5 ms·

While not the same authors as the guys in question, I also gave a talk on key duplication at DEF CON this year. My two main points: 1) A difference in scope me

While not the same authors as the guys in question, I also gave a talk on key duplication at DEF CON this year. My two main points: 1) A difference in scope means a difference in kind. Using a service such as KeysDuplicated (formerly Shoosl[1]) from your mobile phone enables opportunities. These opportunities break previous assumptions in the security threat model but can also lead to new business opportunities (see for instance Prim[2] - a laundry service that will come into your home if you send them a photo of your key; they will then find and do your laundry.) 2) The huge missing element here, which has been a necessity in computer security for years, is monitoring. For many, many people, replacing the lock or installing an alarm may not be an option. My company makes a device that fits over your lock and alerts you when someone uses a key (or bumps your door, or comes in without your permission, etc)[3]. It also allows you to grant virtual keys to actuate the lock - enabling use cases like Prim without having to fabricate a physical, non-revocable access token. [1] http://keysduplicated.com/ http://keysduplicated.com/ [2] https://getprim.com/ https://getprim.com/ [3] https://lockitron.com/ https://lockitron.com/

emhart 13y ago
I didn't realize you were speaking. Sadly I missed Vegas this year, first time I've ever had to cancel a talk. Sorry I missed you. I am of course aware of Lockitron & the competitors in the market, but really appreciate your integration with pre-existing hardware and the point about users who cannot change their hardware out is a great one. Re: threat model vs. business opportunities, I've been following shoosl and the like closely and despite my background, I absolutely love the idea. Again, you have to choose who you trust with your key, and if a service can engender sufficient trust, you can reap the benefits of those services. Glad you chimed in on this, sorry I missed your talk in Vegas.
- paulgerhardt 13y ago
  Sorry I missed you too, I am a huge fan of your work! I was in the Wireless Village (their speaker schedule was submitted a bit too late to make the program.) The second half of my talk was on the radio/encryption side of things along with various attacks when handling electronic keys. DaKahuna (the facilitator) should be posting slides soon.
  - emhart 13y ago
    Excellent. I look forward to checking that out.

emhart 13y ago

I didn't realize you were speaking. Sadly I missed Vegas this year, first time I've ever had to cancel a talk. Sorry I missed you. I am of course aware of Lockitron & the competitors in the market, but really appreciate your integration with pre-existing hardware and the point about users who cannot change their hardware out is a great one. Re: threat model vs. business opportunities, I've been following shoosl and the like closely and despite my background, I absolutely love the idea. Again, you have to choose who you trust with your key, and if a service can engender sufficient trust, you can reap the benefits of those services. Glad you chimed in on this, sorry I missed your talk in Vegas.

paulgerhardt 13y ago
Sorry I missed you too, I am a huge fan of your work! I was in the Wireless Village (their speaker schedule was submitted a bit too late to make the program.) The second half of my talk was on the radio/encryption side of things along with various attacks when handling electronic keys. DaKahuna (the facilitator) should be posting slides soon.
- emhart 13y ago
  Excellent. I look forward to checking that out.