Slashdot Mirror
Robotic Kiosk Stores Digital Copies of Physical Keys
An anonymous reader writes "The New York Daily News reports that a startup company in Manhattan is putting robotic key copying machines in 7-Eleven stores. The machines can automatically create physical copies of common apartment and office keys. What's more interesting is that they allow users to save digital copies of their keys, which can later be created when the original is lost or the user is locked out of their home."
May as well just get rid of physical keys altogether.
Could this be the first case of public key encryption getting broken?
Great, just what I wanted, someone I don't know to have copies of my keys. What could possibly go wrong?
speaks for itself ....
No, but the "robotic key copying machine" is.
Sexy time.
Copy of physical key's bitting dimensions + address info from a credit card. A remote intruder could download that, then sell lists of those to local gangs wanting some easy prey for home invasions.
Of course, there is the fact that if you want to buy a bump-resistant lock [1], it won't be something a key copying kiosk can copy easily.
[1]: I'm partial to Abloy's Protec2 Cliq line because it has the top tier mechanical pick resistance in addition to an electronic lock. Makes life easier to reprogram the lock to deny access just to the single lost key than have to rekey the lock and hand out new keys.
I really hope they don't make you register with your address. Losing that database would be terrifically bad.
There's no technical reason why the kiosk system needs to "know" or store the physical location of the locks that match the keys. Create an account and pay with cash and there's no reason to enter any personally identifying information.
I think charging $20 for an emergency key is a kick in the nuts, tho. They're only charging $3.50 for a standard copy of a key you have in-hand so why are they being dicks about the price of printing a key you've stored? Well, obviously, the reason is, "Because they can." But it's still a dick move.
Also, I hope they've got some sort of approval method where a human looks at a picture of the key to see if it's marked "do not duplicate" before a copy is made. That's something I wouldn't trust to OCR.
Now we can't even trust the babysitter to grab a Slurpee down the street...
I can only see this inspiring people with shifty morals to try something new because it's now more convenient. Good thing car keys are more complex these days.
"The only legitimate use of a computer is to play games." - Eugene Jarvis
Could you imagine the security consequences? Especially if they're dumb enough to store the address of the user on there as part of an account. A hacker could make themself a wonderful little hit keyring for a skilled accomplice. The neighbors probably won't suspect anything if they see a guy going in casually with the key.
This should be good. How much is Achmed going to charge Tre to scout out targets and print a key?
They do cheap ass shit like put only 3 of the 5 possible tumblers in them. The key still has 5 cuts for 5 potential tumblers, but they only use 3 of the 5.
The lock companies only use so many potential combinations anyway.
I'm betting they won't be able to reproduce a 7 tumbler Best key with the "do not duplicate" stamped on it.
What could _possibly_ go wrong? The vending machine and convenience store industries are totally beyond reproach.
Copy of physical key's bitting dimensions + address info from a credit card. A remote intruder could download that, then sell lists of those to local gangs wanting some easy prey for home invasions.
Breaking into most physical locations is trivial for a motivated intruder, no matter how sophisticated your lock is. Anyone who would bother hacking or paying for this info, and then using it to create a duplicate key is sufficiently motivated to break in via less arcane methods. "Local gangs" will simply force open the door or gain access by some other entry.
A fancy lock is only useful if you are afraid of people entering a premises without leaving evidence of their entry. Even then, you better have more security measures in place, most of which obviate the need for the lock anyway. Heck, you might be better off with no lock so that your nemesis might be enticed to expose themselves to your motion-detection/surveillance systems.
I Am A LockSmith. The fastest and easiest way to get a bump resistant lock is add one or two tried and tested bump resistant pins. The variety Masterlock came up with does not work. T-pins work well. Dramatically different spring strengths or top pin weights will stop bumping. All three of those methods cost pennies.
As for the Abloy's of the world, well- they have a problem. Great fun for picking enthusiasts. A good way to kill free time. As for opening them- it takes less time than a Schlage with some spools:
http://www.youtube.com/watch?v=uj4myR2XlWc
This is what professionals use. There really is nothing short of a vault door that cannot be opened in seconds. Personally, if you are willing to put the money into a Protec2, you really should consider putting ballistic film on your windows and replacing your door frames with steel. They are on the same level. You can't just increase the strength of one link on a chain and call it good.
This is nothing you can't do with a camera phone, a decent-angle shot of the victim's key, some trivial math, and a 3D printer. Of course I just said "3D printer" to be trendy. It works just as well with a 2D printer, cutting out the image, laying it on top of a blank key as a pattern, and taking a Dremel to it.
That's what my roommates did at the house I live at. Keyless entry via numeric pad attached to a battery-powered* dead bolt. Simple, convenient, and no less secure than physical keys. It just replaces "something I have" with "something I know," and it isn't vulnerable to bump-keys or lock-picking tools.
*Lasts for months and gives plenty of warning before it goes out, so no worries there.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
What happens if the government gets a tie-in to this database like they have in the phone/interne companies?
"It's just for national security," says the naked guy you find sitting in your bathroom reading your newspaper.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
I dont even let my mechanic have my house keys when i take my car in for repair. I always take the car key off and just give them that. No way in hell im going to trust a kiosk.
Good-bye
Just an FYI: Walmart has key-making machines. I lost one of the keys to my building's main gate (but I still had my second copy). Even though these keys have "Do Not Duplicate" stamped on it, I went ahead and made myself an extra key. It was no problem at all. Now I have a duplicate key, and the new key doesn't even have "do not duplicate" stamped on it.
You still have your own, so what's it to you? No harm, no foul.
Really? TFA describes this as a Manhattan-based initiative, so I'm guessing that he's using the term New York City to refer to Manhattan, not Greater New York (all five boroughs). There are 1.6 million people in Manhattan. I don't believe the average person locks themselves out twice per year. Even if he does mean all five boroughs, that still means that one-third of the city locks themselves out each year. I have a very hard time believing this.
Also, virtually all Manhattan residents live in apartment buildings, so they need to get though two locked doors; the front door to the building and the door to their actual apartment. Pretty much all buildings use a lock/key that can't be (easily) copied (Mul-T-Lock or similar) for the front door, so unless you're going to break into your own lobby, you're still up the creek. And if you live in a building with a doorman or live-in superintendent, they frequently have access to a copy of your key.
I don't see this catching on in a big way.
Do you troll craigslist looking for op-airs that have felony convictions? If you've left the sitter at home with your kids she will just snag the jewelry while the kids sleep. Or more likely her scuz boyfriend will steal pills. If your sitter can read the key after only a few seconds you need to use a different criteria for looking for child care providers
Seriously, why go through the hassle of hacking a system, just use a bump key. If you hacked into the system, you'd have to make sure to remove your tracks. Bump key would be easier, duh!
And just for clarification, picking a dead-bolt by a complete novice that had never done it before took all of 2min.
It is a skill like any other, the basics are easy and can often be fumbled through. The unskilled cannot tell the difference between a talented novice and an expert. Belittling other skills is a shameful practice in the slashdot community. It is that same attitude that has caused many of us to have our careers abruptly end when we hit 40.
Here is a computer analogy of what you posted above:
I used to think hacking is hard. Then I tried to do it myself. Just hacked a program that printed "Hello World" on a computer! Hacking a program by a complete novice that had never done it before took all of 2min.
Billions of Zuckerbucks here I come!
Would you trust 7-Eleven with a copy of your key? I wouldn't. But I might put a copy in my wallet.
I wonder - does providing a third party with a digital copy of your key remove the "expectation of privacy" for law enforcement in the same way as using a digital messaging service (ie, email) does?
That is, I wonder if this will open the doorway to police in the US saying "Oh, well the defendant left their key readout with this company, which as a third party destroys their expectation of privacy to their locks, therefore we had the right to subpoena the key and then search the premises it unlocks".