Hacker News Reader

Comment by daeken | Hacker News Reader

I did plan to wear the shirt; I felt it injected a bit of fun into something that, frankly, is scary as hell.

Forgive me if I'm just naive but I don't get the 'scary' part. Locks have always been 'advisory' and people who have wanted to circumvent them for both good and evil rate them by their 'time to disable'.

Hotel locks with hard keys had their issues as well, and were pretty trivially picked with simple tools. But the key is always that you need to bring the 'simple tools' which is to say that they aren't vulnerable in a way that someone who decides on the spur of the moment to enter the room can easily duplicate. They need the plug that fits the power cord, they need the software which does the JTAG wiggler etc etc.

So if it is 'scary' that people who are not affiliated with the hotel either as guests or as staff can, with pre-meditation, open a hotel room door without damage. Then you need to re-define scary. This has always been true, and will probably always be true by the nature of hotels and motels.

It should be noted that [some] hotel doors with electronic key cards also have physical key holes (as a backup) that are hidden, but are still susceptible to being picked.

This just supports your point that hotel doors are not 100% secure for anyone who really wants to get through.

Edit: Replaced all with some. The doors at the hotels I worked had backup physical keys in case the battery failed. It's cool that Onity locks can be powered externally if the battery fails. Thanks for the correction.

That's not really the case. While some of these do exist, Onity's locks themselves do not contain any physical keyhole and I've never seen them installed in such a configuration. Other vendors may be different.

Agreed. The vast majority of locks on doors are to make the people inside feel safer, not to actually prevent a determined intruder from entering.

Given the dozens or hundreds of hotel staff that can easily gain access to your room, I fail to see why this is "scary."

And also, you don't have to be our ambassador. You can wear whatever you'd like -- you don't owe us anything.

"did plan"

The most important thing was that you gave it thought in advance! That is good. You had your reason for wearing the shirt it might not be the same decisions others would have made but the decision is yours to make based on what you were trying to achieve.

By "scary" did you mean the media attention?

I mean the vulnerabilities. While my exploit has issues (which, as far as I can tell, are issues with timing when reading data from the lock; I lose the first bit of every byte) it's only a matter of time before someone fixes that and has these rolling off the assembly line. All you need is a microcontroller, a resistor, and a connector; that scares me.

http://xkcd.com/538/ is sort of relevant, no?

I'm curious how the admin system of the hotel logs these types of entries. What do they show it as in the log file?

Were or are you able to find out?

Reply on news.ycombinator.com