Airport lounges will let anyone in, provided you can fake a QR code


Originally published at:

Fake boarding pass guy reports he was visited by FBI - UPDATED

Once for a friend’s birthday, a few friends and I prepared a sort of mini-ARG leading to a present (It was a digital thing, so we didn’t have to go burring anything in his garden, though the idea was floated). Sometimes I feel we used a similar level of security in preparing our ARG as vast multinational entities with the fate of millions in their hands do.

This thought does not fill me with cheer.


Many US-based airline lounges ask for a boarding pass for entry into their clubs (at least United does). When I use my physical membership card I am also asked to show my drivers license - presumably to confirm that I am not borrowing someone else’s card. Recently it was changed to show your boarding pass to confirm that you are flying on an eligible, same-day flight. Although this is a visual check and I doubt it does any kind of cross-check against the reservation system.

Most US domestic lounges suck balls anyway compared to international clubs so this hack wouldn’t be much to write home about.


At some level, there’s nothing wrong with having less security to get into a lounge than onto a plane. Just like you don’t protect your library card as strongly as you want the nuclear launch codes protected.


The only lounge I frequent in US airports requires me to show my boarding pass as well. Although they do accept the phone-generated electronic passes. I have no idea though if the boarding pass check actually verifies against a passenger manifest so it is possible that “fake QR code” + “fake boarding pass” would totally work


I had no idea that airline lounges were so nice!


“Abe Froman, Sausage King of Chicago?”

In my teens, I once flew on my dad’s points, but was called to the desk and offered an upgrade – if (they asked, suddenly getting suspicious on seeing me) I could provide some ID.

Shitstorm of aviation hysteria followed (long before 9/11, thank God), and they condescendingly allowed me to travel.

Very, very embarrassing. So, yeah, as an adult there’s no amount of free drinks, snacks, or WiFi that would ever tempt me to put myself in that situation again.


So then, 20 lines of Perl ought to get it, right?


Most fun @ airports:


Batholemew… the original article and the character’s name on the TV show it derives from has an ‘r’ between the a and the t.


Fun harmless qr code hacks in airports. Almost as fun, harmless and risk-free as making jokes about b-o-m-b-s in airports.


At the same time, the convenience cost to users above and beyond that of the boarding pass itself is literally zero, and there’s a minimal one time cost for the lounge likely offset by reduced unpaid use of lounge time.

QR codes are silly as a sole security measure anyway, you can just copy them.


I am surprised, I remember being asked for my boarding pass almost every time I checked in airport lounges. And they definitely cross-checked with the passenger manifest. It might work for some of them, but not all. Unless there is something else.


This topic was automatically closed after 5 days. New replies are no longer allowed.