3 ms·

> just based on an ID the keycard broadcasts unencrypted This isn't necessarily the end of the world. At the end of the day, all that matters is the threat mod

by lol768 5y ago

> just based on an ID the keycard broadcasts unencrypted This isn't necessarily the end of the world. At the end of the day, all that matters is the threat model.. to break an access system designed in this manner using a plain UID you're going to need what, something specialised like a Proxmark to be able to read it any real distance away (and even then, IIRC it's like a ruler's distance you'll be able to do). Otherwise, you need physical possession of my access card, no? Your average burgler is going to have no idea what any of this stuff even is. To me, the scheme being (as you describe) "horribly insecure" in this way is less of a concern than e.g. a lock that can be easily bumped.

Nextgrid 5y ago
You can tap someone's keycard or wallet with an Android phone and get the UID; here's an example app: https://play.google.com/store/apps/details?id=com.nellon.mifareid&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.nellon.mif.... That's much easier than picking even the shittiest lock where you'd need picking tools which have less plausible deniability than let's say a phone, and yet these "secure" keycard systems cost significantly more than a shitty lock.
- BenjiWiebe 5y ago
  Actually the worst locks are so easy to pick that you just insert your tension tool and turn. But those aren't usually on doors. The two like that I've seen: TSA approved luggage lock, high power handheld laser safety lockout.
  - HWR_14 5y ago
    As someone once pointed out, safety lockout locks being easy to pick is a feature. They are a very strong communication device, not a security measure.
    - BenjiWiebe 5y ago
      Oddly enough, the real (Master 410 series) lockout locks of which I have several are more difficult to pick then the non-lockout locks. They have 6 pins and multiple spools (security pins).
- lol768 5y ago
  Right, and the phone needs to be on top of the card - do you think I won't notice?

by lol768 5y ago

Nextgrid 5y ago

You can tap someone's keycard or wallet with an Android phone and get the UID; here's an example app: https://play.google.com/store/apps/details?id=com.nellon.mifareid&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.nellon.mif.... That's much easier than picking even the shittiest lock where you'd need picking tools which have less plausible deniability than let's say a phone, and yet these "secure" keycard systems cost significantly more than a shitty lock.

BenjiWiebe 5y ago
Actually the worst locks are so easy to pick that you just insert your tension tool and turn. But those aren't usually on doors. The two like that I've seen: TSA approved luggage lock, high power handheld laser safety lockout.
- HWR_14 5y ago
  As someone once pointed out, safety lockout locks being easy to pick is a feature. They are a very strong communication device, not a security measure.
  - BenjiWiebe 5y ago
    Oddly enough, the real (Master 410 series) lockout locks of which I have several are more difficult to pick then the non-lockout locks. They have 6 pins and multiple spools (security pins).
lol768 5y ago
Right, and the phone needs to be on top of the card - do you think I won't notice?