Hacker News Reader

Comment by edc117 | Hacker News Reader

They've known about the vulnerability for a -year-?? Come on. In some fields, fine, but in a safe company?

They probably assumed that the cost of fixing the issue and actually pushing that fix to every unit in the field would outweigh the cost of not fixing it.

True, though now that it's public they may start accounting for the potential cost of lawsuits within the next year.

depending on how the usb slot is used surely the fix could be as simple as a tube of superglue (assuming you dont need the usb slot).

We will see if they dare use the 'it is not supposed to be secure' excuse that lock-maker Onity made (Onity is the company that charged its customers for fixing its faulty product.)

A strong engineering case can be made for "Look, if you installed a Brinks safe for a year, experienced no employee theft, and then had an Evil Hacker come in and swipe $10k from you, you got excellent ROI. Your insurance will inevitably pay the claim. We'll reimburse them. They won't cancel your policy. 998 similarly situated stores lost nothing; the last one had someone crash a pickup truck through the window and winch the safe away. Terrible thing, that, but that's why we're all insured."

You don't buy a safe so that you'll never get robbed. Banks don't have that as a desirable security posture! [+] You buy a safe to cheaply decrease the total cost of theft.

[+] Fun fact: average bank robbery costs the bank only $8k or so in lost cash. This is one of the many reasons why every bank in the country has In The Event Of A Bank Robbery Don't Try To Be A Hero Seriously It's Pocket Lint in their training about it.

If they had made that argument to their customers at the purchase time, together with a realistic estimate of the degree of security being provided, then that would be a valid argument for them to make now.

Also, as this argument depends in part on insurance, the insurance companies are entitled to the same information.

The real point here, however, is not that the safes can be broken, but that they can be broken relatively easily with techniques that have been known for a long time, and which can be defended against. There is no strong case to be made that this is a well-engineered product.

Reply on news.ycombinator.com