Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My friend just posted a picture of her key to instagram and it occurred to me that with such a high res photo, the dimensions of the key could easily be worked out. Therefore the key could be duplicated. What's to stop someone malicious from abusing this?

share|improve this question

migrated from cs.stackexchange.com May 18 at 20:14

This question came from our site for students, researchers and practitioners of computer science.

77  
"What's to stop someone malicious from abusing this": Do not post a picture of your key to Instagram. Related: telegraph.co.uk/news/newstopics/howaboutthat/3375872/… –  Jukka Suomela May 18 at 21:22
46  
What stops someone from creating a key the old-school way with a blank-key with a file, just like locksmiths do for centuries? –  Philipp May 18 at 23:46
16  
Just to add to this. Most of the more common house locks (at least in the US) have standard dimensions for the patterns on the keys. This means that your picture doesn't need to be very accurate to recreate. You just need to know what dimension it is closest to. labpins.com/images/kwikset_bitting.jpg –  David Houde May 19 at 0:23
7  
@Philipp: I like odd machinery. For fun I bought a key cutting machine on Craigslist for fifty bucks, and it came with a few hundred key blanks. Simple key cutting machines are cheap; you don't need fancy equipment like 3d printers to make keys, and you don't need primitive equipment like files either. –  Eric Lippert May 19 at 3:07
14  
Summarizing and agreeing with everyone else's answers: The problem is the photo of the key, not which of multiple possible approaches could be taken to produce a key from the photo. DON'T DO THAT. –  keshlam May 19 at 3:37
show 15 more comments

12 Answers 12

The simple answer is: nothing.

This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being successfully used, both by locksmiths and criminals.

A 3D printed key will do just as well, if strong enough, or it could be used to cast a key if necessary, or as pointed out by @EkriirkE - you could use a torque bar to turn the barrel.

You should not ever post picture of keys to a public site, unless it is for something unimportant.

share|improve this answer
46  
This is not just a problem since 3d printing. Recreating a key from a photo is something every locksmith can do the old-school way with a blank-key and a metal file. –  Philipp May 18 at 23:48
2  
Strength really isn't an issue as you can just use a torque bar to turn the barrel, having the 3d printed –  EkriirkE May 19 at 6:05
12  
I once had a locksmith re-tool a key by putting a blank in the lock and torking it enough to get an impression on it, and then filing it accordingly. Obviously, a photograph just makes it that much easier. The only limitation I can think of with the 3d printer would be resolution, but that might not even be an issue now. –  TecBrat May 19 at 14:03
9  
A notable example is the time Diebold posted a photo of the key that opens their voting machines (although 3D-printing wasn't involved; just some blank keys and a file). –  cjm May 20 at 6:02
5  
@jwg: Actually manipulation based impressioning works just fine with standard pin locks. The important concept is trying to twist the key while the pins are not alined with the sheer line causes torque on the pin (a.k.a binding). That torque can make the pin rub against the the "top" of the key, leaving a small mark. If the pin right at the shear line, it does not bind, but twists slightly out of place, much like when you turn a key that fits except to a lesser degree because the other pins are not yet aligned, and therefore leaves no mark. Once all pins stop leaving marks, the key works. –  Kevin Cathcart May 22 at 19:57
show 6 more comments

As the guys previously said, nothing!

Even more, I've been working on such a project myself at the university! (albeit I don't say this as an official target, of course)

I am trying to do duplicate a key from a single photo, with some assumptions to make it a realistic problem such as having a coin of a known size next to it for size calibration and rotation, almost symmetry between the two sides of the key etc..

My target is to automate the whole process, i.e you take a single photo and an app will detect the outline of the key and the grooves inside it (which is a really difficult problem since it's a reflective field) then construct a 3D model ready to be printed.

I have uploaded some videos of my progress if you're interested to know how things went so far :)

Extracting a key from photo

Rendering a key

Rendering of a key with its grooves!

This is the outcome 3D printed key in lock

There have been a couple of researches about this in the States and Thailand, but: 1) the states': you take a photo and point out the points of interest 2) Thailand's: a reconstruction from a video-stream of the key. Meaning that none is absolutely automatic, but they're still good nonetheless.

I have also found an app for iDevices in which you can take a photo of the key and send it to a company which will then duplicate it and send it back. I have always laughed at this and said: yeah, the mailman will knock on your door and if you're not home he'll simply enter the house, put the key and leave with everything else.

share|improve this answer
6  
In regards to your project: There's a relatively small number of keyways in play - you might try matching the non-milled area of the photographs against the known types of blanks. If you can match it using the proportions, you could avoid needing an object in frame for sizing comparison. Once you know what blank is needed, your image processing can focus on figuring out the cut for the key in question (there's usually only a few possible depths for each position), then model that ideal key and print it. –  Michael Kohne May 19 at 20:42
    
I don't get why this isn't the top ratet answer. You provide even a working example, this is really great work! –  Tokk May 25 at 13:25
    
Since my comments were deleted for some reason, I'll say it again: I believe that what you're doing is incredibly unethical and that you are unethical too. –  Boann May 31 at 15:39
    
@Boann I see that you work on software exploits. I think you are unethical. –  Jonathon Reinhart Jun 22 at 20:41
add comment

Absolutely nothing.

On one occasion, a convicted killer in Australia actually duplicated a master key of his own prison cell just by looking at the physical keys carried by the guards.

He successfully escaped from prison and was on the run for 12 days before being captured.

So if a prisoner with only raw metal and a good memory can copy a key, I think that an actual photograph and a 3d printer would work flawlessly.

Every single day when "locking up my house" before leaving for work, I chuckle at how pointlessly stupid the whole practice of "keeping things under lock and key" in this day and age of technological expanse.

share|improve this answer
1  
Agreed that most locks are just security theatre! However, you might want to check out what the Italians often do with locks, it is eye opening. –  Julian Knight May 19 at 13:18
11  
@JulianKnight don't leave me hanging like that! –  islandlubber64 May 19 at 23:02
3  
I chuckle at how ridiculously easy it is to knock a door in. I'm not exactly a big guy, but I locked my keys in the house once and it only took one strong hit to open the door. Sure, I had to fix the door casing but seriously, if I'm a burglar, what does that matter? –  Chris Lively May 20 at 0:22
2  
@EamonNerbonne: Actually, it wasn't any more noise than someone hitting a nail with a hammer. I seriously doubt anyone heard it much less was bothered enough to look out a window. The concept of home security for us regular people is a joke. The only reason to bother with making a copy of a key is if you are trying to not let them know that anyone was there. –  Chris Lively May 20 at 14:12
3  
@islandlubber64, sorry about that! Try this article from the Privacy Surgeon Blog for some interesting thoughts. –  Julian Knight May 21 at 7:20
show 3 more comments

Here's some academic research on stealing keys from afar with a hi-resolution camera:

System demo

Our SNEAKEY system correctly decoded the keys shown in the above image that was taken from the rooftop of a four floor building. The inlay shows the image that was used for decoding while the background provides a context for the extreme distances that our system can operate from. In this case the image was taken from 195 feet. This demonstration shows that a motivated attacker can covertly steal a victim's keys without fear of detection.

share|improve this answer
add comment

As other answers say,nothing prevents them...

however...

As a locksmith I can tell you that some locks have tolerances that are measured in the thousandths of inches, and getting a perfect match isn't always a guarantee.

What would actually stop someone? The fact that picking a lock is easier, and quicker (in most cases) than making a key from an image or 3D scan, even if I have precise measurements.

Regardless of the tolerances, a skilled locksmith can pick a lock in less time an with more certainty than making a key from a photograph***, or even a 3D scan. If the lock has crappy tolerances, it is most likely not a very secure location, and anyone wishing to gain entry is going to kick the door in to minimize the amount of time they are on scene. They aren't going to bother with picking the lock or trying to 3D print a key.

The exception is high-security locks, like Medeco. These are virtually unpickable and are usually in secure locations, but you'd need a very specific set of photographs, a high-res 3D scan, or some other means of finding not only the keyway (shape of the key shaft) and depths of the cuts, but the angles of each cut as well. Simply "jiggling" a wrongly cut Medeco key won't get you anywhere.

Many thieves would just as soon "break in" meaning use force to enter without a key. It's a surer bet, quicker than opening with a legitimate key or picks, and they aren't trying to hide their tracks anyway.

share|improve this answer
    
This. Most locks are hackable. The main thing they do is add enough difficulty to keep honest people and half-hearted criminals out. Someone determined to get in will find/use the weak link in your security, which might not be the lock at all. It might be the door itself, an open window, the fact that the security staff is a bit too "helpful" sometimes...etc. –  cHao May 22 at 16:43
2  
Adding to cHao's comment: a real eye-opener for some my friends was a real history, where the burglars instead of picking the locks, destroying the door, or breaking the window - simply made a window-sized hole in the outer wall of the building. They did it in the middle of the day when house owners were in work, and they were dressed as construction workers so none of the neighbours paid attention. –  quetzalcoatl May 25 at 0:21
add comment

This guy shows how he 3D printed a key from a simple photo:

http://3dprintboard.com/showthread.php?3397-I-3D-printed-my-house-key-from-a-photo

From the site:

Hello, I'am new here. I recently bought a replicator 2 and was trying to come up with something interesting things to print after i got tired of making jewelery and toys... I thought it would be cool to see if the resolution would allow me to make a working house key from a picture I took. After finally getting the cross section measured out correctly the tooth pattern was easy. I think I'm going to try a car key next but I'm a bit worried the PLA won't be strong enough. We'll see. here is a video of me making, and using it.
http://youtu.be/tKY3S1-EKZE

share|improve this answer
add comment

Nothing, but using a 3D printer for this is usually overkill. All you need is a camera phone, a printer, a Dremel, and of course a blank key:

https://www.youtube.com/watch?v=qpDJC4vK7O0

The 3D printing option might be more attractive for some of the nasty "do not copy" keys commercial landlords, universities, etc. like to use (where blanks are not readily available, or where cutting on the inside of the key would also be needed to make a working copy).

share|improve this answer
add comment

What's to stop it? Honor, as sense of morality, knowing the difference between right and wrong, respect for other people, and their property, and when that fails, a .357 Magnum and a bad attitude usually suffices. Locks were invented to keep honest people honest. The locks most people use in every day life are considered "privacy locks," i.e., if someone wanted in you couldn't stop them, and they won't need any "fancy-smancy" 3D printer.

share|improve this answer
4  
This is by far the most ridiculous answer I have seen the past 2 days. I like it but I aint upvoting this –  Nicholas Kyriakides May 21 at 11:34
1  
I can't resist to not upvote. Anyway it remains the lowest answer. –  Sarge Borsch May 21 at 16:53
add comment

What's to stop someone from 3D print cloning a key?

  • People without TV/Youtube: nothing at all (as pointed out in other answers/comments).
  • People with TV/Youtube: Cost...

Why waste money and effort, when your average basic bump key set is cheaper, re-usable and works for 80% of the locks? Just hope the target has expensive locks, then it works even better (this is a must see video).

Once you understand this principle, we can understand the 'big guns': the (lock-)pick-gun, as used by law enforcement.

  • Downside: a little bit more expensive and can't pick 360 degree round dimple locks,
  • upside: fits even more average locks becouse you don't need to pick the right bumpkey from your set.

PS: In the context of printing a key, think of a 2-sided, one-way-fit (none identical halves) dimple key:

Although these can be bumped too, sets are more rare and printing them from one photo wouldn't work since 4-sided and round models exist as well.

So the real problem/question at hand is:

  • a lock is intended as a time-consuming puzzle (the key is an instant solution).
  • yet in reality the vast majority of locks can be opened just as fast as with a key (without 007 hair-pin 'art').
  • as such we don't need to worry about printing a key (that type of lock already provided 0% time-delay/security); instead we need to worry about creating a lock that once again fulfills it's purpose of taking up time of an un-authorized person (something that clearly both law-enforcement and criminals won't like, what a contradiction haha.)
share|improve this answer
    
@Steven Volckaert: Good Edit, Thx –  GitaarLAB May 23 at 6:52
add comment

The best way to stop this from happening (aside from not giving someone key-schematics via an Instagram pic) is to have a key/lock solution with atypical features:

  1. Electronics inside the key that are mandatory - e.g. some car keys have a chip in them, such that the car needs both the physical key and the electronics to start.

  2. The lock requires the key to be a special material that isn't 3D printer friendly. Perhaps the lock requires the key to have specific electric conductivity, strength, light refractivity... just thinking off the top of my head here!

Basically some interactivity that can't be replicated with your standard 3D printer.

share|improve this answer
1  
Just to add to the top of your head: here in the UK we're soon going to start putting fluorescent micro-particles into our coins, currency-news.com/best-new-coin-innovation-2013-finalist-02. You'd think the same would in principle work for keys, provided that the detector is small enough to add to the lock. –  Steve Jessop May 22 at 18:35
    
How about designing a key with a sliding cover which would slide up the shaft of the key (and over the head) as the key was inserted into a lock? That shouldn't be hard, and it would seem to pretty well defend against these sorts of tricks. –  supercat May 23 at 2:19
add comment

Nothing at all, but a better question is how much does it really matter. Most (effectively all) consumer locks are useless. They can easily be bumped, picked or bypassed entirely (go through a window). Primarily, locks keep honest people honest, but don't do much for preventing criminals from being criminals.

If it was actually a photo of a key for an actual secure, multi-direction lock, then it might be more of a problem, though extracting the exact dimensions for such a key from a picture might be slightly non-trivial as it would involve having to make some guesses about shape and size since the photo is 2d and angles may vary.

Overall, I personally wouldn't be too worried if a picture of my key was posted somewhere. I wouldn't intentionally do it, but the chance of someone specifically finding the photo and using it to break in is pretty minimal. Posting when you are going to be on vacation is a FAR bigger security risk and most people don't think anything of that either.

share|improve this answer
add comment

The other answers at the time seem to assume that there exists nothing that could stop one from using a 3D printer to clone keys. This is false. 3D printers could implement a kind of DRM to detect that they are cloning a key and refuse to follow through.

The obvious approach of using techniques such as computer vision would mean false positives/negatives, but this can be overcome by mandating that all keys be manufactured in some manner that is guaranteed to be detectable (with a vanishingly small probability of failure), such as encoding high entropy (possibly digitally signed) data into the shape of the key.

Both the problem of certain 3D printers lacking the DRM and certain keys lacking detectable signatures encoded into them can be solved with sufficient government regulation, much in the way they solved lethal weapon control. Some states may not cooperate in implementing such regulations, but this can be overcome by import/export controls. The only remaining problem is then that an alien from one unregulated state sneak into a regulated one with a cloned key, but that will be a rare incident considering it's usually not worth it.

Another method would be to implement laws against owning a 3D printer that can print strong enough material to turn a lock. Then all they need to do is ensure locks being sold are heavy enough that legal 3D printers can't turn them.

However, I'm unaware of any 3D printers with such DRM or any regulations related to the aforementioned.

share|improve this answer
    
I personally think there is a big difference between DRM (stuff that's already 'tagged') and shape/function recognition. I also vividly remember a period in time where the majority of people refused to buy a DVD player without the region-free code (or factory/store 'fixed'), and that's the way life/future should be, especially when solving an imaginary problem. PS: good side-reading: en.wikipedia.org/wiki/EURion_constellation. Photoshop doesn't 'recognize' cash, it recognizes it's 'secret' tags. Youtube uses a pixel, but these are all forms of DRM. –  GitaarLAB May 23 at 6:44
4  
Not doable, Harold. Anyone can make a 3D printer. There is no way to regulate 'legal' and 'illegal' 3D printers. It's not even a hard problem - it is impossible. –  Rory Alsop May 23 at 8:33
    
"and that's the way life/future should be" That's your opinion. If its' illegal to make non-compliant printers there's nothing you can do about it. Please observe the phone market, where remote players have always been and are still able to capture all data on the device (as well as GPS, camera, microphone, etc), yet the market hasn't even been dented by the constant disclosure of these backdoors. –  Harold R. Eason May 23 at 16:11
    
@RoryAlsop why is it impossible? You just need to make the keys such that the printers required to clone them are too hard to build in secret (because too much capital is required to construct one). Say it's illegal to manufacture phones that don't have a backdoor that can be accessed only by the holder of a certain digital key. The amount of capital required (entire manufacturing plants and fabs) to create a phone that is guaranteed not to have the backdoor would be so massive that the government would notice it and send agents to arrest the operators. –  Harold R. Eason May 23 at 16:13
    
@Eason.. uhu.. yeah. great example with phones (twice).. NOT.. Think OpenMoko.. or DIY cellphone.. etc, etc, etc. The only advantage Big Bad Brother and well-funded criminals have at the moment is UEFI (something that will come to haunt us), but that is currently simply solved by just using (some clustered) older BIOS based computers, just like a lot of people are going back to a 'dumb but safe' phone. Besides, there was a time when 'region-free' was printed in bigger letters than 'brand-name DVD player' in almost every printed advert.. regardless of the manufacturer-lobbied 'law'. –  GitaarLAB May 23 at 22:01
show 8 more comments

protected by Rory Alsop May 23 at 21:03

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.