8 ms·
Is anyone else feeling feeling tired of these security posts that have scary titles but literally no real world impact? Ok, maybe you can copy a key from sound
by Polylactic_acid 6y ago
Is anyone else feeling feeling tired of these security posts that have scary titles but literally no real world impact?
Ok, maybe you can copy a key from sound but getting a clean recording and then going home and producing a new key and getting it correct is 100000x harder than just sticking 2 metal sticks in the lock and opening it in 15 seconds.
To us these posts might provide some light entertainment but then they get shared around by people who people who don't know better and next thing you know people are installing sound proof booths on the front of doors or telling us locks are insecure because they just found out about this trick.
- efficax 6y agoIt seems like the risk on this one is pretty high, assuming the SpiKey software is available. Say you have a job where you need to be let in and out of a locked area by someone who is trusted with a key. The only thing you need now is a smartphone and to be standing not too far from the person putting the key in the lock and you have access!
- ggggtez 6y agoOr you could just bring some lock picks, and then you don't even need someone with the original key.
- Polylactic_acid 6y agoIf the area is so high secure that this is a real threat then you should be using nfc tokens and a fingerprint/code scanner. The chance that someone will steal your token and clone your fingerprint before you notice and deactivate the token is nonexistant. And if all that is still not enough security then you need to combine that with a security guard at the door. Key and lock security is for low security situations where it just has to be more secure than the window.
- efficax 6y agoAlso, lock picking often damages the lock and is a lot slower than people are giving credit here. This gets you in and out in short order
- JackeJR 6y agoIn which case you need to check out the lockpickinglawyer. Sure, not everyone has that level of skill but it is conceivable to self learn and be competent to a point where lock picking is practical.
- Polylactic_acid 6y agoThat guy picks locks faster than I can find the correct key on a ring.
- Xylakant 6y agoHowever, picking a lock still requires a short period of being unobserved. This may not be the case in for example an office building. Taking out a key and unlocking the door is an absolutely normal act and few people would notice. It even adds an air of legitimacy - that person has a key, they’re likely allowed in there.
- rhacker 6y agoEven the blog article at the bottom made the more insightful point that just a picture of a key is enough to make a duplicate. It seems a much easier thing to do considering you just need a microcamera pointing sideways at the lock entry.
- pishpash 6y ago"If a key is inserted at a nonconstant speed, the analysis can be ruined, but the software can compensate for small speed variations." (That and noise.) Can we say academic project?
- hughw 6y agoThis paper demonstrates the principle. You start with the easier cases, then introduce the complexities. You don't have to wait until you've licked every problem to publish. And when you eventually do solve the problem in the presence of noise and varying insertion speed, you may not publish.
- brudgers 6y agoIf you have a smartphone, you can just take a picture of the key.
- hughw 6y agoI feel sure this technology will have a real world impact. Maybe not on your front door, but many valuable secrets and resources lie behind physical locks. As with 0-days, the owners of the technology (say a three-letter agency) may not want to use it so widely they raise awareness. With more research the designers can certainly overcome the problems other commenters have posted here regarding noise, or more challenging lock design. Lock makers could build effective countermeasures. But there are so many locks that never will be upgraded.
- nautilus12 6y ago"Security researches have found they can guess your password from analyzing how frequently you blink."
- ashtonkem 6y agoMost American locks just aren’t that secure; even I can pick a Masterlock #3 in a few minutes, and I’m a total novice at lock picking. A little bit of practice and there’s a good chance you could pick most front doors in a few minutes. The simple reality is that if you’re going to get robbed, chances are the robber is going to use a pry bar to ruin the door jam or break your window. Locks are about keeping honest citizens honest.
- jjeaff 6y ago>locks are about keeping honest citizens honest I've heard that, and I get it, but I don't think that's actually it. Locks are about making it too inconvenient or risky to be worth stealing or breaking into. I guess some people might just all the sudden steal something if given the chance but would never do so otherwise, but usually, it's people who are already willing to steal if the difficulty and stakes are low enough.
- dec0dedab0de 6y agoI think the saying "locks keep honest people out" means that locks are there to keep out the overzealous girlscout selling cookies, that annoying friend who comes over when you dont text him back, and your neighbor that heard a noise and wants to make sure everything is ok.
- Polylactic_acid 6y agoIt also deters some dishonest people. A while ago my suburb was hit by a drug addict who moved in and would steal change/ipods from unlocked cars and tools from unlocked sheds. He never touched anything that was locked because the extra risk and effort wasn't worth it.
- kens 6y agoI agree that "locks keep honest people honest" is a nice but bogus sentiment. Bike locks are a clear counterexample. While a cheap cable lock will keep honest people honest, your bike will soon get stolen. A Kryptonite-style lock is kind of the minimum. But even those need constant upgrades as bad guys figure out how to pick them or freeze them with canned air. Thus, the goal of a lock is to make it not worth the effort for a thief, not to keep honest people honest.
- deleted 6y ago[deleted]
- smnrchrds 6y ago> * Is anyone else feeling feeling tired of these security posts that have scary titles but literally no real world impact?* Researchers, regardless of the discipline, often work at the edge of what's possible, not what's practical. Decade after decade, we have consumed news about researchers finding ways to cure cancer, immunize against HIV, break encryption with quantum computing, etc. It will be a couple more decades before any of these endeavours come to fruition. Just remember how long researchers have been working on quantum computers and how much longer they need to work to create something even remotely useful. Science news hints how the world might look like half a century or a century in the future, not next year. For that, you need to read corporate announcements.
- Polylactic_acid 6y agoThats fair. I just get the vibe that these articles are less about sharing research and more about drumming up fear to get more eyes on their post/organisation.
- abhayhegde 6y agoA thoughtful comment. Much of the research carried now is a part of immediate future, only in research field. For example, suppose we develop a way to encode information as states of electron spin. This opens a huge avenues for quantum computing, although only at the level of labs. To bring out a user product onto a market, that is a whole different story and complicated deal of various factors and fields, independent of research. It makes sense it takes decades or even half a century to roll out considerable paradigm shifts.
- brudgers 6y agoIt's not just that picking a lock is going to be simpler. It's that to use the audio exploit a person needs to know enough about locks to select the correct blank. And setting up a camera to take a picture of the key is likely to be at least as easy as setting up audio recording equipment.
- Lammy 6y agoNo, but I am tired of every security/surveillance post I see on HN having a glut on comments downplaying the severity or real-world applicability.
- lawl 6y ago> going home and producing a new key and getting it correct is 100000x harder Once you get the bitting and know what key it is, this is really not hard at all, provided you have the right tools. There's handheld tools for this [0] stuff, so you can do this pretty quickly in a parking lot, in theory. Yes, these tools are relatively expensive and you probably don't need to worry about your bike getting stolen that way. Probably also not about someone breaking into your home like this, they'll just smash a window or something. But if the attack described here gets to the point where you have an app that outputs the bitting code then I believe this is a legitimate attack that should worry (some) companies. This could let you go from access to a building with a 'visitor' badge to getting easy permanent access. [0] https://www.lockpicks.com/pak-a-punch-for-schlage.html https://www.lockpicks.com/pak-a-punch-for-schlage.html
- Tuna-Fish 6y agoIf you care about security, for starters you don't use pin-tumbler locks. They are pretty much useless as far as stopping a determined attacker is concerned.
- imtringued 6y agoYeah, basically all pin based locks suffer from the same problem. Once you tension the cylinder the pins don't reset anymore so just poking all pins to the correct height will open the lock. Of course there are locks with varying difficulty but the most effective locks mostly involve making it hard to put conventional lock picking tools into them.