1

Obligatory disclosure I have no relation to the Everykey company and do not mean to promote them in any way.

I came across the product Everykey that claims to be "your only key" by allowing you to unlock all your access-controlled devices when you're nearby including car/house door, phone, even logging you into websites. While this sounds cool it also instantly raises many red flags for security.

Their website does a good job of addressing this by explaining they use AES 128-bit encryption to prevent password cracking and eavesdropping

Everykey utilizes AES 128-bit encryption, the same encryption that's used by the military to protect documents with confidential and secret security levels.

it uses a pseudorandom algorithm when sending signals to prevent replay attacks and spoofing

Each time Everykey broadcasts an encrypted Bluetooth 4.0 message, it is different from the previous message, preventing a hacker from sniffing a message and re-broadcasting it.

and the passwords are only stored on the devices themselves and only the device can decrypt the received signal.

Your Everykey broadcasts encrypted information to identify itself, which only your devices are able to decrypt

But how safe is this really? It seems to sound like a garage door opener with better encryption, is that good enough to prevent attacks? Aside from the obvious issue of if you lose the physical device whoever finds it has access to everything.

closed as primarily opinion-based by RoraΖ, Neil Smithline, Ohnana, Rory Alsop Jun 4 '16 at 23:19

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I'm voting to close this question as off-topic because I believe this is a question only Everykey can answer. There is not enough public information to give a complete factual answer. – RoraΖ Jun 3 '16 at 14:52
  • 3
    I disagree with the above. Just because we don't know anything about the company, doesn't mean we cannot take apart the provided information to show that the device does, or does not protect us. The below answer does just that. – XaolingBao Jun 3 '16 at 15:41
  • @lasagna The question is not asking us to make statements about the marketing literature. It is asking "how safe is this really?" We cannot answer that – Neil Smithline Jun 3 '16 at 20:21
  • The question asks "is it really secure," and the quickest way to know is by the security information they provide to the consumer. If they tell you they are using such and such security procedures (which they apparently do) and the security community knows that isn't secure, than an answer can be formed that it is NOT secure; however it is MUCH harder to say something is actually "safe/secure," than not, unless you have the source in front of you, and know everything when it comes to exploits/vulnerabilities. Do we know for sure? No, but any application is uncertain, with security. – XaolingBao Jun 3 '16 at 22:42
0

First of all, I have no access to real technical specs, I just know what the site (and the question) is saying. (The site has a specs section, but it's completey useless. It's just stuff like which OS are supported).

But how safe is this really?

Judging from the available information, not at all.

Some reasons, in no particular order:

As you said, one key for everything is a huge red flag. Would you want a key that locks both your house and car, gives access to your bank account, and is enough authentication for a divorce? Probably not.

the same encryption that's used by the military

This (haha) is a 1000%-sure sign that they just want money, not security.

No real, detailled description of the security scheme available: No one can check if the employees made some error, or if it is really secure. Since humans are not perfect ... History shows that many "closed-source" security stuff gets cracked pretty easily. A secure algorithm can be called secure after people knowing how it works tried to crack it, and failed, that's one of the most important and basic rules in cryptography. Also see Kerckhoffs law on Wikipedia.

AES128 is the weakest AES variant, that's no reason to boast with it.
(And without more information, even the storngest AES variant could be bad).

Using AES to prevent password cracking means that there is a key. What prevents key cracking? And why do the use a reversible algorithm to prevent password cracking at all? While there could be a reason, it sounds more like an beginner-level error.

Bluetooth has some security risks itself.

Each time Everykey broadcasts an encrypted Bluetooth 4.0 message, it is different from the previous message, preventing a hacker from sniffing a message and re-broadcasting it.

Just introducing some difference in each message does not prevent anything.
This statement is just nonsense.

Your Everykey broadcasts encrypted information to identify itself, which only your devices are able to decrypt

So all devices have the key (AES is symmetric). An attacker doesn't even need to steal your bluetooth dongle, control over any bluetooth-y thing in your house is enough.

  • 3
    While I agree with parts of your answer, much of it could use some references and seems highly opinionated. "Even the strongest AES variant could be bad" Could you explain? I'm not sure why stating a fact like "uses the same encryption as the military" (which is true) means they're out for money. Your last statement is just wrong. It's more than possible that it's broadcasting a public key with which it stores the private key on the device. "Any bluetoothy thing" is not necessarily enough. – RoraΖ Jun 3 '16 at 11:49
  • @RoraΖ With And without more information, even the storngest AES variant could be bad I mean things like ECB block mode etc.etc. (I've seen that in practice already, from people who should know better). About the broadcasting part: As I wrote at the top, I know only what they're telling us. They say much about AES, but a public/private key system is nowhere mentioned. – deviantfan Jun 3 '16 at 14:39
  • And about the military part: Yes, this is opinionated. But still, have you ever seen serious security from people talking like that? – deviantfan Jun 3 '16 at 14:42
  • @deviantfan Yeah, that's very clearly marketing BS which tells us nothing about the actual security of the system, but keep in mind it's very likely the contents of that page were written in an attempt to explain things to non-technical users. Without more details we can't really say anything about the security of this system one way or the other. – Ajedi32 Jun 3 '16 at 19:35
  • Apparently, the have no problem talking about AES, so... if they start throwing AES at non-technicals, adding another algorithm (if they have any) won't hurt. – deviantfan Jun 5 '16 at 9:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.