Hacker News Reader

Comment by dsjoerg | Hacker News Reader

I don't think OP actually read the NYPost article he's complaining about. http://nypost.com/2015/09/20/the-8-key-that-can-open-new-yor...

The keys are being sold so cheaply that it is easier to just buy them online than to turn the published key image into your own copy: "UltimateSecurityDevices offers 1620 keys at $7.40 each for up to nine, and $6.66 each for 10 or more. Any order over $249 comes with a 10 percent discount."

EDIT: My point is that the cat is way, way, way out of the bag. Publishing the key image reduces the security of this key from 0.2% to 0.1%. It's already utterly destroyed.

View on HN

There are keys which are simply used for tamper reduction. If you buy an RV in the United States, it will have lots of external compartments storage. These will likely all have the same key, as every other RV on the lot. Furthermore you can use your key to open all kinds of things! It's like a treasure hunt. Mysterious stainless steel panel on public restroom wall? Yep. Sprinkler controller? Yep.

And you can order them on Amazon for a wide variety of prices, depending on what function the are sold for. Sprinkler keys are cheapest. Security system keys are much more expensive. RV keys, in between. But all the same key.

I ordered some Torx TR bits to upgrade my Mac Mini, and now I've been noticing those screws everywhere too. I'm tempted to just start carrying a screwdriver around...

I had that experience a few years back, when I picked up a set of Torx TR bits for a college project. Almost temped to carry it around and randomly unscrew things just to say "Tamper-resistant? Ha!"

Great point- it seems like the NY Post is following standard whitehat full disclosure procedures. My takeaway is that for any security vulnerability, as long as you append "because terrorism / for the children", you're in the clear.

Another point missed is that the lock mechanism on something like an elevator fire-service switch is not exactly robust, and a person determined to access it could probably do so quite easily with standard locksmith tools or even a screwdriver or pry tool.

The keys make casual mischief easier, but would not stop anyone more serious.

I don't know about subways, but elevators should never be a part of a building's security because they're so easy to hack[1].

[1]: https://www.youtube.com/watch?v=ZUvGfuLlZus

The keys make tampering much less noticeable. If you take a crowbar to a panel, someone will eventually see it and investigate. With a key you lock up after yourself and no one will know.

Actually looking at that key any cheap pick set or a couple of bobby pins and in a matter of seconds I could open and reclose the lock (without having ever seen the key). Surely any self respecting terrorist could figure that out too. If a cheap little lock is all that protects us from terrorism the danger level hasn't changed too much.

A paper clip and a binder clip are usually sufficient to open any keyed furniture lock in the office where you found the clips. It actually takes longer to bend the paper clip into the proper pick shape than it does to open the lock. You can also pick them back into the locked position afterward.

That's a case where having an actual key is less useful than knowledge of how the locks work, because the key won't actually open every lock in the office, whereas the clips will.

This is why you make a distinction between privacy locks and security locks.

Most of the locks in daily use by humans on this planet are barely better than privacy locks. I once unlocked the car, got in, and started it up before the country music station on the radio made me realize that my car was actually parked in the next space over in the parking lot. It was a different brand of GM car that coincidentally had exactly the same body style, paint color, and locks as mine.

After that, I thought about trying my key in every car in the parking lot, but I never quite overcame my fear of getting arrested for it.

Reply on news.ycombinator.com