6 ms·

Seems like it's only a matter of time before someone writes a Flipper Zero script to do this.

datameta 3y ago
The more pertinent matter is that it took this long for RFID exploits to start catching the public eye. RFID is the least secure communication protocol that could be used for locks. At the very least we should have NFC be the standard. Someone with the intent and know-how to crack RFID readers could put together a hardware tool to do so. Does the Flipper Zero provide such a tool? Yeah. Does the responsibility of following ethics fall with the user? Debatable, but I think absolutely yes. If one carries around a lockpicking set and learns how to use it, they can go right ahead, correct? We accept the fact that people exist that can pick locks and yet 80% of states allow possession and use of lockpicking tools in a legal manner.
- wongarsu 3y ago
  It's not just that RFID isn't very secure, it's that a lot of locks are using the worst possible implementations. Just checking the ID of the RFID chip against a whitelist is an astonishingly common method. Not only makes that access cards easy to clone and provides no cryptographic security at all, if you bulk buy access cards you often get sequentially numbered cards ...
  - rescbr 3y ago
    OTOH I can use my credit card to open my door - and this is even advertised as a feature by the manufacturer!
    - OkGoDoIt 3y ago
      Which lock do you have? I’ve been wanting to get one with this functionality but I’ve never successfully found a smart lock that works like that.
      - rescbr 3y ago
        Mine is an Yale YMF-30
- Nextgrid 3y ago
  RFID is just a bidirectional link between the reader and the card. The security depends on what you send over that link. RFID in itself doesn't imply security or insecurity.
- vel0city 3y ago
  RFID just means radio frequency identification. It does not imply any particular standard. NFC can be a type of RFID system. Even saying NFC isn't necessarily implying any particular system of protection, basic NFC has no real protection out of the box and would require the higher-level protocols to actually provide any kind of encryption or relay protection or the like. An NFC-based system of RFID can also be incredibly insecure. Saying "RFID is insecure, use NFC" is like saying "radio is insecure, use WiFi." NFC is a subset of the concept of RFID, much the same way WiFi is a subset of digital radio protocols.
  - datameta 3y ago
    In my opinion it's clear that NFC is indeed designed with a higher focus on security than general RFID applications. In fact it emphasizes secure data exchange by design. Yes it is a subset of RFID technology operating at 13.56 MHz. Because NFC enables encrypted communication over very short distances (typically less than 4 cm), it is more challenging for unauthorized interception to happen. Also NFC supports two-way communication, which allows for more dynamic and secure interactions between devices, such as payment systems or secure access controls. RFID, while versatile and utilized across a range of applications from inventory management to access control, does not inherently prioritize security to the same extent. Its broader application spectrum means that specific security measures can vary significantly based on the use case and the design of the RFID system. For example, passive RFID tags, which are widely used due to their cost-effectiveness and simplicity, can be read from distances up to several meters, potentially exposing them to unauthorized scans. Active RFID tags offer longer read ranges and can incorporate additional security features, but their cost and complexity limit their use to specific applications. Therefore, when comparing the security aspects directly, NFC's design principles inherently prioritize secure exchanges, leveraging close proximity communication and encryption standards that are well-suited for transactions and sensitive data exchanges. This focus on security, combined with the technology's adaptability for consumer use (e.g., smartphones for payments), underscores NFC's advantage in scenarios where security is paramount. Most hotels use non-NFC RFID and on top of that most use passive tags. So it is certainly an inherent security flaw of hotel door locks. Unfortunately non-meatspace security is also drastically in need of choosing more effective already existing measures.
- lmm 3y ago
  Feels like a very US-specific mentality. Back in the UK carrying lockpicking tools outside your home without good reason is "going equipped" and a crime in itself, and that's generally supported.
  - datameta 3y ago
    I don't have a formed opinion on available lockpicking kits other than if you make them contraband they will still be available in different ways and that measure will have the opposite effect. But a lockpicking kit has one purpose, it's picking locks. A Flipper Zero type device has plenty of legitimate, legal, personal uses in an IoT equipped home. The Flipper Zero being banned will lead to a flood of copies, not to mention black market OEM versions.
    - lmm 3y ago
      > if you make them contraband they will still be available in different ways and that measure will have the opposite effect. Banning things doesn't make them impossible to get hold of but it does make it harder/more costly, which is all that any anti-crime measure can hope to achieve. Why do you say the opposite effect? This isn't like alcohol (or even, to an extent, weed) where a majority of ordinary decent people use it occasionally and want it to be available. Most people have never owned or used lockpicks and don't see any reason to have them if you're not a criminal. (And, sadly, that's probably also true of a flipper zero).
  - empathy_m 3y ago
    US lockpicking enthusiasts tend to know their states' laws (see e.g. https://www.toool.us/lockpicking-laws.php https://www.toool.us/lockpicking-laws.php) In general it's probably okay to bring your picks somewhere in most parts of the country if you're a hobbyist. In general it's a bad idea to carry picks if you're doing anything that a prosecutor could construe as breaking into a building to steal things. This is an area to be particularly aware of for urban exploration, where trespassing is bad but burglary with burglarious tools is like felony bad.
  - int_19h 3y ago

The more pertinent matter is that it took this long for RFID exploits to start catching the public eye. RFID is the least secure communication protocol that could be used for locks. At the very least we should have NFC be the standard. Someone with the intent and know-how to crack RFID readers could put together a hardware tool to do so. Does the Flipper Zero provide such a tool? Yeah. Does the responsibility of following ethics fall with the user? Debatable, but I think absolutely yes. If one carries around a lockpicking set and learns how to use it, they can go right ahead, correct? We accept the fact that people exist that can pick locks and yet 80% of states allow possession and use of lockpicking tools in a legal manner.

wongarsu 3y ago
It's not just that RFID isn't very secure, it's that a lot of locks are using the worst possible implementations. Just checking the ID of the RFID chip against a whitelist is an astonishingly common method. Not only makes that access cards easy to clone and provides no cryptographic security at all, if you bulk buy access cards you often get sequentially numbered cards ...
- rescbr 3y ago
  OTOH I can use my credit card to open my door - and this is even advertised as a feature by the manufacturer!
  - OkGoDoIt 3y ago
    Which lock do you have? I’ve been wanting to get one with this functionality but I’ve never successfully found a smart lock that works like that.
    - rescbr 3y ago
      Mine is an Yale YMF-30
Nextgrid 3y ago
RFID is just a bidirectional link between the reader and the card. The security depends on what you send over that link. RFID in itself doesn't imply security or insecurity.
vel0city 3y ago
RFID just means radio frequency identification. It does not imply any particular standard. NFC can be a type of RFID system. Even saying NFC isn't necessarily implying any particular system of protection, basic NFC has no real protection out of the box and would require the higher-level protocols to actually provide any kind of encryption or relay protection or the like. An NFC-based system of RFID can also be incredibly insecure. Saying "RFID is insecure, use NFC" is like saying "radio is insecure, use WiFi." NFC is a subset of the concept of RFID, much the same way WiFi is a subset of digital radio protocols.
- datameta 3y ago
  In my opinion it's clear that NFC is indeed designed with a higher focus on security than general RFID applications. In fact it emphasizes secure data exchange by design. Yes it is a subset of RFID technology operating at 13.56 MHz. Because NFC enables encrypted communication over very short distances (typically less than 4 cm), it is more challenging for unauthorized interception to happen. Also NFC supports two-way communication, which allows for more dynamic and secure interactions between devices, such as payment systems or secure access controls. RFID, while versatile and utilized across a range of applications from inventory management to access control, does not inherently prioritize security to the same extent. Its broader application spectrum means that specific security measures can vary significantly based on the use case and the design of the RFID system. For example, passive RFID tags, which are widely used due to their cost-effectiveness and simplicity, can be read from distances up to several meters, potentially exposing them to unauthorized scans. Active RFID tags offer longer read ranges and can incorporate additional security features, but their cost and complexity limit their use to specific applications. Therefore, when comparing the security aspects directly, NFC's design principles inherently prioritize secure exchanges, leveraging close proximity communication and encryption standards that are well-suited for transactions and sensitive data exchanges. This focus on security, combined with the technology's adaptability for consumer use (e.g., smartphones for payments), underscores NFC's advantage in scenarios where security is paramount. Most hotels use non-NFC RFID and on top of that most use passive tags. So it is certainly an inherent security flaw of hotel door locks. Unfortunately non-meatspace security is also drastically in need of choosing more effective already existing measures.
lmm 3y ago
Feels like a very US-specific mentality. Back in the UK carrying lockpicking tools outside your home without good reason is "going equipped" and a crime in itself, and that's generally supported.
- datameta 3y ago
  I don't have a formed opinion on available lockpicking kits other than if you make them contraband they will still be available in different ways and that measure will have the opposite effect. But a lockpicking kit has one purpose, it's picking locks. A Flipper Zero type device has plenty of legitimate, legal, personal uses in an IoT equipped home. The Flipper Zero being banned will lead to a flood of copies, not to mention black market OEM versions.
  - lmm 3y ago
    > if you make them contraband they will still be available in different ways and that measure will have the opposite effect. Banning things doesn't make them impossible to get hold of but it does make it harder/more costly, which is all that any anti-crime measure can hope to achieve. Why do you say the opposite effect? This isn't like alcohol (or even, to an extent, weed) where a majority of ordinary decent people use it occasionally and want it to be available. Most people have never owned or used lockpicks and don't see any reason to have them if you're not a criminal. (And, sadly, that's probably also true of a flipper zero).
- empathy_m 3y ago
  US lockpicking enthusiasts tend to know their states' laws (see e.g. https://www.toool.us/lockpicking-laws.php https://www.toool.us/lockpicking-laws.php) In general it's probably okay to bring your picks somewhere in most parts of the country if you're a hobbyist. In general it's a bad idea to carry picks if you're doing anything that a prosecutor could construe as breaking into a building to steal things. This is an area to be particularly aware of for urban exploration, where trespassing is bad but burglary with burglarious tools is like felony bad.
- int_19h 3y ago