Weblog

Monday October 09, 2006

Insecure pin codes for access to planes at LAX

Whilst sitting around waiting for my flight up from LAX to SFO today, I happened to be sitting where I could easily see the number pad for opening the doors out to the plane.

After watching both a pilot and hostess enter in their access codes, I began to wonder if there was any security at all in the PIN number they use. I'm not going to repeat what buttons I saw them push, but the sequence was quite easily observed...and easily remembered. I've never taken any real notice of this before, but I'm sure if I was thoughtful about it, recording the sequence would have been close to trivial with a video camera installed in a mobile phone whilst maintaining some degree of denyability.

The first problem here is observability. There is no privacy for the touch pad itself from casual observers. The security of the key entry relies on the body of the person entering in the PIN.

The second problem is that I could not see the use of or requirement for any other access control mechanism required - no swipe card of any sort.

So while TSA is making sure you can't carry on any lipstick or toothpaste, there seems to be little to stop a random person from walking down the air bridge, if they're observant enough.