Slashdot Mirror
Smartphone App To Be Used As Hotel Room Keys
An anonymous reader writes Starwood Hotels and Resorts has became the first chain to let guests unlock doors with their phones at 10 Aloft, Element and W hotels. They hope to expand the program to 140 more properties in those brands by the middle of next year. From the article: "The technology's developer says that it uses its own encrypted secure channel to ensure thieves cannot abuse the innovation. But one expert had reservations. "Nothing is 100% secure, and once this technology is in widespread use it will make a very tasty target for hackers," said Prof Alan Woodward from the University of Surrey's department of computing.
With an active CPU behind it, certainly this system can be more secure than the current card system. Also means much less chance of leaving the card in the room and less money spent replacing lost cards.
I was at a Starwood hotel two weeks ago and I was not offered such an opportunity.
I feel robbed.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
It's using it's own, encrypted, secure channel that happens to be accessible from my phone.
So it's handled by NFC, Bluetooth, Wifi, the cell radio, the speakers, or the display, in that order of likelihood.
The communication channel is the least of their worries, however. With only a little bit of effort, these can all be implemented more securely than magstrip cards.
The problem is that it'll all be accessible by an internet-connected PC at the front desk, allowing a remote (or local) attacker to create a master key on their phone, no magstripe hardware needed.
An app can hardly be less secure than the current system. Knowing the target's name and room number is all it takes to "hack" most hotel locks - just ask the front desk clerk to make you a new key!
0 1 - just my two bits
"I'll put my phone on charge. Oh dear the charger is in my hotel room".
You just know how this will end.
It's secure, trust us ... and you'll also have to trust we won't abuse the access to your phone for our own purposes.
Yeah, sorry, no ... no interest in installing an app for something like this. Give me an old school key card.
Other than saying "ZOMG, teh smart phone opens teh hotel door" ... I really don't see the point. And I really don't see why we'd trust them.
Lost at C:>. Found at C.
It doesn't matter. The current card security system is as about as insecure as it could possibly get and still have a door in the frame.
After an incident at a hotel a few years ago where our door lock failed and ruined our stay... and a subsequent discussion with their maintenance man about how the card systems work I had a suspicion and tried my card on the room across the hall. Low and behold my card would work on any room in the building. Since then I've made a habit of testing my card on random, seemingly vacant rooms at other hotels. To my surprise I've had it actually work several times.
Now I deadbolt it when I'm in the room, and don't leaving anything valuable in there at all. I even keep my suitcase in the trunk when I leave if I have my car there. The hotel I had my honeymoon in didn't have a deadbolt or chain. Sure enough, the morning after our wedding cleanign tried to come in. Lucky for me I'm super paranoid so she just ended up slamming the door into the mini-fridge I'd slid in front of the door the previous night. Before I even had my pants on she was down there with their security manager trying to force the door open. I yelled "Go talk to the front desk before you break into my room morons" before forcing the door shut with my foot and holding it. They weren't happy. I now carry a wedge shaped piece of oak with me to any hotel.
This is the potential future of convenience. With NFC and actual secure chips, you should be able to use your phone for ID verification, boarding passes, purchases, hotel rentals, rental car "keys", and everything else you need.
Properly implemented, it would have as much or more security than just about every other common form used for any of the areas above. Of course, we all know they're going to fumble the security part, so hopefully it won't be any worse that what we already have.
Is it just my observation, or are there way too many stupid people in the world?
I was at a hotel chain about 10 years ago that was using magstripe cards for room entry. Checked in, walked up to my room, swiped my card, and got no green light. Tried it again, no light. Just out of curiosity, I tried the handle and the door opened. Called down to the front desk to let them know my card wasn't working right, and they sent a maintenance guy up to fix it. The fix, a torx screwdriver and 4 AA batteries. When the batteries went dead, the door defaulted to open. With insecurity by default, what's to stop someone from walking up to a door with a small power screwdriver, pulling a battery, and walking into your room in about the same time as it takes you to swipe a card and get in?
Shows how much you know about locks and chains.
</locksmith>
With my first mobile phone, I could beat down the door on a bank vault. Hotel doors wouldn't stand a chance.
Modest doubt is called the beacon of the wise. - William Shakespeare
You sound insane
Can someone in the room next to mine wirelessly hack my door?
Any good locksmith will tell you that the best a lock can do is increase the amount of time it takes someone to break in -- it can't prevent the break in. But a person attempting to pick a lock in a hallway is a lot more conspicuous than a transmitter hidden next door.
I don't have a smartphone, by choice.
Seriously, though. Doing everything with that easily lost/stolen/dead battery phone just sounds like a bad idea to me. Monoculture, anyone?
Nothing will end well... Entropy always increases as energy runs down hill, eventually, there will be nothing left.
Your point was?
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Hotel door app requires access to contacts, shared files, camera, microphone, GPS, SMS, internet, dropbox, google drive, online banking, ....
The current system is sufficient to purpose, but few people know how it works. Here is how: The lock stores a list of 10,000 keycodes in random order. The front desk has the same list. At installation (or reset) the lock will open for any of the first couple of codes on the list. Once a code is used, any code earlier on the list is no longer valid but the next few become valid. This way the front desk can issue a new code that will be accepted, without communicating with the lock itself. My own view is that if the new system allows one-hend entry, that is a big win.
He does... you should probably buy a gun to protect yourself.
"If any question why we died, Tell them because our fathers lied."
I call bullshit. Magstripe cards aren't easily wiped. You really have to use power to wipe them. A phone ain't gonna cut it. The static electricity from your hand is more likely but under normal circumstances that isn't going to do anything either. Just put the card away when you're playing with VandeGraaf generators or Tesla coils.
You can call bullshit all you want... but I've done it dozens of times. If you want to reproduce it, just drop your card key in the same pocket as your phone and leave it there for a few hours. When you get back to your room, your card key won't work.
The reason this happens with card keys is because they have low coercivity magstripes, which makes them easy to rewrite. This is good because they get rewritten regularly. Your credit cards use high coercivity stripes and aren't nearly as vulnerable.
http://en.wikipedia.org/wiki/Magnetic_stripe_card#Magnetic_stripe_coercivity
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.