The App I Used to Break Into My Neighbor’s Home

I feel like this is a complete misunderstanding of the threat model here. Keys are not "like passwords", because to use a key you need to physically go up to someone's door, whereas with a password, you can generally do so from a computer terminal anywhere in the world, potentially using anonymizing proxies.

If anyone in the world could anonymously try and open my doors and, if they succeeded, could steal my valuables, locks would have been found insecure a long time ago.

Yes, the author here doesn't know how to use lockpicks or a crowbar to break into a house. The author also has presumably never tried to steal something from a house. Houses are generally just secure enough that the casual passer-by can't easily get into them, but not secure enough that if you really wanted to you couldn't get in. Most people who pick locks will tell you that picking locks is not a particularly good way to break into a house to steal things because breaking into a house is easy when you don't mind destroying someone's property. If you're a criminal you don't need anything more sophisticated than a crowbar (and even then you might just walk around until you find a door that's not locked at all).

So sure, maybe this makes one particular attack marginally easier (not really all that much easier than it was before), but illicit key duplication is still not the weakest part of your physical security by a long shot, so I don't think there's anything to worry about.

"Parking valets suddenly require a ludicrous level of trust"

They always have. It was always possible to take a blank key and just copy it with a file. You could use a softer material to expedite the process and then copy it again later...

Which is why, most cars come with a valet parking key that only turns the ignition, and doesn't open your trunk. You're not supposed to hand the valet your entire keyring. That's ludicrous (although a lot of people do this)

Though with the availability of this app we're going to see a lot more crime committed this way.

Killer escaped prison after being issued picture of master key to all locks.

A former prison officer said the design of the master key - which could open every lock in Berrimah jail in Darwin - was printed on the front of the prisoners' information handbook.

http://www.news.com.au/national/killer-escaped-prison-after-...

To spare people time reading:

It's KeyMe, a service that lets people make copies of keys from a vending machine, using photographs of keys. He got the photos because his neighbor let him handle the keys.

No particular high-tech involved. (Even though he claims they're 3d-printed in the vending machine, i suspect they're simply cut from a raw.)

for those playing along at home, the app he used to break into his neighbor's home is called "my neighbor gave me a key to their home".

if we are willing to call this a "break in" then the app is not the operative concept, it's the social engineering that enabled the guy to give you the fucking key.

might as well have written about the shoes you used to break in with.

I think that this article, and many of the comments, show a misunderstanding of what robbing houses is really all about. Not that I've done it, but it seems pretty obvious when you think about it from the robber's perspective.

Anything to do with locks is not really relevant to robbery, since virtually none of the houses in the world have good enough security to resist anyone even moderately determined and willing to break things. Why bother with some elaborate charade to copy keys when a crowbar, or usually a boot, will get you into any house?

What is actually relevant is information about the house and what's in it. First, information about whether there is anything stealable in there - stuff that's easy to transport out and can be sold in a grey market for a good price without being easy to track back to the thief. Most houses don't have a lot of stuff like this, and there's probably a pretty stiff haircut on the price you can get when moving stolen goods through fences. I'm guessing that you'd want trustworthy information that there's stuff you can take and move for at least $1,000 or so to make it worth your risk to break into a specific house.

You'd also want solid information about who can be expected to be at the house, and when. Any chance at a confrontation is going to add a lot of risk.

Threats like the valet copying your keys don't really make any sense. Yeah, he has the keys, and information that could lead to an address, like registration and license plate. But he doesn't know anything about what's in the house or who's there. Why should he care that, after going through a complex and risky process to get a copy of the keys and the address, he has slightly easier access to a house of unknown quality?

Worry instead about people who have access to that information. Repairmen, exterminators, maids, anybody who has a legitimate reason to go around your house. And be wary of letting untrusted people know when your house might be empty for an extended amount of time.

There's a minor inconsistency with car keys.

In contrast to "stupid" ordinary house locks, which are not powered, car keys these days incorporate RFID chips so that the key at least cannot be used to steal the car. Granted, you can still empty it, but at least better than losing the car altogether.

So what if there's an app? Copying keys has been done for centuries and it's trivial. I forgot my personal storage locker key once at home when working at one metal company. It didn't take too long to call my dad, as details about the key, and creating a working copy. It was a Abloy Classic key, so it was trivial to copy of it from bolt using lathe and a bandsaw. With some key types you might also need a drill. All this work can be done bit slower using plain hand tools, you don't need even electric power for copying keys. And the lathe was only needed, because I naturally didn't have a right 'blank'. Copying keys has been always trivial if you have access to key you want to copy. I guess it's now ok to confess that I also had a teachers set of keys at school. Of course a copied set. One teacher borrowed me their keys once, and that's it. And this was 20 years ago and before copying the keys needed for personal locker at work.

Apparently 95% of USA home locks use SC1 or KW1 keys... and OpenSCAD files can be downloaded to easily generate a 3D model of any key configuration using a statement like this for example: sc1([3,3,1,7,2]); http://www.thingiverse.com/thing:8925/#files ... then send it to your 3D printer

News story in 2006:

Jail keys changed after TV lapse

All the locks and keys at Feltham Young Offenders' Institution have had to be replaced after security was compromised during a media visit last week.

http://news.bbc.co.uk/1/hi/england/london/5145026.stm

What happens if the "Key" DB gets hacked and stolen? Is the company required to buy everyone new locks?

Only tangentially related, but: It would be interesting to consider physical(ish) methods of federated authorization.

Hand the valet a key fob that you've enabled for use within a 1 mile radius and two car starts?

DEF CON 18 - Schuyler Towne & datagram - Attack the Key, Own the Lock

http://www.youtube.com/watch?v=_ctWJAdeHPU

Nice link-bait on the headline but for most people the only thing preventing an intruder is a very thin piece of glass.

Also, does KeyMe, et al, really not email/notify you when a dupe is made?

Wasn't something like this already being done in the pre-iPad era with bars of soap or wax?

If you loose possession of your keys for a time someone can copy them. Did someone not know this?

This is why I use 2 factor on my front door.. Mainly fingerprint backed by a code or key. Noting is 100% safe..but I prefer ease of use in making a decision.

I know people who made keys from photos in high school (I attended boarding school, there was a lot of free time). It is not hard to do, even without KeyMe.

Yep. And this is why I have an easy way to separate my car keys from the rest of my keys. I don't hand anyone my house keys, ever.

Like magnetic stripe credit cards, keys need to die. The security model is broken for the same reason - anyone who handles or even looks at the token has free reign on whatever is protected by the secret. The secret should instead remain encapsulated, used only to sign encrypted, replay-attack-proof authorizations.

It's 2014. Smart cards need to be everywhere. Even my college dorm had contactless smart card authentication.

Keys still have a place for manual override in outages, but that should be rare and set off alarms.

With apologies to all, everyone is missing the point, including the author.

Spoiler/tl;dr summary of this comment: Soon you will be able to generate a key while standing at the lock, scanning it with the laser scanner built into your mobile device, generating the key with a hand-held 3D printer you bought at the convenience store on the corner.

OK, longer version.

A number of comments dismiss the security threat as not particularly meaningful (give someone your keys, give them an opportunity to mess you up) and they are correct insofar as this very specific threat is concerned. It really is very similar to the traditional "give someone your credit card, they can mess you up" threat.

But think about that threat for a moment: The reality of that threat led to chip-and-pin cards, to CCVs, and to PCI compliance.

That threat was also greatly magnified by the move from the pen-and-paper world to the world of online shopping - and we've had to adjust our threat mitigation strategies appropriately.

The point of the article isn't actually for example that valets require great trust. The author actually misses the real point while describing it quite clearly: It has always been possible to do this, it's just orders of magnitude easier, and cheaper, to do it today, because of the blend of off-the-shelf widely available low-tech technology. That's the point of mentioning KeyMe: It is so easy to build the bits to do this threat that there are reliable commercial services that make money from low-cost apps and unattended kiosks.

And it is going to get much, much, much, much worse, very, very, very soon.

Very soon now you will be able to buy a pocket or at worst back-pack size multifunction replication device, that is, a 3D printer with a scanner built-in, or perhaps a 3D printer that uses your mobile device as a scanner.

With that device, you will be able to duplicate the keys on the way up the stairs.

And soon you will be able to use a commercial hand-held 3D printer with a commercial hand-held laser scanner to generate a key by scanning the lock.

That's just the beginning of tomorrow's threat model.

EDIT: Added a missing word above, and the following thought....

We assess attackers based on motivation and resourcefulness: a motivated, resourceful attacker is always a worry. The key duplication threat used to require a motivated attacker capable to acquiring resources, e.g., the prisoner, who would duplicate a key slowly and laboriously, using low-tech tools. This is a very motivated attacker.

Existing and emerging technologies make the resources widely available and lower the motivation bar dramatically. The key duplication scenario will soon be populated by the equivalent of script kiddies who will perform the threat just because they can, just because it's that easy.

That's the point of the article. That's the threat model we face going forward.