Hacker News Reader

Comment by alister | Hacker News Reader

One result of doors being controlled by facial recognition -- or any other kind of biometric system -- is that you have to get permission from someone whenever you have a regular visitor. You can no longer give your girlfriend, boyfriend, dog sitter, relatives, or whoever you wish a key or access card to your home. You have to enroll that person in the facial database. And whoever is doing the enrolling can ask for lots of further information about your visitor, or take that opportunity of enrolling to impose restrictions on your visitor, or just say no -- you're not allowed that visitor. Wonderful surveillance and control society we're building one piece at a time.

View on HN

This is already accomplished by having difficult-to-duplicate keys or fobs for the building entrance, which is a pretty standard feature of apartment living. And yes, some management companies are very stingy with extra fobs, as a control against having extra people in the unit who are not on the lease, or Airbnb, or whatever. You can tell you are in a building with a lot of illegal extra tenants when the keyfob-controlled gates are always propped open, or there are always people waiting to tailgate through them.

If nothing else: there's a market for fighting back against this. KeyMe kiosks (usually found at US supermarkets, pharmacies, etc.) have had RFID fob/card cloning capabilities for a while now. You scan the fob/card at the kiosk, then they clone it to a sticker and send it to you via mail.

Interesting. I wonder if they have actually productized the security research on HID iClass, etc. or if they are only supporting simpler credentials with no cryptography.

> clone it to a sticker and send it to you via mail.

So they have a database full of addresses together with their digital keys?

What could possibly go wrong...

To be honest, not a lot, they only let you past the building door. So as a thief, I can: A. Scrub through a hypothetical leak of all that data, or B. Tailgate someone (even in security-conscious buildings this isn't much harder than following someone while carrying a box in both hands)

Locks are for honest people.

So it can be used to steal or deliver packages.

Until you live in an apartment complex that has eliminated keys. My place is all keyfobs (except for the mailbox).

Letting people get into the locker room or bike room can create issues.

You can get a great lock, but what they lock into is usually a very weak link.

Does this also work for company badges?

In theory, it could. Depends on whether the particular RFID standard used is supported by KeyMe or not. At a glance, they didn't seem to have much info available on what is/isn't supported.

I wonder what they do with the data after they’ve mailed you the sticker.

Most RFID keyfobs simply contain a serial number (possibly encrypted or signed) and nothing more. There's not a lot of use in stealing a random number. They'd have to be in cahoots with the people running the lock software to gain anything by it.

In every apartment I've lived in with such difficult-to-duplicate keys (such as magnetic locks and what not), I've been ask whether I want a second set; and/or the owner told me to ask them should that ever be the case.

Not quite sure what's different with that situation from before, other than slightly cheaper keys.

In my experience, in San Francisco, the owner will only give you a key for every name on the lease.

Nevertheless, you can at least hand a person (e.g. your visiting parents) your key so they can open the door without you.

Some buildings (or just the owners?) keep the copy for cleaners in a realtors lock box. Doesn’t stop a sophisticated attacker, but probably does the job when you want to fire the cleaner.

In Switzerland I've always changed the locks to my apartment and its garage.

1) The landlord is _never_ allowed to enter your house 2) In an emergency, the firemen would just break the door.

GP was talking about the entrance to the building, not the apartment. Having your own keys to the apartment doesn't help much if you only have one key to get into the building.

Yep, sorry for the lack of clarity. I assumed we were talking about building entrances, I've never had magnetic locks on an apartment itself.

In parts of the US I have lived in at least, not letting the landlord in under certain conditions allows the landlord to evict you or go after you for damages. There is no way to never let them in

I've yet to meet an apartment key fob I haven't been able to clone with a 'universal' RFID cloner gadget I bought in Shenzhen for $150 a few years back and some blank cards of various frequencies. You can also link it to a Aliyun/Tencent Cloud account for compute power to crack some older/low-end encrypted tags. I even managed to successfully clone a HID badge from work that was supposedly clone-proof...

Most landlords, in my experience, don't invest in the high-end RFID systems that have real security.

Do Americans not get extra keys for their rental apartments?

Granted, I've only rented out an apartment once, but it was from a big local rental agency and I got three keys despite being the only tenant in a single bedroom apartment. My current studio apartment (although not a rental) also has three keys.

As a single tenant, I've always gotten 2 keys for my apartment door, and only one fob for the main entrance.

That also sounds weird since here it's pretty much universal that your apartment key also works for the main entrance.

RFID access fobs instead of keys are becoming increasingly common for main entrances because it allows property management to revoke access for one person without making everyone else in the building also change keys.

> Do Americans not get extra keys for their rental apartments?

Mine didn't though I'm sure I could have gotten extra ones if I just asked.

I've been tempted on many, many occasions to give the neighbors a dollar to get a duplicate key made so they aren't knocking on the door/window at all hours because they obviously don't have enough keys for the amount of people living there.

In San Francisco the rent ordinance allows tenants to petition the rent board to lower their rent due to a substantial decrease in services if a landlord denies a request for a spare key.

This seems like a reasonable policy that other cities with renters might benefit from, if they don't already have something similar.

Presumably the landlords then don't deny the request... They just make the process horrendously long and complex...

"Please fax this handwritten form to this foreign phone number and then you can collect the key from this office on the other side of town only at 3pm on a tuesday. Oh - now you've shown up we need ID, and we only accept birth certificates."

An SF landlord has 14 days to provide a key after being asked in writing. It's acceptable to deny the request for unlawful occupancy, but not for giving a family member, houseguest, or service worker access to your home.

For reference: https://sfrb.org/section-3713-keys

If they claim unlawful occupancy, you can invoke the Kim 2.0 amendments of the rent ordinance which basically prevent an SF landlord from denying you the roommates of your choice.

If a landlord denies a roommate under the Kim 2.0 amendments, you can almost certainly get your rent cut in half by petitioning the rent board.

Face recognition will not allow anyone other than the tenant EVEN if they carry the very original key. Forget about duplicate keys, which may be it's own problem, but nothing compared to this.

You can't have unattended visitors. If you're there to let them in, they can visit as often as you like.

Basically, turning this from an apartment to more of a long term hotel. Is it a fair trade for a rent subsidy? Will it become standard in all rentals?

What a world where you don't have family members come in to water your plants or feed the fish...

This would seem to violate a tenant's rights to Quiet Use and Enjoyment, as is recognized by real estate law:

https://www.landlordology.com/implied-covenant-quiet-enjoyme...

How so? I read your link and can't help to see it is about tenants rights, not visitors of tenants.

It seems this would only stop non-tenets from having access to the facilities. At least without being accompanied by actual tenants.

Did you read the part about Privacy and Right of Use?

Facial recognition would violate that.

Not sure if legally it would be considered to violate privacy.

My guess would be the mentioned privacy is relating to the dwelling itself, that is, the landlord can’t come hang out in your living room or hide cameras in your apartment.

Plenty of apartments have 24/7 concierge at the front door and monitored entrances. That isn’t considered violating privacy even though the concierge can see you come in and out.

Would a computerized system that does the same thing necessarily violate the legal definition of privacy ? I suspect it would be hard to tell at this point.

I think once you start documenting and recording exactly who is coming and going and exactly what apartment they're going to you are violating privacy.

No doubt cases like this will be tried as people test the bounds of that legal definition.

I don't think so. I know many gates cominities that have a guard that verifies identity for those comming and going from the subdivision. And logs are kept.

If you can hire a human to do it and it is fine then I don't think any automated systems would be violating privacy.

Also there is no privacy in public places and you can probably conclude that you are in a public place before you enter. Eg. Their is no privacy at the checkpoint.

> it is about tenants rights, not visitors of tenants.

That link is not the best. Quiet Enjoyment does cover the tenant's right to have visitors. A landlord cannot interfere with that right, including by blocking access to the unit by unaccompanied visitors who don't have the tenant's face.

Just give them a paper mask of your face! Much cheaper than a key anyway.

Let's ignore whether this is dystopian or evil for a minute.

Assume that the land lord is right and that this will lower his expenses.

I assume he's going to pass that savings to his tenants or just use it to buy more properties?

If this is NY, and the buildings are rent-stabilized, he could already be losing money on some apartments by charging below market if the mandated maximum rent increases did not keep up with the rents increases elsewhere in the city.

So to answer your question - maybe? But most likely not. And it's not necessarily evil.

The landlord is not "losing money" in that case.. merely just not profiting as much as otherwise.

It's a rent stabilized apartment. The savings have been passed to the tenants even before something was actually saved.

Having to ask permission for things we didn't used to is sort of the sea change of the computer age.

I would love to be able to run my own software on my iPhone in an unfettered way.

Rent-stabilized implies individuals that are less successful. This might be because of drugs, or various other distractions. Maybe it's their personal choice. Either way, any time you have rent stabilized, you have increased crime, increased disruption and increased disfunctionality. I think with greater restriction you are actually doing them a favor.

I've lived in dozens of non-rent controlled apartments, and it's almost always hell. You always have some douchebag that is above, or below or next to you who can't manage to respect personal boundaries of noise or space or smell. I would have much more enjoyed the experience if there was some level of enforcement.

> I think with greater restriction you are actually doing them a favor.

Congrats, you are now a certified authoritarian.

> And whoever is doing the enrolling can ask for lots of further information about your visitor

Why are you jumping to the conclusion that is has to go this way? Very possible that a landlord would be happy to simply have someone log a face and then go back to that person if there was a particular and legal reason to know who the face was. Now sure if they wanted maybe they could google image search the face and find out who it was. But per my other comment there is nothing to prevent a building owner (landlord or otherwise) from installing a camera and filming everyone that enters a building and actually even posting that face on the internet for everyone to see. (Would not go down very well of course but it would be legal as it's a public place). If you want to hang out in front of Shake Shack (arbitrary) with your camera all day and take pictures of everyone who enters and buys a burger or a shake you can do that.

> Why are you jumping to the conclusion that is has to go this way?

Same reason we put on a seatbelt when we go for a drive.

>Why are you jumping to the conclusion that is has to go this way?

If NSA employees abuse their surveillance powers and get away with it, then so will random landlords.

Also, keep in mind that in the article, the landlord is already using the cameras to spy on the comings and goings of tenants, and harassing them for meeting to talk about this:

> In order to let neighbors who might not have seen the letter know what was potentially coming, five tenants convened in the lobby of one of the two buildings on a late October morning to spread the word. A few days later, those five tenants — like most of the residents at Atlantic, black women — received a notice from property management with pictures of the gathering taken from a security camera; they were told that the lobby was not “a place to solicit, electioneer, hang out or loiter.”

> New York State law, in fact, grants tenants the right to meet peacefully in nearly any location in a building as long as they are not obstructing passageways. Management maintains that tenants were getting in the way even if the pictures did not clearly indicate that.

Reply on news.ycombinator.com