Hacker News Reader

Comment by sriramk | Hacker News Reader

I'm shocked he didn't even try to contact Onity. He's trying ascribe motivations and possible behavior just based on his reading of the lock market - we have no idea whether Onity would have acted in this way. Perhaps they'd have scrambled to contact hotels? Or maybe they'd have disregarded it.

We have no way of knowing because he never attempted to do the right thing.

View on HN

Don't we have a good idea how they would have responded from how they've actually responded? It took four months and a huge public backlash before they acquiesced to demands for replacements.[1]

[1] http://www.forbes.com/sites/andygreenberg/2012/12/06/lock-fi...

How they responded after public disclosure says little about how they would have responded to notification with a deadline for public disclosure.

I understand the various incentives for Onity, and I think a great incentive for them is, given six months to address the issue, knowing it'll be made public, to take at least some proactive steps such as notifying large customers or being ready upon public disclosure with a mitigation plan.

His whole blog entry is a lot of handwaving to cover up the fact that he never even gave them a chance to do something anything like the right thing.

He makes an important point though: security researchers have been used by vendors as part of trying to go through the traditional process of responsible disclosure. It could easily come off as blackmail[1]. Simply disclosing to the public avoids that possibility, because the researcher was clearly not trying to personally get something from the vendor.

That being said, I think this kind of thing should be covered by whistleblower protection laws (I don't know if it's ever been tested)... although it seems those are only enforced when it's convenient.

So while I think he may have reached the right conclusion, I don't think it was for the right reasons. If sufficient protections for disclosers are in place, this should be a relative non-issue (though it makes sense to adjust the disclosure window based on the ease and risk of the vulnerability in order to apply pressure for an expedited fix)

[1] Given there's no payout for the researcher other than having the vulnerability fixed, it is conceivably not too hard to defend against. That doesn't change the fact that they can be sued, which is expensive, time-consuming, and stressful.

The best protection for the discloser is simply to do so anonymously, which shouldn't be difficult for someone like this.

Alternately, do so 'legal anonymously', perhaps by the EFF approaching the company and saying "we have in our possession information on a security vulnerability in your product. We want to give you information on it. In six months this information will be made public. We ask for and want no compensation or consideration at all."

That's it. There exist methods to do this safely; Daeken could have done it, and didn't.

No, the EFF doesn't offer this service, and given the volume of vulnerabilities disclosed, it would be a huge waste of their resources.

I'm not paying a lawyer because you have broken software that I had nothing to do with making.

> he never attempted to do the right thing.

Why do you presuppose that its the right thing?

edit: In particular, I'd rather know that when I stay at a hotel with an Onity lock, I should take security precautions instead of remaining in ignorance. I would rather know that there's a general public pressure via the media to change from insecure locks to secure locks. I would rather that hotel managers know about this via the 6-o'clock news rather than in some mailing with a PR spin.

Consider the Therac-25 case and the problems the vendor exhibited in fixing it. That behavior is endemic, and I'd rather be a consumer in the know than trust to the chancy kindness of a corporation whose interest is not per se aligned with my personal interests.

Standard procedure is to give the vendor a reasonable amount of time to fix the problem, then go public if they don't. It's not like there was some big hurry to go public, here. As he notes, the problem has been around for decades and he personally knew about it for years beforehand. Giving the company a few months to get their shit together, if they so chose, wouldn't make much of a difference in the worst case, and could have turned out a lot better.

As he clearly explained, one can't simply equate contacting the guilty vendors with an offer of nondisclosure with "doing the right thing".

"The right thing" is carefully considering and balancing a variety of qualitative factors and guesswork (and to not expect much thanks in return).

I think he read the situation correctly, given response when the information was actually released. If they'd gone to Onity before, it's pretty clear that they'd try to sweep it under the rug, also since it's highly probable they already knew about such an obvious security hole. I don't know how the law works, but it would seem to me that if they went to Onity, they might have sued to keep it quiet. It's happened before.

It is entirely likely that had he given them notice and then 6 months to prepare, they would have spent the entire 6 months suing him and trying to get him silenced by court order. The problem would then still exist but he would be bankrupt and unable to warn anyone.

Our legal structure creates situations where the "right thing" sometimes has to be balanced against the potential for personal ruin, so it turns into the "rightest" thing given the circumstances.

He could have disclosed to them anonymously, either technologically or legally, which would have prevented Onity from suing him.

Anyone who's dealt with Onity and is familiar with their business practices would immediately confirm that they not only didn't deserve disclosure but they likely would have done nothing with it. One need only look at the evidence of what they did in the face of non-disclosure to confirm that.

My capacity for shock was run dry by the original engineering decisions made by Onity.

Everyone messes up. Every exploit can be made into an easy to distribute tool. As an industry, the idea is to help the people who make these mistakes fix it as soon as possible so users don't get hurt.

If you make hotel locks, it's your job to not mess up and if you do, to find it and fix it before anyone else. Other people's safety is relying on you.

The problem is that the incentive here is for Onity to NOT disclose anything and keep on going like nothing happened. They'll get around to replacing them one day, and it hasn't caused any huge scandal yet, so what the hell right? It can wait! The alternative: a lot of bad press and millions of dollars in hardware fixes. Contrast that with a software fix delivered through the internet, instantly fixing the hole.

Then there's the matter whether Onity seems like a trustworthy company, that would do the right thing. A company whose ONE job is to make electronic locks, but still has an obvious security hole in their system is either 1. really stupid or 2. knows about it and has done nothing. A security whole in a beast like Windows (which main purpose is not security btw) I could understand and sympathize with. A lock is not nearly as complex. Either way I wouldn't trust them to do the right thing.

Except users can(and likely did) get hurt regardless of how the disclosure was preformed.

"Everyone messes up" is fine if your job is creating systems where security is largely a secondary concern. If security is the whole point of your product in the first place, and your product is actually completely insecure, that's not messing up, that's gross incompetence.

Think about how that conversation would go:

"Dear Onity, I found a security problem in your product that will cost you millions of dollars to fix. Fix it now or I'll go tell the world about it."

I'd be afraid my car would blow up the next time I turn the key.

It doesn't matter. The linked breakin was half a year after the presentation. If Onity didn't fix the lock by then, more time wouldn't have really helped.

My mother-in-law was in a hotel room on a business trip just in the last 3 weeks where they had the lock vendor reprogram the door while she was in the room because of "some hacker."

I had no way of asking her if it was Onity after the fact, but whoever it was is actively working on the problem. It takes a bit longer to push out something to millions of non-networked devices than it does to just fix something on the App Store.

If you look through my past comments I've been very critical of his "disclosure plan" myself. I agree with you completely. This blog post did nothing but reinforce my belief that he made a mistake. He wrote a lot of words that weakly defended his almost indefensible position.

I can only conclude he really does believe he did the right thing. I hope the people who's rooms were broken into see it that way too.

Reply on news.ycombinator.com