The Security Threat of Forged Law-Enforcement Credentials | Hacker News Reader

The Security Threat of Forged Law-Enforcement Credentials

schneier.com

97 pointswglb12 comments

An impossible threat to fix, for all the reasons discussed in the article and comments. The only disincentive you can rely on for somebody showing you a fake badge is the small comfort that it is a huge felony for the guy to do so, so he's either really a cop or willing to face some hard time. Either way, resisting is not a good idea.

Having a lawyer on retainer and speed dial might help you catch some of the BS and/or protect yourself, but most Americans can't afford that. A (supposed) cop can easily claim PC to prevent you from calling anybody else.

It is a further argument against all of the automatic law-enforcement back doors.

Investigators were able to walk-in and request a background check on a fictitious name by waving a badge.

Suppose someone waving a badge could take down a website or get all communications involving a given person?

It's not a scenario that I'd considered as a possibility before, but it does seem quite plausible that a hijacker masquerading as police or an airport security guard could get onto an aircraft without going through even so much as a metal detector. All they would need would be something which looks convincingly like a uniform, some fake badge and a gun.

Actually to go through the security checkpoints armed federal agents need to have 2 sets of tickets printed from the check in desk. Which requires a call to their supervisor. They then have to fill out a form at the security check point and are asked for a secret password/code that is changed periodically. I don't think that just having credentials is going to get you past security.

I know this because I have a friend who flys armed since he is a Border Patrol Agent.

In that case maybe this isn't the loophole that I thought it could be.

From a comment: >>> Collecting police badges is a popular hobby for many policemen and they didn't want to have to stop.

They rate their hobbies above the safety of the public. I guess this is nothing compared to all the other security screwups going on.

They probably didn't see that policy helping.

Business model alert:

> I'd like to be able to photograph a law-enforcement badge with my camera, send it to some police website, and get back a real-time verification -- with picture -- that the officer is legit.

I wonder how big a problem this is. Might be something people can look at. Ties in with what I am passionate about, security

Perhaps a URL encoded as a barcode, which anyone with a smartphone camera can check.

Loved the E. E. Doc Smith reference :-) in one of the comments. A whole series of books where a major plot point was unforgeable credentials. Don't meet many people familiar with the series though, so I'm always surprised when I see a reference online.

I'm a huge of the series, I've read them all.

The series is called Lensman

http://www.amazon.com/Chronicles-Lensmen-Triplanetary-Lensma...

Reply on news.ycombinator.com