Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

229

it is possible to render a key fob useless by pressing the button at least 256 times while out of the range of the car. Not useless, but desynchronized. Any car will allow you to re-synchronize, and one example of a typical procedure is: Turn the ignition key on and off eight times in less than 10 seconds. This tells the security system in the car to ...


193

I would recommend setting it to 0000 or some other specified combination (doesn't really matter what). "Mashing around the dials" is a little vague, but I would guess based on my own behavior that people would tend to move most or all of the dials at once, which would create a strong correlation between the current combination and the lock combination. For ...


124

The simple answer is: nothing. This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being successfully used, both by locksmiths and criminals. A 3D printed key will do just as well, if strong enough, or it could be used to cast a key if necessary, or as ...


118

In theory zeroing or any predetermined sequence is more secure as you could, in theory make a guess at how far someone might move the dials. In practice this is probably a bit far fetched and anything with a combination lock probably has larger concerns eg the combination being known by too many people or the fact that any number between 1950 and 2018 ...


114

It's called anti-drill plate. With the anti-drill rotating plate, the drill bit won't be able to go through the cylinder. It's supposed to be in hardened steel and act as an other layer of security. When you drill a cylinder lock, you have to go with small drill bit first. You will then use bigger and bigger drill bit on the little hole you made. The plate ...


88

As the guys previously said, nothing! Even more, I've been working on such a project myself at the university! (albeit I don't say this as an official target, of course) I am trying to do duplicate a key from a single photo, with some assumptions to make it a realistic problem such as having a coin of a known size next to it for size calibration and ...


54

The answer to your question is yes, though whether this will ever actually help them is dependent on the lock and their 'skill'. With a typical (cylinder?) deadbolt repeated attempts can advance an impressioning attack with a key blank (see tylerl's answer for more detail), if using picking tools the extra visits will improve the feel for the lock and in ...


52

Yes, there's a classic attack that involves incremental access. The attacker starts out with a blank key that fits into the lock in question. The attacker approaches the door, puts the key in, jiggles the key a bit, grumbles something about how the office numbers changing, and leaves. Then in private he examines the impression pattern on the key. Where ...


51

More details here. High-end manufacturers use expensive challenge-response schemes (the key sends a request, the car answers with a challenge, and the key sends a reply derived from the challenge with some algorithm). Even so, such algorithms are proprietary, usually not reviewed, and could well be an example of "rolling your own crypto". There are ...


45

A typical rolling code fob from a decade ago which used a 64-bit payload would unlock if it received one code that was within 16 of what it was expecting, or two consecutive codes that were within 32768 of what it was expecting and adjacent to each other. Pushing the button 32768 times would cause a fob to become sufficiently desynchronized as to be useless,...


42

Absolutely nothing. On one occasion, a convicted killer in Australia actually duplicated a master key of his own prison cell just by looking at the physical keys carried by the guards. He successfully escaped from prison and was on the run for 12 days before being captured. So if a prisoner with only raw metal and a good memory can copy a key, I think ...


40

Here's some academic research on stealing keys from afar with a hi-resolution camera: Our SNEAKEY system correctly decoded the keys shown in the above image that was taken from the rooftop of a four floor building. The inlay shows the image that was used for decoding while the background provides a context for the extreme distances that our system can ...


38

What Deunis said, except it is not only an anti-drill plate. The fact that it rotates freely makes it anti-drill on top. Originally, these were an upgrade for existing lock cylinders which didn't have built-in protection against being pulled out, which became a popular method (the most popular?) of breaking in the 80s. Locks at that time didn't have the ...


34

It does not matter. A lock can provide three forms of protection: Delay an attacker from accessing a resource so that they can be interrupted and stopped Provide evidence of tampering Dissuade a would-be attacker from attempting an attack As discussed throughout answers and comments, it fails to do much in the way of delaying an attacker. The lock can be ...


33

As other answers say,nothing prevents them... however... As a locksmith I can tell you that some locks have tolerances that are measured in the thousandths of inches (tens or hundreds of micrometres), and getting a perfect match isn't always a guarantee. What would actually stop someone? The fact that picking a lock is easier, and quicker (in most cases) ...


33

As a general rule to remember: Don't make it to hard to use! If it's to hard to use and you keep forgetting, all you've done is shown that you need a different security method to make your door usable. Things mentioned in this post: Private/Public authentication (keys) UUID pre-authentication (fobs) MFA(specifically 2, fob and code gen) Things mentioned ...


30

You choice of lock matters a surprising amount. There exist locks which have not been defeated through "covert" mechanisms (picking, pick guns, etc.) in the open literature. Abloy's disc detainer locks, and one other type (I think it was a plastic lock from a subsidiary of Kaba?) are two such locks. Replacing the lock may be a suitable recourse, if you're ...


27

This guy shows how he 3D printed a key from a simple photo: http://3dprintboard.com/showthread.php?3397-I-3D-printed-my-house-key-from-a-photo From the site: Hello, I'am new here. I recently bought a replicator 2 and was trying to come up with something interesting things to print after i got tired of making jewelery and toys... I thought it would ...


23

Zero it out. Maybe more work, but you don't run the risks of rotating too little or rotating the same amount for multiple dials. An attacker would have very little to go on in either case, though... Most people wouldn't consider this. Actual real-world security between the two is probably about equal. They would just have nothing extra to go on if you zero ...


22

The problem with the attack as you're describing it is that it's glossing over a lot of details about how keyless entry and start systems work, and details about built-in backup systems, some of which have been covered in comments on the question and other answers. First, let's cover getting into the vehicle: In other words: could the attack described in ...


12

As a former locksmith, I can provide a qualified "no" for you. It is not possible to incrementally pick a lock, especially if it is a standard pin-tumbler variety deadbolt (Kwikset, Schlage, Baldwin, etc.). One thing you can do to assure that the lock is 'reset' is to stick the key in it, then removed it - turning it isn't necessary. This will force any ...


11

There are a few things to take into account when answering this question. If you are looking for a statistical answer, then "spinning" the dials a specific number of times randomly forward and backward. (I don't have the count as that would be a calculation I don't have with me. It's like a required number of shuffles in Vegas to be considered random.) If ...


9

This is a very interesting question, I've come across this when a client was designing a fire-code-compliant office space. The client's work was related to the defence industry and the office space had two rooms with highly classified contents. Now, of course, if you're a 3-letter government agency, you can disregard whatever laws you want, but let's assume ...


9

Nothing, but using a 3D printer for this is usually overkill. All you need is a camera phone, a printer, a Dremel, and of course a blank key: https://www.youtube.com/watch?v=qpDJC4vK7O0 The 3D printing option might be more attractive for some of the nasty "do not copy" keys commercial landlords, universities, etc. like to use (where blanks are not readily ...


8

What's to stop someone from 3D print cloning a key? People without TV/Youtube: nothing at all (as pointed out in other answers/comments). People with TV/Youtube: Cost... Why waste money and effort, when your average basic bump key set is cheaper, re-usable and works for 80% of the locks? Just hope the target has expensive locks, then it works ...


7

What's to stop it? Honor, as sense of morality, knowing the difference between right and wrong, respect for other people, and their property, and when that fails, a .357 Magnum and a bad attitude usually suffices. Locks were invented to keep honest people honest. The locks most people use in every day life are considered "privacy locks," i.e., if someone ...


7

There are cars with PIN codes (which must usually be entered in addition to using the car key). I have seen several. However, users forget PIN codes, then become irate; that's bad for business. Users also keep forgetting where they last put their car keys, but, for some psychological reason (probably related to the fact that keys are tangible objects), users ...


6

Conceptual view: there is authentication, and there is authorization; these are distinct activities. Authentication is about making sure of who you are talking to; authorization is about deciding what some individual is allowed to do. You actually want to keep them separate. RFID tags implement authentication: through the electronic conversation between the ...


6

To add an extra level of security, either use both directions equally for zeroing or always rotate all to a single direction, to leave equal amount of fingerprints. People tend to pick a number once and memorize it. The path from zero to (or near) the correct combination might get revealed in UV light. I think that's even easier than guessing whether a non-...


5

Your deadbolt's security does not seem nearly as important as the lack of monitoring on the door. Even the most braindead criminal will eventually realise the value of a bolt cutter, at which point the whole discussion becomes moot. If a particular layer of your security (usually the outer-most) is vulnerable when you can't afford for it to be you have two ...


Only top voted, non community-wiki answers of a minimum length are eligible