Hacker News Reader

The lock on your front door is more secure than the lock on your bedroom door. This tradeoff is for convenience, of course.

A entrance to a mini-storage place is probably OK to be weak. Presumably, you are required to have a proper lock on your own unit. Likewise, the PIN is generally the 2nd factor (along with "something you have") for important things. I'm OK with the convenience of having only a 4 digit PIN on my ATM card since I can reasonably protect & deactivate the card. If someone forces me to enter my pin under duress, it doesn't really matter how many digits it is.

Probably worth noting that using another PIN like that to enter a storage facility is almost certainly a breach of terms of use. Such that, if you did anything in there that is not ok with everyone, they have easy legal recourse against you.

Probably limited to termination of your rental.

Would depend what else you did, I presume? I also just meant this as an "in addition" to the idea that it isn't aiming for fool proof protection.

> A entrance to a mini-storage place is probably OK to be weak. Presumably, you are required to have a proper lock on your own unit.

You'd like the entrance to be strong, because access to the entrance grants you secluded access to all the units, and angle grinders beat locks in seconds, proper locks in just a few more seconds.

Of course, cars beat entrance gates pretty easily too.

Hopefully they have cameras in there.

They're hardly worth stealing.

Or do you mean they might prevent theft? Or deter it? It is my experience that they are pretty useless at both.

If it's ok to be so weak that it's trivial to enter like this, why have the lock at all? The cynical (and probably accurate) answer is that it's security theater designed to give customers warm fuzzy feelings cheaply and with low risk of lockout calls and maintainance issues. It does basically nothing to keep someone from taking your stuff.

dissuading the least motivated perpetrators, ability to add a "breaking and entering" charge perhaps?

It's weak, but I don't know if trivial is the right word. Like a bedroom lock, it does what it needs to do. First, the lock is probably there to make it easier for one remote security guy to monitor many locations after hours. They can be alerted when a door opens, has been ajar for a while and along with a camera, see what's going on. Other than that, you also want a lock to help keep the door closed to help keep climate control working efficiently, keep animals out, etc. Like I had been alluding to, when you rent a unit, you're told that you are responsible for locking your own unit with a specific, harder, lock, like a front door lock. If an attacker can get by this lock, entrance to the premises would have been possible as well.

On that note, I don't think the absence of a super strong lock on the front door of a storage place invites criminals. I live near open air storage facilities where anyone can just walk up to the units, like they're walking by cars on the street or in a parking lot. Thefts from storage units are just not big enough of an issue to require additional measures.

"You need to choose an access PIN."

"How about (digits)?"

"You can't use that one. Someone else has already chosen that."

"Wait, now I know someone else's PIN code. I could use that and it'd be logged under their name."

My mini storage place issued me a code that was just the number of my box and the year I was born. Knowing this, I could probably brute force someone else’s code in 30 seconds.

I'm sure they have cameras that could trace things back to you.

In my mother tongue there's a saying that that roughly translates to "The lock on the door isn't there to keep you out. It's there to communicate that you're not wanted there."

But this is coming from a culture that's rather communal where shared property is often the default.

This reminds me of when I was in HS. There was a auto car wash that would print a number on a receipt for one to enter and get a carwash with. One day for whatever reason I just punched in 12 random numbers and it worked. And thats how I got free car washes all through high school...

> in most cases you don't need to search anywhere near that many

If the pin is chosen randomly with a uniform distribution over the 0000 to 9999 range, then the average brute force search will probe 5000.5 combinations.

And even if the number is randomly generated, many devices accept any string of digits that end with the correct four digits. Pressing "12345" actually tests both codes "1234" and "2345".

I'm sure there's an optimal sequence of keypresses that tests all 10000 codes in something like 30,000 keypresses rather than the naive 40,000.

Also true of those old "lockbox" key lockers that real estate agents use to "protect" the keys to your house.

This made me uncomfortable when I was selling a house, so naturally I wrote some code to generate a string of digits that would cover the full solution space most efficiently.

Armed with this "master key", I had the lockbox open in negligible time. Honestly I think it was just a few minutes, and I was about halfway through the string.

This let me put the key out only when a showing was happening, and I brought the lockbox to the closing, which baffled the real estate agent.

Yes, there's some solid theory behind it:

https://en.wikipedia.org/wiki/De_Bruijn_sequence

It seems that you can do it in 10003 key presses. Calculation for this this exact example is in the Wikipedia page.

So the system allowed multiple users to chose their own Pin and didn’t ask for a user ID when authenticating? That’s just stupid design.

“What’s the password?”

“Which password?”

“Any password.”

“Hunter2”

“Welcome!”

Why did you put just asterisks?

This is an asterisk

*

As a memory rule, astrisk looks like a star, asteriskos means ”little star” in greek and is related to asterology.

I think what's happened here is that you didn't get the joke. https://knowyourmeme.com/memes/hunter2

I did not get that, lol

In my case I see just #######

Is it? it is just a gate

Well we just got told how someone who forgot their pin managed to get in, so it probably doesn’t work. I would call that stupid.

Depends what is inside.

Every security mechanism is breakable with enough budget

To be fair that was decades ago. The mini-storage place I use now asks for your unit # AND your PIN. So it would be a lot harder to guess like described above.

Yes! Back in the 1980s when long distance telephone was a thing, I used to dial (301) 737-2051 followed by a 5 digit pin to get access to a service that the let me enter a long distance call. It only took about 20-30 manual attempts for me to guess a valid 5 digit PIN! I'd just increment my guesses by 1 each time.

What is "5150" well known for?

https://en.wikipedia.org/wiki/Lanterman%E2%80%93Petris%E2%80...

I had the same question. It is the title of a Van Halen record album, also a section of the California legal code related to mental health, according to a simple search.

It's apparently the California law section number for restraining a mentally unwell person or something, so has law enforcement and slang usage, and there's a 1986 chart-topping song named after it. (I'd never heard of it either, but I'm not Californian.)

This is one of the first results a search provided. I skipped Wikipedia which was first but it was actually informative as well.

https://www.dictionary.com/e/slang/5150/

One of the best Van Halen albums?

And Eddie’s amp model, the Peavey 5150. It’s become the de-facto standard for the more extreme metal bands.

When Eddie took the rights with him to Fender and they made the EVH 5150 (another fantastic amp), Peavey renamed this line to the 6505 series, so there you have another four-digit code to use.

Well the 5150 was Eddie’s Studio Postal Code, but if we are going down this road :-) I would like to point out at some point in time they run out of Sylvania 6L6 Power Tubes... then Peavey started with Chinese Ruby 6L6 Power Tubes for the EVH5150 and they dont sound the same...

This being HN, my mind went immediately to the IBM 5150...

https://en.wikipedia.org/wiki/IBM_5150

This being HN, there's only a few of us left.

Its the famous law for involuntary mental lockup in California, then referenced a lot in pop culture, probably most notably with a Van Halen album named after it. Its used in a lot of jokes, but also oppressively. I think we've seen some divorce court releases and such on how to "5150 my wife," how cops abuse it, etc.

Around these parts, we call it an "M1 hold"

M1 is - I think - the form they have to fill out to put you on a temporary hold.

In my GenX brain, a Van Halen album* comes to mind.

* https://www.youtube.com/watch?v=OFxg1nB9yQ8

As a Van Halen fan, I think of it because of the album titled "5150". But it has other well known uses as well.

Color me a bit sad to not see 2112 make the list.

Based on the legal code, around here it's slang for "crazy".

Poster: "I was ripping my dirt bike out in the snow and got pulled over!"

Commenter 1: "What for?"

Commenter 2: "5150."

Barcroft Station in California (elevation 3800 m) has house number 5150 over the door. You'd have to be crazy to want to work there.

The biggest job of the front entrance gate at a mini-storage business is to keep random people from loitering in the area, so the cameras(/hypothetical people watching the feeds) have an easier time witnessing a break-in.

That's called a dictionary attack and it's one rung above bruteforcing

Ofc whenever I need a insecure four-digit pin I use 2501 - so people will know me when they meet me again.