Hacker News Reader

Comment by closeparen | Hacker News Reader

This is already accomplished by having difficult-to-duplicate keys or fobs for the building entrance, which is a pretty standard feature of apartment living. And yes, some management companies are very stingy with extra fobs, as a control against having extra people in the unit who are not on the lease, or Airbnb, or whatever. You can tell you are in a building with a lot of illegal extra tenants when the keyfob-controlled gates are always propped open, or there are always people waiting to tailgate through them.

View on HN

I've yet to meet an apartment key fob I haven't been able to clone with a 'universal' RFID cloner gadget I bought in Shenzhen for $150 a few years back and some blank cards of various frequencies. You can also link it to a Aliyun/Tencent Cloud account for compute power to crack some older/low-end encrypted tags. I even managed to successfully clone a HID badge from work that was supposedly clone-proof...

Most landlords, in my experience, don't invest in the high-end RFID systems that have real security.

If nothing else: there's a market for fighting back against this. KeyMe kiosks (usually found at US supermarkets, pharmacies, etc.) have had RFID fob/card cloning capabilities for a while now. You scan the fob/card at the kiosk, then they clone it to a sticker and send it to you via mail.

Interesting. I wonder if they have actually productized the security research on HID iClass, etc. or if they are only supporting simpler credentials with no cryptography.

> clone it to a sticker and send it to you via mail.

So they have a database full of addresses together with their digital keys?

What could possibly go wrong...

To be honest, not a lot, they only let you past the building door. So as a thief, I can: A. Scrub through a hypothetical leak of all that data, or B. Tailgate someone (even in security-conscious buildings this isn't much harder than following someone while carrying a box in both hands)

Locks are for honest people.

So it can be used to steal or deliver packages.

Until you live in an apartment complex that has eliminated keys. My place is all keyfobs (except for the mailbox).

Letting people get into the locker room or bike room can create issues.

You can get a great lock, but what they lock into is usually a very weak link.

Does this also work for company badges?

In theory, it could. Depends on whether the particular RFID standard used is supported by KeyMe or not. At a glance, they didn't seem to have much info available on what is/isn't supported.

I wonder what they do with the data after they’ve mailed you the sticker.

Most RFID keyfobs simply contain a serial number (possibly encrypted or signed) and nothing more. There's not a lot of use in stealing a random number. They'd have to be in cahoots with the people running the lock software to gain anything by it.

In San Francisco the rent ordinance allows tenants to petition the rent board to lower their rent due to a substantial decrease in services if a landlord denies a request for a spare key.

This seems like a reasonable policy that other cities with renters might benefit from, if they don't already have something similar.

Presumably the landlords then don't deny the request... They just make the process horrendously long and complex...

"Please fax this handwritten form to this foreign phone number and then you can collect the key from this office on the other side of town only at 3pm on a tuesday. Oh - now you've shown up we need ID, and we only accept birth certificates."

An SF landlord has 14 days to provide a key after being asked in writing. It's acceptable to deny the request for unlawful occupancy, but not for giving a family member, houseguest, or service worker access to your home.

For reference: https://sfrb.org/section-3713-keys

If they claim unlawful occupancy, you can invoke the Kim 2.0 amendments of the rent ordinance which basically prevent an SF landlord from denying you the roommates of your choice.

If a landlord denies a roommate under the Kim 2.0 amendments, you can almost certainly get your rent cut in half by petitioning the rent board.

In every apartment I've lived in with such difficult-to-duplicate keys (such as magnetic locks and what not), I've been ask whether I want a second set; and/or the owner told me to ask them should that ever be the case.

Not quite sure what's different with that situation from before, other than slightly cheaper keys.

In my experience, in San Francisco, the owner will only give you a key for every name on the lease.

Nevertheless, you can at least hand a person (e.g. your visiting parents) your key so they can open the door without you.

Some buildings (or just the owners?) keep the copy for cleaners in a realtors lock box. Doesn’t stop a sophisticated attacker, but probably does the job when you want to fire the cleaner.

In Switzerland I've always changed the locks to my apartment and its garage.

1) The landlord is _never_ allowed to enter your house 2) In an emergency, the firemen would just break the door.

GP was talking about the entrance to the building, not the apartment. Having your own keys to the apartment doesn't help much if you only have one key to get into the building.

Yep, sorry for the lack of clarity. I assumed we were talking about building entrances, I've never had magnetic locks on an apartment itself.

In parts of the US I have lived in at least, not letting the landlord in under certain conditions allows the landlord to evict you or go after you for damages. There is no way to never let them in

Face recognition will not allow anyone other than the tenant EVEN if they carry the very original key. Forget about duplicate keys, which may be it's own problem, but nothing compared to this.

Do Americans not get extra keys for their rental apartments?

Granted, I've only rented out an apartment once, but it was from a big local rental agency and I got three keys despite being the only tenant in a single bedroom apartment. My current studio apartment (although not a rental) also has three keys.

As a single tenant, I've always gotten 2 keys for my apartment door, and only one fob for the main entrance.

That also sounds weird since here it's pretty much universal that your apartment key also works for the main entrance.

RFID access fobs instead of keys are becoming increasingly common for main entrances because it allows property management to revoke access for one person without making everyone else in the building also change keys.

> Do Americans not get extra keys for their rental apartments?

Mine didn't though I'm sure I could have gotten extra ones if I just asked.

I've been tempted on many, many occasions to give the neighbors a dollar to get a duplicate key made so they aren't knocking on the door/window at all hours because they obviously don't have enough keys for the amount of people living there.

Reply on news.ycombinator.com