Slashdot Mirror
Smartphone App To Be Used As Hotel Room Keys
An anonymous reader writes Starwood Hotels and Resorts has became the first chain to let guests unlock doors with their phones at 10 Aloft, Element and W hotels. They hope to expand the program to 140 more properties in those brands by the middle of next year. From the article: "The technology's developer says that it uses its own encrypted secure channel to ensure thieves cannot abuse the innovation. But one expert had reservations. "Nothing is 100% secure, and once this technology is in widespread use it will make a very tasty target for hackers," said Prof Alan Woodward from the University of Surrey's department of computing.
"can be" is the keyword there... Seeing how easily previous systems were compromised this doesn't have much promise behind it.
It's using it's own, encrypted, secure channel that happens to be accessible from my phone.
So it's handled by NFC, Bluetooth, Wifi, the cell radio, the speakers, or the display, in that order of likelihood.
The communication channel is the least of their worries, however. With only a little bit of effort, these can all be implemented more securely than magstrip cards.
The problem is that it'll all be accessible by an internet-connected PC at the front desk, allowing a remote (or local) attacker to create a master key on their phone, no magstripe hardware needed.
"I'll put my phone on charge. Oh dear the charger is in my hotel room".
You just know how this will end.
It's secure, trust us ... and you'll also have to trust we won't abuse the access to your phone for our own purposes.
Yeah, sorry, no ... no interest in installing an app for something like this. Give me an old school key card.
Other than saying "ZOMG, teh smart phone opens teh hotel door" ... I really don't see the point. And I really don't see why we'd trust them.
Lost at C:>. Found at C.
This is the potential future of convenience. With NFC and actual secure chips, you should be able to use your phone for ID verification, boarding passes, purchases, hotel rentals, rental car "keys", and everything else you need.
Properly implemented, it would have as much or more security than just about every other common form used for any of the areas above. Of course, we all know they're going to fumble the security part, so hopefully it won't be any worse that what we already have.
Is it just my observation, or are there way too many stupid people in the world?
I was at a hotel chain about 10 years ago that was using magstripe cards for room entry. Checked in, walked up to my room, swiped my card, and got no green light. Tried it again, no light. Just out of curiosity, I tried the handle and the door opened. Called down to the front desk to let them know my card wasn't working right, and they sent a maintenance guy up to fix it. The fix, a torx screwdriver and 4 AA batteries. When the batteries went dead, the door defaulted to open. With insecurity by default, what's to stop someone from walking up to a door with a small power screwdriver, pulling a battery, and walking into your room in about the same time as it takes you to swipe a card and get in?
Unless all guests are expected to have smartphones as a requirement of occupancy, I imagine you'll get plain old room keys too.
You sound insane
I could be less convenient in many ways though. For one thing, this means that I have to bring my phone with me when I go to the pool or the gym. Also, I don't think that the current cards are that expensive to replace. If they were, they could just charge the client for unreturned or lost cards, same as if other things in the room go missing.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Hotel door app requires access to contacts, shared files, camera, microphone, GPS, SMS, internet, dropbox, google drive, online banking, ....
At that point it's pretty much just a novelty. If I have to carry the key-card as a backup anyway (which would be smart) I'd rather just have an RFID enabled card and wave my wallet in front of the lock. If I have the card there is no security bonus form the more programmable phone since the card has to work also.
Although having redundancy on your person does have its benefits if you did happen to lose one or the other while out and about.
With an active CPU behind it, certainly this system can be more secure than the current card system.
Which means little unless they disable the old system. Much like changing the design of currency to thwart counterfeiters is worthless unless you devalue bills with the old design. The chain of security is only as strong as its weakest link.