News for hackers. Stuff that matters.
Re:The App I Used to Break Into My Neighbor’s Home by superuser2 on Saturday July 26, 2014 @11:16PM (#8091831)
Like magnetic stripe credit cards, keys need to die. The security model is broken for the same reason - anyone who handles or even looks at the token has free reign on whatever is protected by the secret. The secret should instead remain encapsulated, used only to sign encrypted, replay-attack-proof authorizations.

It's 2014. Smart cards need to be everywhere. Even my college dorm had contactless smart card authentication.

Keys still have a place for manual override in outages, but that should be rare and set off alarms.

Re:The App I Used to Break Into My Neighbor’s Home by PeterisP on Sunday July 27, 2014 @06:29AM (#8092410)
Just like imperfect passwords, keys have a valid place in the security models.

Security is always a tradeoff, and there are many usecases where a huge increase in security isn't worth even a tiny increase in accessibility or cost.

Let's take an example of cheap padlock on a garden shed or a lock on a filing cabinet. Both of them are trivially broken, either by skill or simply brute force. Yet, they achieve their security goal - they do prevent (as in, significantly reduce frequency) random passers-by from taking the stuff inside. A more secure model, such as smart cards, would be an inferior choice there due to increased cost and decreased usability.

For example, a secure system would require to make it harder for a random person to make copies of the key/token/whatever. An accessible system would require to actually make it easier - so that any keyholders can easily make copies without authorization from 'key owner' that takes some time and effort. For example, if a renter needs to involve the landlord to copy his key if one of them was lost, then it's more secure but less usable. "Easily copied" is a bug or a feature only depending on the system needs.

Re:The App I Used to Break Into My Neighbor’s Home by brewdad on Sunday July 27, 2014 @12:14AM (#8091949)
I agree about the smart cards. My college had chipped id cards (like modern non-USA credit cards) in 1992!

I just stayed at a hotel in New York with smart card locks. It was so nice to be able to just hold my wallet against the door rather than pull the card out of my wallet and try to remember which way the magstripe goes, etc.

The reader on the elevator was placed low enough that I just needed to stand within a few inches of it to "unlock" my floor.

Re:The App I Used to Break Into My Neighbor’s Home by dublinben on Sunday July 27, 2014 @12:57AM (#8092039)
Do keep in mind that hotel doors are anything but secure, regardless of the kind of lock. It doesn't even take a sophisticated exploit to unlock the door, just a simple metal gadget.

http://shop.riftrecon.com/products/under-the-door-tool

Re:The App I Used to Break Into My Neighbor’s Home by adestefan on Sunday July 27, 2014 @08:11AM (#8092548)
If keys are such a threat, then the sidelight next to my front door lock is a gaping security hole. Keys are nothing more than an annoying deterrent.