4 ms·

That's a great example for why any kind of 'master key' is dangerous.

at-fates-hands 11y ago
Just a story to support your point. When I was a junior in high school, me and some buddies got into lock picking. Our goal was to be able to break into the school and explore places we weren't supposed to go. We could get in and out and no one would be the wiser. One of my friends figure out the janitors only had two master keys they used for every lock in the school. We were able to steal one, and reproduce it several times for each of the team members and get it returned without them suspecting anything. For two years, we roamed every part of the school and discovered some amazing things about our school that no one would ever know except us. For two years we had a run of the place, then turned them over to another group of incoming students were hackers like us. They did the same thing and it went on for several years and became somewhat of an urban legend. It finally ended when one group used the keys to break in and vandalize the school. Afterwards, the locks were changed, cameras and alarms were put in and all the fun ended. But your point is spot on.
- nly 11y ago
  > For two years, we roamed every part of the school and discovered some amazing things Well, don't leave us hanging...
  - kordless 11y ago
    Underground steam pipe hallways with rats, for one. For me, it was college.
    - elcct 11y ago
      Do you know where this rats were from?
      - filoeleven 11y ago
        Crotobaltslavonia, originally, though they only got as big as they are now from all the radioactive waste stored down there.
      - kordless 11y ago
        They were Oklahoma rats.
  - at-fates-hands 11y ago
    - We found a series of catwalks that ran above the gym. It was closed and you had a series of doors you had to go through to get there. It felt like something out of a movie. - Passages to the roof outside the normal fire escapes. - A bunch of underground tunnels (not steam tunnels) that ran under the school and connected to god knows where - all three tunnels ended at another set of locked double doors we couldn't seem to open with our lockpick set at the time. We think it may have been some 1940's bomb shelter or something. - The best was being in the maintenance rooms where they fixed stuff and had some really cool tools and tons of stuff in various stages of being torn apart. We also figured out the janitors had tools to break into the combination locks that secured all of our lockers which raised a few eyebrows. - All the outdoor storage areas. My school had four huge garages built into the side of a hill where all the sports equipment like track and field hurdles, landing mats, soccer goals and nets. They contained all kinds of balls and other things that probably shouldn't be stored there like jersey's, warm up suits, etc. It felt like stepping back into time since a lot of the stuff in there hadn't see the light of day since the 1970's. - Tons of empty storage rooms that were located throughout the school. This was the real reason we wanted to get those master keys. They just seemed completely random. Like in one hall, there were three, non-descript doors. No "Maintenance Only" or "No Students Allowed" posted on them. You'd almost miss them if you didn't recognize them. Some were empty, other held trophies from the 50's and 60's. Others had boxes and boxes of financial and academic records of students from long ago. Others had political flyers and pins from the 70's and 80's. The one thing I was really proud of is that we didn't do anything nefarious. We explored the school and never vandalized anything and for the most part were responsible with the power we had. The several classes after us did the same thing, pushing farther and discovering even more nooks and crannies that they would share with the rest of the groups that came before them over pizza and pop and the local Pizza Hut. When I read the books about the early hackers at MIT, exploring building 26, I finally knew what they felt like.
- Balgair 11y ago
  On hijinks: Our dorm rooms at college had a master key type system too. You dorm key would only open your room, but the RA, college dean, and other personnel had a master key. In talking with the RA who was a good friend, he let me and a few friends see the master key. I kid you not, the master key was just 1 tooth longer than our's. That's it, just 1 tooth and the locks opened all up. Well, now, with that know-how and access to any paper-clip, we had run of any lock at the college. The only nefarious purpose was to yank the cable hook-ups right before the finale of some dancing show to watch the girls loose their minds. Other than that, it was used for getting into your dorm when you locked yourself out.
  - mindslight 11y ago
    Our doors had master keys and core removal keys, but they also had lever handles and no weatherstripping. A bent coat hanger and some string made for a device that could quickly and reliably open doors. Most physical security works by perpetuating illusions.
KirinDave 11y ago
The entire SSL infrastructure we use is not only looking at you side-eyed, but also asking you if you've checked your SSL root certificate list lately. Just saying, our life is full of secret master keys. Most of the products built here rely on secret master keys. There really isn't any way to get around secret master keys. The problem here is that we don't trust the TSA to secure said master keys. In part because it's an incredibly hard problem since any image capture device glimpsing them can enable reproduction, but also because the TSA doesn't incentivise its employees well enough (see pay bands here: http://www.federallawenforcement.org/tsa/ http://www.federallawenforcement.org/tsa/ and note that airport security folks won't be making even $70k a year).
- TD-Linux 11y ago
  It's more of an example of why widely distributed, irrevocable master keys are a bad idea. In addition, it's also an example of why end-user-owned but secret master keys don't work (see DRM). The picture taken was totally not necessary to make these 3D models. You could just buy one of each of the seven lock types, and saw them open to look at the pin arrangements.
  - KirinDave 11y ago
    > The picture taken was totally not necessary to make these 3D models. You could just buy one of each of the seven lock types, and saw them open to look at the pin arrangements. Is it really that simple with modern locks? I thought they had gotten good at foiling this kind of attack.
    - TD-Linux 11y ago
      Newer locks are designed to be hard to pick. If you have complete, destructive access to the lock, there's nothing they can do.
- InclinedPlane 11y ago
  Are your implying that the ssl CA system isn't a huge shit show? Because it is, and it's only incrementally more secure than the tsa keys.

Just a story to support your point. When I was a junior in high school, me and some buddies got into lock picking. Our goal was to be able to break into the school and explore places we weren't supposed to go. We could get in and out and no one would be the wiser. One of my friends figure out the janitors only had two master keys they used for every lock in the school. We were able to steal one, and reproduce it several times for each of the team members and get it returned without them suspecting anything. For two years, we roamed every part of the school and discovered some amazing things about our school that no one would ever know except us. For two years we had a run of the place, then turned them over to another group of incoming students were hackers like us. They did the same thing and it went on for several years and became somewhat of an urban legend. It finally ended when one group used the keys to break in and vandalize the school. Afterwards, the locks were changed, cameras and alarms were put in and all the fun ended. But your point is spot on.

nly 11y ago
> For two years, we roamed every part of the school and discovered some amazing things Well, don't leave us hanging...
- kordless 11y ago
  Underground steam pipe hallways with rats, for one. For me, it was college.
  - elcct 11y ago
    Do you know where this rats were from?
    - filoeleven 11y ago
      Crotobaltslavonia, originally, though they only got as big as they are now from all the radioactive waste stored down there.
    - kordless 11y ago
      They were Oklahoma rats.
- at-fates-hands 11y ago
  - We found a series of catwalks that ran above the gym. It was closed and you had a series of doors you had to go through to get there. It felt like something out of a movie. - Passages to the roof outside the normal fire escapes. - A bunch of underground tunnels (not steam tunnels) that ran under the school and connected to god knows where - all three tunnels ended at another set of locked double doors we couldn't seem to open with our lockpick set at the time. We think it may have been some 1940's bomb shelter or something. - The best was being in the maintenance rooms where they fixed stuff and had some really cool tools and tons of stuff in various stages of being torn apart. We also figured out the janitors had tools to break into the combination locks that secured all of our lockers which raised a few eyebrows. - All the outdoor storage areas. My school had four huge garages built into the side of a hill where all the sports equipment like track and field hurdles, landing mats, soccer goals and nets. They contained all kinds of balls and other things that probably shouldn't be stored there like jersey's, warm up suits, etc. It felt like stepping back into time since a lot of the stuff in there hadn't see the light of day since the 1970's. - Tons of empty storage rooms that were located throughout the school. This was the real reason we wanted to get those master keys. They just seemed completely random. Like in one hall, there were three, non-descript doors. No "Maintenance Only" or "No Students Allowed" posted on them. You'd almost miss them if you didn't recognize them. Some were empty, other held trophies from the 50's and 60's. Others had boxes and boxes of financial and academic records of students from long ago. Others had political flyers and pins from the 70's and 80's. The one thing I was really proud of is that we didn't do anything nefarious. We explored the school and never vandalized anything and for the most part were responsible with the power we had. The several classes after us did the same thing, pushing farther and discovering even more nooks and crannies that they would share with the rest of the groups that came before them over pizza and pop and the local Pizza Hut. When I read the books about the early hackers at MIT, exploring building 26, I finally knew what they felt like.
Balgair 11y ago
On hijinks: Our dorm rooms at college had a master key type system too. You dorm key would only open your room, but the RA, college dean, and other personnel had a master key. In talking with the RA who was a good friend, he let me and a few friends see the master key. I kid you not, the master key was just 1 tooth longer than our's. That's it, just 1 tooth and the locks opened all up. Well, now, with that know-how and access to any paper-clip, we had run of any lock at the college. The only nefarious purpose was to yank the cable hook-ups right before the finale of some dancing show to watch the girls loose their minds. Other than that, it was used for getting into your dorm when you locked yourself out.
- mindslight 11y ago
  Our doors had master keys and core removal keys, but they also had lever handles and no weatherstripping. A bent coat hanger and some string made for a device that could quickly and reliably open doors. Most physical security works by perpetuating illusions.

KirinDave 11y ago

The entire SSL infrastructure we use is not only looking at you side-eyed, but also asking you if you've checked your SSL root certificate list lately. Just saying, our life is full of secret master keys. Most of the products built here rely on secret master keys. There really isn't any way to get around secret master keys. The problem here is that we don't trust the TSA to secure said master keys. In part because it's an incredibly hard problem since any image capture device glimpsing them can enable reproduction, but also because the TSA doesn't incentivise its employees well enough (see pay bands here: http://www.federallawenforcement.org/tsa/ http://www.federallawenforcement.org/tsa/ and note that airport security folks won't be making even $70k a year).

TD-Linux 11y ago
It's more of an example of why widely distributed, irrevocable master keys are a bad idea. In addition, it's also an example of why end-user-owned but secret master keys don't work (see DRM). The picture taken was totally not necessary to make these 3D models. You could just buy one of each of the seven lock types, and saw them open to look at the pin arrangements.
- KirinDave 11y ago
  > The picture taken was totally not necessary to make these 3D models. You could just buy one of each of the seven lock types, and saw them open to look at the pin arrangements. Is it really that simple with modern locks? I thought they had gotten good at foiling this kind of attack.
  - TD-Linux 11y ago
    Newer locks are designed to be hard to pick. If you have complete, destructive access to the lock, there's nothing they can do.
InclinedPlane 11y ago
Are your implying that the ssl CA system isn't a huge shit show? Because it is, and it's only incrementally more secure than the tsa keys.