Richard L. Adams, the T.S.A.’s acting federal security director, said Mr. Soghoian’s generator “could pose a threat to aviation security.”

But Bruce Schneier, chief technology officer at BT Counterpane, a security consulting firm in Mountain View, Calif., emphatically disagreed. Anybody with Photoshop could create a fake boarding pass, he said. Mr. Soghoian’s Web site simply eliminated the need to use Photoshop. The T.S.A.’s profession of outrage is nothing but “security theater,” Mr. Schneier said, using the phrase he coined in 2003 to describe some of the agency’s procedures.

Mr. Schneier is not alone in his view that the T.S.A. vilifies people who point out its flaws. Matthew Blaze, an associate professor of computer science at the University of Pennsylvania, did not regard Mr. Soghoian’s generator as a dangerous breach of national security, either. “If a grad student can figure it out,” he said, “we can assume agents of Al Qaeda can do the same.”

The root problem, as some experts see it, is the T.S.A.’s reliance on IDs that are so easily obtained under false pretenses. “It would be wonderful if Osama bin Laden carried a photo ID that listed his occupation of ‘Evildoer,’ ” permitting the authorities to pluck him from a line, Mr. Schneier said. “The problem is, we try to pretend that identity maps to intentionality. But it doesn’t.”

Woe to him or her who happens to have a name identical to someone else deemed a possible menace to society and who finds, upon check-in, that the no-fly list places one’s own name by Mr. bin Laden’s. When a terror suspect’s alias using the Kennedy name appeared on the list, gate agents blocked Senator Edward M. Kennedy of Massachusetts from boarding in Washington. And Boston. And Palm Beach, Fla. And New York. Each time, supervisors interceded on his behalf, but only because of his status as an elected official.

T.S.A. officials have said they think that the effectiveness of the no-fly list, as well as a “selectee” list — which permits flying but brings an extra round of physical screening — will improve if the task of comparing names against the lists is taken out of the airlines’ hands and given to the agency. The name of this initiative is “Secure Flight.”

Ostensibly interested in what security specialists and legal authorities on privacy issues thought of its Secure Flight plans, the agency convened an advisory group in January 2005. (Mr. Schneier was a member.) Nine months later, when the advisers turned in their final report, it showed that the T.S.A.’s planners had given little or no thought to basic security issues, such as the problem of stolen identities.