-2, AA Platinum
Posts: 563
Drudge has picked up this story.
jfunk138 is offline  
Old Oct 26, 2012 | 12:28 pm
  #32  
Original Poster
 
Join Date: Jun 2012
Posts: 105
@baliktad...true that a TSO can direct a person for additional screening even without any audible alarms indicating the person needs additional screening

However, if a person has the 3 beeps - which is generally believed to indicate approval for precheck, do you really think a TSO will "get away" with not allowing that person into precheck?

The purpose of not knowing your status was to make precheck authorization unpredictable - this is meant to discourage prechecker (allegedly we the American People can trust precheckers) from bringing items that are not allowed.

Knowing your status before you even pack your luggage, allows a prechecker to do exactly what TSA was trying to discourage by way of not letting the prechecker know till the airport.

So yes, not a garuntee even with authorization, likelyhood a TSO will deny you access to precheck - when the TSO, you, and everyone else in precheck knows you are approved for it - very very small.
FatherAbraham is offline  
Old Oct 26, 2012 | 3:17 pm
  #33  
Ambassador: Alaska Airlines
10 Countries Visited
20 Countries Visited
30 Countries Visited
15 Years on Site
 
Join Date: Jul 2009
Location: Seattle
Programs: AS MVP Gold
Posts: 2,733
Originally Posted by FatherAbraham
However, if a person has the 3 beeps - which is generally believed to indicate approval for precheck, do you really think a TSO will "get away" with not allowing that person into precheck?
Yes, TSO's routinely tell people to do whatever they want.

But more importantly, the response of the barcode reader is still fully in control of the TSA. Right now everyone assumes that a 3 on the barcode means LLL, 3 beeps, and expedited screening 100% of the time. This is an assumption made without a full understanding of the system. The barcode reader can still beep once even when a 3 is present in the barcode.
baliktad is offline  
Old Oct 27, 2012 | 4:52 pm
  #34  
15 Years on Site
 
Join Date: Nov 2007
Posts: 322
Originally Posted by Ari
Good god-- why does everyone keep posting about a flaw that doesn't exist. Do people not understand what an electronic signature is? This has been posted several times already.

I am starting to question the competence and literacy of my fellow FT'ers.
Even with an electronic signature, that won't stop people from trying to find workarounds, or ways to mess around with/otherwise exploit - that's what makes fields of work/study dedicated to such things incredibly fun to consider going into.
Travelsonic is offline  
Old Oct 27, 2012 | 6:47 pm
  #35  
FlyerTalk Evangelist
40 Countries Visited
All eyes on you!
20 Years on Site
 
Join Date: Jun 2005
Posts: 38,543
Originally Posted by Travelsonic
Even with an electronic signature, that won't stop people from trying to find workarounds, or ways to mess around with/otherwise exploit - that's what makes fields of work/study dedicated to such things incredibly fun to consider going into.
And note that even those programmers who don't focus on such matters still need to pay attention to them--if you don't understand how people might break your stuff you can't hope to make it so they can't break it.
Loren Pechtel is offline  
Old Oct 28, 2012 | 12:39 am
  #36  
All eyes on you!
20 Years on Site
 
Join Date: Sep 2004
Location: The Bay Area, USA
Posts: 162
This person tweeted their AA boarding pass back in April 2010. I decoded this using my old Windows Mobile 6.5 phone using an app.

http://bit.ly/SNhryv

Knowing that all AA tickets start with 001 I thought that the last 14 digits prior to the "AA AA" Advantage number was the ticket number plus a check digit. In this case it's zero. Are we now saying that it's 3 if you are pre selected for PreCheck?
askmrlee is offline  
Old Oct 28, 2012 | 12:07 pm
  #37  
15 Years on Site
 
Join Date: Nov 2007
Posts: 322
Originally Posted by Loren Pechtel
And note that even those programmers who don't focus on such matters still need to pay attention to them--if you don't understand how people might break your stuff you can't hope to make it so they can't break it.
Exactly.

IMO, Ari is a bit hasty in dismissing people in the manner done in the post I repled to.
Travelsonic is offline  
Old Oct 28, 2012 | 2:43 pm
  #38  
All eyes on you!
15 Years on Site
 
Join Date: Nov 2009
Location: PHL , EWR
Programs: AA Platinum, UA Gold, Hyatt Diamond, Avis First
Posts: 293
Originally Posted by baliktad
Yes, TSO's routinely tell people to do whatever they want.

But more importantly, the response of the barcode reader is still fully in control of the TSA. Right now everyone assumes that a 3 on the barcode means LLL, 3 beeps, and expedited screening 100% of the time. This is an assumption made without a full understanding of the system. The barcode reader can still beep once even when a 3 is present in the barcode.
Exactly. For a data point I checked the last 3 of my US Airways boarding passes that allowed for precheck and there was no 3 in there.
steve65341 is offline  
Old Oct 28, 2012 | 6:05 pm
  #39  
 
Join Date: Apr 2009
Location: WAS
Programs: AMEX Platinum, Global Entry, Priority Pass, SPG Gold, HHonors Gold
Posts: 1,594
Originally Posted by steve65341
Exactly. For a data point I checked the last 3 of my US Airways boarding passes that allowed for precheck and there was no 3 in there.
Without the 3 in the barcode, how did the offline scanner know to indicate LLL?
14940674 is offline  
Old Oct 29, 2012 | 12:01 am
  #40  
All eyes on you!
15 Years on Site
 
Join Date: Nov 2009
Location: PHL , EWR
Programs: AA Platinum, UA Gold, Hyatt Diamond, Avis First
Posts: 293
Originally Posted by 14940674
Without the 3 in the barcode, how did the offline scanner know to indicate LLL?
I haven't been able to figure the pattern out since I don't have enough passes to scan and compare yet but I can tell you that it's definitely not dependent on the number 3 at the end of the sequence.
steve65341 is offline  
Old Oct 29, 2012 | 10:49 am
  #41  
Ari
FlyerTalk Evangelist
10 Countries Visited
20 Countries Visited
30 Countries Visited
20 Years on Site
 
Join Date: Aug 2005
Location: Chicago
Posts: 11,678
For US Airways, it is the second-to-last number in the long sequence that counts. The last number is something else-- the API indicator. You want the selectee indicator which comes before the API indicator. Most domestic boarding passes will leave the API indicator blank, but not on US.
Ari is offline  
Old Oct 30, 2012 | 12:26 am
  #42  
All eyes on you!
15 Years on Site
 
Join Date: Nov 2009
Location: PHL , EWR
Programs: AA Platinum, UA Gold, Hyatt Diamond, Avis First
Posts: 293
Originally Posted by Ari
For US Airways, it is the second-to-last number in the long sequence that counts. The last number is something else-- the API indicator. You want the selectee indicator which comes before the API indicator. Most domestic boarding passes will leave the API indicator blank, but not on US.
Sure enough that's it ! Thanks for the tip.
steve65341 is offline  


Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.