5 ms·

A friend of mine who lives in New York actually has an apartment where all building an unit access uses an RFID enabled lock system with an app on the phone. It

A friend of mine who lives in New York actually has an apartment where all building an unit access uses an RFID enabled lock system with an app on the phone. It’s very easy for the owner to lock someone out and the system went out twice and they couldn’t get in. She doesn’t even get a physical key for a back up.

whoopdedo 6y ago
Read the lease carefully. Two years ago some tenants in NYC won a lawsuit against their landlord for not giving them keys.[1] Anyway, I assume Amazon is already considering what GP proposed. They have a program called Alexa for Residential[2] marketed to property managers who want to put IoT things in apartments. [1] https://www.cnet.com/news/tenants-win-rights-to-physical-keys-over-smart-locks-from-landlords/ https://www.cnet.com/news/tenants-win-rights-to-physical-key... [2] https://www.gizmodo.com.au/2020/09/amazons-alexa-for-landlords-is-a-privacy-nightmare-waiting-to-happen/ https://www.gizmodo.com.au/2020/09/amazons-alexa-for-landlor...
- donmcronald 6y ago
  "Alexa, evict the peasant in apartment 6B."
  - pdkl95 6y ago
    "Alexa, have you got a 27B/6?"
    - ChrisMarshallNY 6y ago
      David Thorne?
      - pdkl95 6y ago
        https://www.youtube.com/watch?v=0B61_5sRoBI https://www.youtube.com/watch?v=0B61_5sRoBI
        ChrisMarshallNY 6y ago
        Thanks! Forgotten about that (I see that Jonathan Pryce is young, so my lapse is to be forgiven). This was what I meant: http://www.27bslash6.com http://www.27bslash6.com He's well worth the read.
        KineticLensman 6y ago
        Video not available, in the UK at least. Although I think I know the scene you mean.
      - deleted 6y ago
        [deleted]
TedDoesntTalk 6y ago
Our fucking community pool has an app to unlock the gate. Why do I need to install your app to open a gate? I refused to install it and demanded a keycard. People look at me like I’m a freak when I open the door with it.
- skeletonjelly 6y ago
  You should intercept the API calls it uses!
  - fakedang 6y ago
    Honest question. How do you intercept and retrieve an API that communicates within an app?
    - nickserv 6y ago
      If it's on WiFi, any old packet sniffer on the network should do the job. If it's on cellular, you'll need to have access to police equipment.
      - ThermalCube 6y ago
        Cellular data? just connect your phone to your own VPN (like a RaspPi) and sniff there
      - tpetry 6y ago
        A packet sniffer on the network will not help with tls encrypted endpoints. The charles proxy with custom ssl certificates may help if the certificate is not pinned in the app.
        TeMPOraL 6y ago
        I'm going to bet a beer it's not encrypted at all. Too much hassle, so plenty of hardware vendors don't bother.

whoopdedo 6y ago

Read the lease carefully. Two years ago some tenants in NYC won a lawsuit against their landlord for not giving them keys.[1] Anyway, I assume Amazon is already considering what GP proposed. They have a program called Alexa for Residential[2] marketed to property managers who want to put IoT things in apartments. [1] https://www.cnet.com/news/tenants-win-rights-to-physical-keys-over-smart-locks-from-landlords/ https://www.cnet.com/news/tenants-win-rights-to-physical-key... [2] https://www.gizmodo.com.au/2020/09/amazons-alexa-for-landlords-is-a-privacy-nightmare-waiting-to-happen/ https://www.gizmodo.com.au/2020/09/amazons-alexa-for-landlor...

donmcronald 6y ago
"Alexa, evict the peasant in apartment 6B."
- pdkl95 6y ago
  "Alexa, have you got a 27B/6?"
  - ChrisMarshallNY 6y ago
    David Thorne?
    - pdkl95 6y ago
      https://www.youtube.com/watch?v=0B61_5sRoBI https://www.youtube.com/watch?v=0B61_5sRoBI
      - ChrisMarshallNY 6y ago
        Thanks! Forgotten about that (I see that Jonathan Pryce is young, so my lapse is to be forgiven). This was what I meant: http://www.27bslash6.com http://www.27bslash6.com He's well worth the read.
      - KineticLensman 6y ago
        Video not available, in the UK at least. Although I think I know the scene you mean.
    - deleted 6y ago
      [deleted]

TedDoesntTalk 6y ago

Our fucking community pool has an app to unlock the gate. Why do I need to install your app to open a gate? I refused to install it and demanded a keycard. People look at me like I’m a freak when I open the door with it.

skeletonjelly 6y ago
You should intercept the API calls it uses!
- fakedang 6y ago
  Honest question. How do you intercept and retrieve an API that communicates within an app?
  - nickserv 6y ago
    If it's on WiFi, any old packet sniffer on the network should do the job. If it's on cellular, you'll need to have access to police equipment.
    - ThermalCube 6y ago
      Cellular data? just connect your phone to your own VPN (like a RaspPi) and sniff there
    - tpetry 6y ago
      A packet sniffer on the network will not help with tls encrypted endpoints. The charles proxy with custom ssl certificates may help if the certificate is not pinned in the app.
      - TeMPOraL 6y ago
        I'm going to bet a beer it's not encrypted at all. Too much hassle, so plenty of hardware vendors don't bother.