6 ms·
Human behavior toward keys makes mechanical locks insecure. We've been able to reproduce keys, even fairly complex ones, well before 3D printers came along. Get
by emhart 13y ago
Human behavior toward keys makes mechanical locks insecure. We've been able to reproduce keys, even fairly complex ones, well before 3D printers came along. Get a clean enough impression/scan/photograph and we can make it happen, perhaps 3D printing is seen as making it more accessible to the general population.
I'm about to go on a whole thing here, so let me first say that I am excited about their work and I have personally been pushing for years to see more high security key printing happening (see Nirav Patel's Abus Plus key printing[0])
What I take umbrage with is the idea that this development is going to be the death of mechanical locks. Even the suggestion that it _should_ be the death of mechanical locks. In the Forbes article [1] One of the students behind this work suggested that his goal was the elimination of mechanical locks:
"If we show that mechanical locks are vulnerable to key duplication just by having a handful of numbers you can download off the internet, hopefully they'll be phased out more quickly," says Van Albert.
What this fails to address is that the cuts on your key are supposed to be a secret, and your behavior toward your keys should be the same as your behavior toward a password. You don't pass it around and you are very careful about who you trust it with.
I also dislike the characterization of the discovery of the "numbers" in the main and sidebar bittings. That information has been publicly available and the suggestion that they "reverse-engineered" (from their abstract submitted to defcon)[2] the lock is a bit dramatic. Better, I think, to say that they "read the documentation."
Obviously I have a chip on my shoulder when it comes to mechanical security, but I am confident saying that any call for the blanket abolition of mechanical locks is short-sighted and narrow-minded. This could have been an amazing opportunity to address human behavior as it relates to mechanical security, but instead it was wasted on the age-old call for the death of locks. There remain myriad places where a traditional lock is still required, there are myriad populations who are not able to sustain electronic locks.
If the day does come when mechanical locks can be left to the dust of history, it will be more likely the result of dramatic shifts in society than in technology. It will be the death of all locks, not just mechanical ones.
[0] https://github.com/nrpatel/PhysicalKeygen/blob/master/abus_plus.scad https://github.com/nrpatel/PhysicalKeygen/blob/master/abus_p...
[1] http://www.forbes.com/sites/andygreenberg/2013/08/03/mit-students-release-program-to-3d-print-high-security-keys/ http://www.forbes.com/sites/andygreenberg/2013/08/03/mit-stu...
[2] https://www.defcon.org/html/defcon-21/dc-21-speakers.html#Lawrence https://www.defcon.org/html/defcon-21/dc-21-speakers.html#La...
- rcthompson 13y ago> the cuts on your key are supposed to be a secret I don't think the average mechanical key user is aware of this fact. I wonder if someone makes keys that hide their cuts during normal use. For example, a cylindrical key with the cuts on the inside of the cylinder.
- emhart 13y agoYou are right, and that's why I think it's a shame that the opportunity wasn't taken to alert people to that idea. I spend a little time collecting high res photographs people post online of their keys (happens all the time) and do enough digging to associate those keys with an address. I'm a good guy, though and just try to raise awareness. And yes, they do. There have been a handful of concepts to do exactly that. Check out the Van Lock[0] for one, which is almost exactly what you are describing. [0]http://www.safersystems.co.uk/Images/Vanlock.gif http://www.safersystems.co.uk/Images/Vanlock.gif
- HarryHirsch 13y agoI don't think the average mechanical key user is aware of this fact. What?? This ties in with the recent reports on insecure electronic keyfobs for cars. In Germany it used to be that your key number used to be printed on your car title, and your friendly car dealer would gladly cut you a replacement key if you had lost yours, but he wouldn't do it unless you procured ID and the title.
- rcthompson 13y agoThe average mechanical key user (i.e. the average non-homeless person) certainly knows that someone can duplicate a key given access to the key. But the average key user doesn't know that a mere picture, much less a picture from hundreds of feet away, is sufficient. When was the last time you saw someone hide a key from view while using it? I've never seen anyone do this. I've never done it myself.
- chii 13y agoand they would be right - the threat model of the average home isnt one under which having a picture of their keys taken is realistically possible. if a burgler (the most common threat) wants to get in, they don't need a key. However, when the threat model is one where a more funded organization is attempting to break in, then you need a better system.