Hacker News Reader

Comment by CobrastanJorji | Hacker News Reader

It's worth pointing out that this is specifically the Medeco "M3". The newer generation, "M4", advertises itself as resistant to 3D printing, which it accomplishes by adding a tiny moving shuttle pin inside the key itself.

Thre's no reason a 3D printed key can't have a hole for adding a little spring and a pin, but it does mean that a 3D-printed key probably won't work right off the printer, which helps defend Medeco's main selling point: making it hard for the average person to easily acquire a copy of a key.

View on HN

Interactive elements are common in high security keys, like protec 2 and Mul-T interactive. They provide good security against low skill casting (though protec 2 has its element at the front which makes it easy to modify a mold to permit a pick to operate the element). It's easy to modify a 3d printed key to allow sliding in a shallow pick to operate the interactive

At a certain fairly early point this stuff has to become impractical compared to electronic keys (contactless smart card, or even a mag swipe like in hotels, where the door code gets changed after the guest checks out). I wonder why this high end mechanical stuff even exists in this day and age.

Because anything electronic has a higher maintenance upkeep on the lock side. A good quality mechanical lock can work for decades even in bad conditions, and power outages have no effect at all.

Because an electrical lock has a wider attack surface. Instead of attacking the key itself, you can try to disrupt the electronics to cause the lock to open itself, which is sometimes easier, even a lot easier.

Or worse, they do a very good job on the electronics, but forget about basic mechanics. The LPL has lots of examples of that as well.

In general, bypassing electronic keys is in no way harder than picking locks, it's just a different skill set.

Here are some common bypass methods that work on many real world electronic locks deployed in the wild.

https://www.youtube.com/watch?v=gbn3JtoFdPg

https://www.youtube.com/watch?v=KHvfwpnPwwU

https://www.youtube.com/watch?v=hQTz1OmmHYo

> I wonder why this high end mechanical stuff even exists in this day and age.

* Mechanical bypass for electronic locks, to deal with battery failures, damaged readers etc

* Anything that needs a padlock - for some reason, most electronic padlocks are trash.

* Things that need cheap moderate security - vending machines, confidential-waste-for-shredding bins.

* Things that need the simplicity of classic keys, or that need to be controlled by someone different to the door access system. Safety lock-out systems, lift shaft / roof access.

* Things that are already behind electronic locks, but need an extra layer of security - e.g. the safe in the ambassador's office.

Because you are thinking about a single door. Cost of implementing and maintaining non-copiable RFID is much higher. My workplace uses Medeco M3, I have 7+ keys for the various areas I have access to, I can be given a key for a specific area for the time I need to do something over there, etc. Some areas behind electronic access as well but it is rudimentary and it did cost us an insane amount of money to just install that an a few doors because we have to use union shops that abuse us (took them weeks to do, four people showing up to find out they were missing a plate so they came back a week after and found out another part was missing etc for 3 months, no kidding...)

Is that really the extent of their claim? "Hard for the average person to obtain a copy"?

Seems like a regular key stamped with "do not copy" could meet that threshold.

Walk into any store with a key-copying vending machine and, hey, new key. But none of those machines are equipped to cut Medeco keys, partly because it's a little more expensive to make a machine the measures and cuts them, and partly because of IP.

The idea with Medeco is that you give one of these to your AirBNB guests or a building maintenance worker or something, and if you get your keys back, you can be reasonably confident that they didn't make any copies. You can't be 100% sure, of course, but the average mall machine or even locksmith probably can't help them.

An authorized Medeco agent will want documentation that you have the right to have a key made (you're the owner and not a renter), and they will of course happily charge you rather more than the mall kiosk to make a copy.

> you give one of these to your AirBNB guests or a building maintenance worker or something, and if you get your keys back, you can be reasonably confident that they didn't make any copies.

This seems to be a fairly useless reassurance. If you trust your AirBnB guest so little that you think they might reasonably make copies and distribute your key to unsavory people, then just the single key floating around out there is enough to compromise your security.

The risk is that someone will rent the place and spot an easy opportunity to copy the key and come back when other guests are staying at your Airbnb. Having a known number of official keys out there with a guest means you can keep tabs on those key and retrieve them for "full security". But having an unauthorized copy puts the owner's and every future guest's security at risk until the lock is changed because you cannot retrieve it or even know if it exists.

My mistake, I misread the previous post. I stupidly read it as "if you DON'T get your keys back..."

Locksmiths can and do just ignore the "do not copy". And even if they didn't you could just use a machine, tape over it, grind it off etc.

The point is that a key is only hard to copy for the average person if it is hard to copy for the average locksmith.

Every mechanical key is possible to clone, because every mechanical key is possible to manufacture.

No lock manufacturer claims you can't clone their keys if you've got the same machines as they've got in their factory. Or for that matter manual tools and the patience and dexterity of a watchmaker.

The aim is merely that when an employee needs an extra key for a newly hired colleague, going through the building services bureaucracy is easier than going to the key cutting guy in the mall.

This is one of the reasons 99% of large buildings use RFID keycards for the vast majority of doors.

> This is one of the reasons 99% of large buildings use RFID keycards for the vast majority of doors.

Most of these can be cloned, skimmed or even emulated with a common smartphone these days.

HID Prox was broken completely back in 2005. You can read and clone any 125khz prox card from six feet or more away.

https://proxmark.com/

No because standard house keys with "do not copy" on them, you can make them yourself with a key cutter and a few blanks you bought on ebay or alibaba. Medeco blanks are much harder to find, and the cutting requires specific equipment (nothing a custom CNC can't do though)

You can actually print the moving part in place using dissolvable supports (sometimes possible without a second extruder, using strategically placed removable supports but the tolerances won't be as good).

Oh, that's a really interesting idea. I had thought the slider used a spring of some sort, but apparently it's just freely sliding and the keyway pushes it. You might be able to do that! I haven't worked with dissolvable support material before; that sounds neat. I wonder if it'd be hard to clean out of such a small space?

Either way, they still upped the requirements from "anybody with a Prusa" to "multi-material printer, one of which is dissolvable," which is probably good enough for Medeco to believably claim to buyers that their system is "resistant" to 3D printing.

This is still in "anyone with a prusa" range, I think. Firstly you can do multi-material on a single extruder head by either changing filament as it prints (which is annoying, but for a high enough target not a problem), or pre-printing a two-material filament; second, Prusa themselves do a multi-filament mod for the Mk3 which can do soluble filaments; third, you might not need a second filament at all: I reckon you could print-in-place a two-part key with a captive pin. You could design in a leaf spring if it needs it. The resolution looks challenging, but you've got to bear in mind that 0.4mm is only the standard nozzle diameter, not the smallest available: 0.1mm nozzles are around and capable of some really fine detail.

It's only a matter of time, and probably less than you'd think.

Oh yeah, and we're also safely in "anyone with a resin printer" territory if that wasn't enough.

Their new side bitting and shuttle pin stuff in M4 are actually pretty cool. Props for Medeco! Love their rendering here too. https://www.youtube.com/watch?v=wLz7UWjy1mc

Much better explanation of how it works here: https://www.youtube.com/watch?v=DNpAIZl4krc

So like the Mul-T interactive, no different for picking

Reply on news.ycombinator.com