5 ms·

In one single image, mainstream media show their utter ignorance of security

72 points by jarcane 11y ago

hellofunk 11y ago
Maybe the media was forcing things to change by exposing the key, deliberately, rather than being ignorant of what their exposure was doing.
- degenerate 11y ago
  This is more along what I think they were doing with this article/picture.
justinclift 11y ago
Related useful info - "Replication Prohibited", a talk at the recent 32C3 about 3D printing keys: https://media.ccc.de/v/32c3-7435-replication_prohibited https://media.ccc.de/v/32c3-7435-replication_prohibited
kelseydh 11y ago
Personally I get more annoyed when reporters cover stories about "cyber attacks" but don't actually go into the details of what's going on -- because a DDoS is a completely different story from a SQL Injection.
- newsignup 11y ago
  Maybe they publish the report as early as possible and the "fix" is not in place yet?
dsjoerg 11y ago
I don't think OP actually read the NYPost article he's complaining about. http://nypost.com/2015/09/20/the-8-key-that-can-open-new-york-city-to-terrorists/ http://nypost.com/2015/09/20/the-8-key-that-can-open-new-yor... The keys are being sold so cheaply that it is easier to just buy them online than to turn the published key image into your own copy: "UltimateSecurityDevices offers 1620 keys at $7.40 each for up to nine, and $6.66 each for 10 or more. Any order over $249 comes with a 10 percent discount." EDIT: My point is that the cat is way, way, way out of the bag. Publishing the key image reduces the security of this key from 0.2% to 0.1%. It's already utterly destroyed.
- erikw 11y ago
  Great point- it seems like the NY Post is following standard whitehat full disclosure procedures. My takeaway is that for any security vulnerability, as long as you append "because terrorism / for the children", you're in the clear.
- ams6110 11y ago
  Another point missed is that the lock mechanism on something like an elevator fire-service switch is not exactly robust, and a person determined to access it could probably do so quite easily with standard locksmith tools or even a screwdriver or pry tool. The keys make casual mischief easier, but would not stop anyone more serious.
  - eatkinson 11y ago
    I don't know about subways, but elevators should never be a part of a building's security because they're so easy to hack[1]. [1]: https://www.youtube.com/watch?v=ZUvGfuLlZus https://www.youtube.com/watch?v=ZUvGfuLlZus
  - pilsetnieks 11y ago
    The keys make tampering much less noticeable. If you take a crowbar to a panel, someone will eventually see it and investigate. With a key you lock up after yourself and no one will know.
    - dsmithatx 11y ago
      Actually looking at that key any cheap pick set or a couple of bobby pins and in a matter of seconds I could open and reclose the lock (without having ever seen the key). Surely any self respecting terrorist could figure that out too. If a cheap little lock is all that protects us from terrorism the danger level hasn't changed too much.
      - logfromblammo 11y ago
        A paper clip and a binder clip are usually sufficient to open any keyed furniture lock in the office where you found the clips. It actually takes longer to bend the paper clip into the proper pick shape than it does to open the lock. You can also pick them back into the locked position afterward. That's a case where having an actual key is less useful than knowledge of how the locks work, because the key won't actually open every lock in the office, whereas the clips will. This is why you make a distinction between privacy locks and security locks. Most of the locks in daily use by humans on this planet are barely better than privacy locks. I once unlocked the car, got in, and started it up before the country music station on the radio made me realize that my car was actually parked in the next space over in the parking lot. It was a different brand of GM car that coincidentally had exactly the same body style, paint color, and locks as mine. After that, I thought about trying my key in every car in the parking lot, but I never quite overcame my fear of getting arrested for it.
TazeTSchnitzel 11y ago
Promotional coverage of something much better covered here previously.
callumlocke 11y ago
This article could have been a tweet
jonstokes 11y ago
This article is not good. I, for one, applaud the NY Post for publishing the key. Back when we were all flipping out over electronic voting, I published a "how-to" on Ars for compromising various popular voting machines, complete with some codes and other instructions. It was so easy anyone could do it, and the piece was printed out and waved angrily at various hearings on CSPAN, and the end result was... Well, actually, the end result was that some counties went back to mechanical, and some didn't, and today it's all still a mess and it's impossible to have any confidence that your vote was correctly recorded. And now, in the digital age, voting is probably just this cargo cult ritual that we all do to summon this "democracy" thing that our ancestors once encountered. Anyway, my point is, just publish the key. That makes it harder for the people who are embarrassed by this and want to bury it to do so.
- maxerickson 11y ago
  And now, in the digital age, voting is probably just this cargo cult ritual that we all do to summon this "democracy" thing that our ancestors once encountered. If the current situation is a farce, what description does more than half of the population being disenfranchised deserve? States with paper ballots and electronic tabulators shouldn't have too much problems with election integrity, the electronic results may be tampered with, but the paper trail is much harder to mess with.
  - mikeash 11y ago
    I think there's an important difference between outright prohibiting someone from voting, and allowing them to vote but not counting it. If you prohibit someone from voting, at least they know it happened. Paper trails are great, but are they checked frequently?
    - maxerickson 11y ago
      Yeah, the stated election process and actual election outcome have to both be considered, but my point was more that there aren't any good ol' days to harken back to when it comes to evaluating how egalitarian US elections are in practice. Personally, I'm more concerned that parties have easier access to the ballot and that people are prevented from voting than I am with records tampering.
danso 11y ago
So, the idea that "obscurity is not security" is not exclusive to security professionals. It is the justification that investigative journalists use on a daily basis in pursuing and publishing their stories. Next time you read an exposé of a government function, consider that the government at some point pressured the journalist to back off for "the sake of national security|the children"...assuming that the journalist isn't a total sociopath, we can give some benefit of the doubt and assume the reporter believes it's more important to expose government incompetence completely so that there's no turning back. That is almost certainly what the NYPost thought here...images draw attention. They also cost money to print, especially in full color on the inside pages. This wasn't an accident and the author of the critique shows his utter ignorance of civic institutions and bureaucracy.
mikeash 11y ago
It's not the newspaper's responsibility to keep secrets. That's actually pretty much the opposite of their responsibility. If the key was intended to be secret, then the organizations that use it should have done a better job keeping it that way. Somewhat related, it wasn't that long ago that the TSA published their own master keys: https://www.schneier.com/blog/archives/2015/09/tsa_master_keys.html https://www.schneier.com/blog/archives/2015/09/tsa_master_ke... And here's a case where a prison put a picture of their master key on the cover of a booklet given to every prisoner: http://www.news.com.au/national/killer-escaped-prison-after-being-issued-picture-of-master-key-to-all-locks/story-fncynjr2-1226629878591 http://www.news.com.au/national/killer-escaped-prison-after-... Mainstream media isn't showing their utter ignorance of security so much as showing everybody else's.
- SixSigma 11y ago
  I did some video work in a couple of prisons. We had to sit with the prison security team afterwards and watch all the tapes looking for images of keys - they had already been burned to the £m before.

72 points by jarcane 11y ago

Maybe the media was forcing things to change by exposing the key, deliberately, rather than being ignorant of what their exposure was doing.

degenerate 11y ago
This is more along what I think they were doing with this article/picture.

justinclift 11y ago

Related useful info - "Replication Prohibited", a talk at the recent 32C3 about 3D printing keys: https://media.ccc.de/v/32c3-7435-replication_prohibited https://media.ccc.de/v/32c3-7435-replication_prohibited

kelseydh 11y ago

Personally I get more annoyed when reporters cover stories about "cyber attacks" but don't actually go into the details of what's going on -- because a DDoS is a completely different story from a SQL Injection.

newsignup 11y ago
Maybe they publish the report as early as possible and the "fix" is not in place yet?

dsjoerg 11y ago

I don't think OP actually read the NYPost article he's complaining about. http://nypost.com/2015/09/20/the-8-key-that-can-open-new-york-city-to-terrorists/ http://nypost.com/2015/09/20/the-8-key-that-can-open-new-yor... The keys are being sold so cheaply that it is easier to just buy them online than to turn the published key image into your own copy: "UltimateSecurityDevices offers 1620 keys at $7.40 each for up to nine, and $6.66 each for 10 or more. Any order over $249 comes with a 10 percent discount." EDIT: My point is that the cat is way, way, way out of the bag. Publishing the key image reduces the security of this key from 0.2% to 0.1%. It's already utterly destroyed.

erikw 11y ago
Great point- it seems like the NY Post is following standard whitehat full disclosure procedures. My takeaway is that for any security vulnerability, as long as you append "because terrorism / for the children", you're in the clear.
ams6110 11y ago
Another point missed is that the lock mechanism on something like an elevator fire-service switch is not exactly robust, and a person determined to access it could probably do so quite easily with standard locksmith tools or even a screwdriver or pry tool. The keys make casual mischief easier, but would not stop anyone more serious.
- eatkinson 11y ago
  I don't know about subways, but elevators should never be a part of a building's security because they're so easy to hack[1]. [1]: https://www.youtube.com/watch?v=ZUvGfuLlZus https://www.youtube.com/watch?v=ZUvGfuLlZus
- pilsetnieks 11y ago
  The keys make tampering much less noticeable. If you take a crowbar to a panel, someone will eventually see it and investigate. With a key you lock up after yourself and no one will know.
  - dsmithatx 11y ago
    Actually looking at that key any cheap pick set or a couple of bobby pins and in a matter of seconds I could open and reclose the lock (without having ever seen the key). Surely any self respecting terrorist could figure that out too. If a cheap little lock is all that protects us from terrorism the danger level hasn't changed too much.
    - logfromblammo 11y ago
      A paper clip and a binder clip are usually sufficient to open any keyed furniture lock in the office where you found the clips. It actually takes longer to bend the paper clip into the proper pick shape than it does to open the lock. You can also pick them back into the locked position afterward. That's a case where having an actual key is less useful than knowledge of how the locks work, because the key won't actually open every lock in the office, whereas the clips will. This is why you make a distinction between privacy locks and security locks. Most of the locks in daily use by humans on this planet are barely better than privacy locks. I once unlocked the car, got in, and started it up before the country music station on the radio made me realize that my car was actually parked in the next space over in the parking lot. It was a different brand of GM car that coincidentally had exactly the same body style, paint color, and locks as mine. After that, I thought about trying my key in every car in the parking lot, but I never quite overcame my fear of getting arrested for it.

TazeTSchnitzel 11y ago

Promotional coverage of something much better covered here previously.

callumlocke 11y ago

This article could have been a tweet

jonstokes 11y ago

This article is not good. I, for one, applaud the NY Post for publishing the key. Back when we were all flipping out over electronic voting, I published a "how-to" on Ars for compromising various popular voting machines, complete with some codes and other instructions. It was so easy anyone could do it, and the piece was printed out and waved angrily at various hearings on CSPAN, and the end result was... Well, actually, the end result was that some counties went back to mechanical, and some didn't, and today it's all still a mess and it's impossible to have any confidence that your vote was correctly recorded. And now, in the digital age, voting is probably just this cargo cult ritual that we all do to summon this "democracy" thing that our ancestors once encountered. Anyway, my point is, just publish the key. That makes it harder for the people who are embarrassed by this and want to bury it to do so.

maxerickson 11y ago
And now, in the digital age, voting is probably just this cargo cult ritual that we all do to summon this "democracy" thing that our ancestors once encountered. If the current situation is a farce, what description does more than half of the population being disenfranchised deserve? States with paper ballots and electronic tabulators shouldn't have too much problems with election integrity, the electronic results may be tampered with, but the paper trail is much harder to mess with.
- mikeash 11y ago
  I think there's an important difference between outright prohibiting someone from voting, and allowing them to vote but not counting it. If you prohibit someone from voting, at least they know it happened. Paper trails are great, but are they checked frequently?
  - maxerickson 11y ago
    Yeah, the stated election process and actual election outcome have to both be considered, but my point was more that there aren't any good ol' days to harken back to when it comes to evaluating how egalitarian US elections are in practice. Personally, I'm more concerned that parties have easier access to the ballot and that people are prevented from voting than I am with records tampering.

danso 11y ago

So, the idea that "obscurity is not security" is not exclusive to security professionals. It is the justification that investigative journalists use on a daily basis in pursuing and publishing their stories. Next time you read an exposé of a government function, consider that the government at some point pressured the journalist to back off for "the sake of national security|the children"...assuming that the journalist isn't a total sociopath, we can give some benefit of the doubt and assume the reporter believes it's more important to expose government incompetence completely so that there's no turning back. That is almost certainly what the NYPost thought here...images draw attention. They also cost money to print, especially in full color on the inside pages. This wasn't an accident and the author of the critique shows his utter ignorance of civic institutions and bureaucracy.

mikeash 11y ago

It's not the newspaper's responsibility to keep secrets. That's actually pretty much the opposite of their responsibility. If the key was intended to be secret, then the organizations that use it should have done a better job keeping it that way. Somewhat related, it wasn't that long ago that the TSA published their own master keys: https://www.schneier.com/blog/archives/2015/09/tsa_master_keys.html https://www.schneier.com/blog/archives/2015/09/tsa_master_ke... And here's a case where a prison put a picture of their master key on the cover of a booklet given to every prisoner: http://www.news.com.au/national/killer-escaped-prison-after-being-issued-picture-of-master-key-to-all-locks/story-fncynjr2-1226629878591 http://www.news.com.au/national/killer-escaped-prison-after-... Mainstream media isn't showing their utter ignorance of security so much as showing everybody else's.

SixSigma 11y ago
I did some video work in a couple of prisons. We had to sit with the prison security team afterwards and watch all the tapes looking for images of keys - they had already been burned to the £m before.