Slashdot Mirror


User: Dun+Malg

Dun+Malg's activity in the archive.

Stories
0
Comments
6,746
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 6,746

  1. Re:Is this surprising? on Shrinky Dinks As a Threat To National Security · · Score: 2, Interesting

    It would be trivial to extend the car key method by...adding a capacitor whose value must be matched, and so on.

    Nah, that's a dead end. GM did that already years ago with their VATS keys, only with a resistor (more reliable than a capacitor). Big pain in the ass, for very little additional security. Sealed transponder modules have completely superseded them, as they provide greater variation (unique IDs vs. only 15 resistance values), they can't be read with a $2 multi-meter, and they aren't dependent on flaky physical contacts to be read.

  2. Re:Not news... on Shrinky Dinks As a Threat To National Security · · Score: 1

    (RFID in the keys? A second key? A dongle?)

    One or more very well trained groups of men with guns, watching the place 24 hours a day?

  3. Re:Getting the key picture, is the key to success on Shrinky Dinks As a Threat To National Security · · Score: 1

    What makes you think that they have no backup security? Even the Slashdot article did not imply that Medeco locks were all that protected the Whitehouse and the Pentagon.

    The title:

    "Shrinky Dinks As a Threat To National Security"

    I'm pretty sure the implication is there.

  4. Re:Getting the key picture, is the key to success on Shrinky Dinks As a Threat To National Security · · Score: 1

    Which brings us back to the FA. We're not talking about a $10 lock from the hardware store here, these are "high security" locks that are supposed to have keys that cannot ever be copied unless you have the original key codes that were used to key the lock.

    Actually, the way Medeco key s work is that you get a plastic card with the key which allows a locksmith to look up in a book how to pin the lock to match. In order to get more keys, the owner presents the card, the locksmith imprints the number on a carbon slip (just like old timey credit card charge slips), the owner signs, and the original is sent in to Medeco who then makes the keys and drops 'em in a Fedex envelope. Two days later, the owner picks up the keys from the locksmith.

    Medeco never claimed to have keys that "cannot ever be copied". Their selling point has always been "patented key control". All that means is that all purchased keys come from Medeco--- you can't go down to the local Home Depot and have them run off a few using cheap and readily available knock off blanks from China, as is the case with most Schlage and Kwikset residential locks. Only a fool would claim to have created an "uncopyable" mechanical key, as a few minutes with a piece of brass stock and a milling machine will get you a functionally identical item.

    Seeing this article, I think it'd be funny to cut a working "key" from the plastic card that you use to order Medeco keys...

  5. Re:3-d printers? on Shrinky Dinks As a Threat To National Security · · Score: 1

    The hardest thing about coping those Medeco keys was the difficulty in cutting the angles and the proper spacing.

    That wouldn't be tough at all if you have a couple of fine-tooth files and a decent bench vise.

    -jcr

    No doubt! Heck, I've made many a working car key standing under a street light with only Vise-Grip pliers and a pippin file. Locksmithing 101, that kind of thing is.

  6. Re:Is this surprising? on Shrinky Dinks As a Threat To National Security · · Score: 4, Informative

    It should be noted that one of the major selling points of the Medeco locks is that, through some mixture of technological and legal means, Medeco is quite aggressive about restricting access to key duplication blanks.

    Of course, their aggressive protection of their patented key blanks is about marketing more than anything else. They are the sole legal supplier of keys to their locks*, so they therefore reap profit every time someone needs another key. The only selling point of their high priced and inconvenient to procure patented keys is the natural control this restricted access creates. They've managed to sell this access with very slick marketing which conveniently glosses over many important security issues. But then again, their business is only to sell locks, and they do it very well. The mechanical quality of their stuff is high as well, so you at least get a quality product for the price.

    * You can buy 3rd party blanks now for the old Sky, Air, and the newer Biaxial keyways. They're always looking for one more mechanical "kink" to add to the system to justify the next patent. Skay and Air were patented on the strength of the rotating pin concept. Biaxial was patented via making the cuts staggered either for or aft on the key. The latest M3 is patented on a step on the blank that pushes a silly little "anti pick" pin near the back. Seems to me they're running out of ideas.

  7. Re:Is this surprising? on Shrinky Dinks As a Threat To National Security · · Score: 4, Informative

    Most modern keypad locks like what you're thinking of actually randomize the layout of the keypad. So looking for the more worn keys is an exercise in futility.

    There are very few manufacturers of those kind of keypads. The vast majority of the keypads installed are fixed and suffer from the "dirty keys" exploit. The "scramble pad" keypads are 4-5 times the price, and very few people outside of defense contractors spec that sort of thing. I've only ever seen one, and I've installed and serviced hundreds of keypad entry systems.

  8. Re:I wish Abloy PROTEC locks made it to the US soo on Shrinky Dinks As a Threat To National Security · · Score: 4, Insightful

    I don't know about Medeco 3, but one lock mechanism that was out in other countries for almost four years before making it to the US which is quite pick resistant is Abloy's PROTEC cylinder.

    Trouble with those is that they're ONLY pick resistant. I can drill the face of an Abloy disc-tumbler lock, remove the sidebar, and fill the drilled hole such that no one will notice--- all in a matter of minutes. After that, the old key will still work... and so will a screwdriver. The laundry machines at the apartment I lived in years ago had Abloy PROTEC locks. I never paid for laundry, and no one ever knew the difference.

    Of course, if you want the best in anti pick protection, purchase either an Abloy or Mul-T-Lock Cliq lock. It has a pick resistant mechanical key, as well as a small chip and solenoid with a challenge/response system. If someone does make a key impression, it won't help much. However, for $500 a cylinder, its pricy.

    That's just electronic access control shrunk down to fit the size of standard key access components and hybridized with mechanical keys. Great if you want to retrofit existing mortise and rim lock installations, but then you're just trading labor cost for material cost. I'd personally go for a keyless prox card system before I'd field a system powered by batteries in the key. It's bad enough dealing with your average dodo trying to use normal locks. Can you imagine the service calls from those dodos who break their keys off because the battery in the key head is dead? Locksmith's dream (service call = money in your pocket), businessman's nightmare (service call = money down the rathole).

    I don't understand why people fixate on "pickability". Criminals just don't pick locks. I've been a locksmith since 1995 (minus a couple years when the Army decided I should be in Afghanistan), and I have never seen a case of intrusion that wasn't either a) forced entry, or b) an inside job.

  9. Re:BFD on Shrinky Dinks As a Threat To National Security · · Score: 2, Interesting

    Joe Crook can cut a Medeco bitting key out of an old grocery store coupon card and bypass the sidebar and slider in a few seconds without any need for a key machine or any particular skill. That's what the exploit is all about.

    It requires skill, just not much. Did I say dremeling a brass blank and cutting with a Blitz requires much skill? If you don't know the operating principles of a Medeco lock, you can't do it, but that's not saying much. The only difference is that it can be done with an X-acto knife instead of an expensive key machine.

    p.s. the sidebar isn't "bypassed", the key is cut to pass it in the normal way. The slider is a silly gimmick to give them something to patent, as the patent on Biaxial blanks has run out and 3rd parties are now cranking out Biaxial blanks for whoever wants them.

  10. Re:Not news... on Shrinky Dinks As a Threat To National Security · · Score: 1

    Ugh, you can't copy Medico keys in metal without access to the special blanks.

    Nonsense. Medeco key blanks, you just can't buy them from a key blank manufacturer, that's all. Any locksmith with skill in the art can make a usable Medeco blank without much difficulty. I've done it myself. I ran off a dozen unauthorized copies of a G3 Biaxial padlock key for the local station fire chief after he couldn't get his bosses to get hem more than the ONE they issued. Putting longitudinal grooves in a piece of brass isn't rocket science.

  11. Re:the actual threath on Shrinky Dinks As a Threat To National Security · · Score: 1

    Digital cameras and printers are the real threats. If they didn't have digital cameras they would have to take the film to Wall-Mart to get it developed and the photo lab techs will notify law enforcement if they see somebody with pictures of Medeco keys.

    Please. Unless the keys were being held by naked kids, the film techs at Wal-Mart couldn't give two shits.

  12. BFD on Shrinky Dinks As a Threat To National Security · · Score: 5, Interesting

    Shrinky dinks? Paper clips? Gimme a break. I can duplicate a Medeco key blank with a piece of brass stock and a dremel tool, then cut a perfect key from a photocopy using my HPC Blitz. There's nothing amazing about what this guy's done. Given the appropriate information (cut depths and angles) any medeco key can be duplicated without serious difficulty. Heck, that's the case with all mechanical key locks. I once showed the Medeco rep who came to my lock shop how I could duplicate a standard G3 Biaxial key using a slightly modified commonly available Rolls Royce key blank. He was understandably dismayed, but not surprised. There are two kinds of locksmiths in this world: 1) the kind like the guy quoted in the article who said "Your locksmith will tell you this is impossible", and 2) guys like me who will tell you "yeah, someone could make a key to that--- I've done it myself". Point is, you want to use a locksmith more like 2) than 1). The first guy will feed you the standard Medeco marketing bullshit about how "only we can make your keys" and convince you that equals security. The second guy will tell you key control is useful, but it's not relevant beyond its obvious purpose. There are really only two kinds of common break-ins: inside jobs and random burglaries. In the case of inside jobs, all the key control in the world won't matter because the perp has a key already. This key could have been given to them, taken out of a desk drawer, or otherwise acquired via lax internal key management. This makes up 99% of all break ins. The other 1% is burglaries by random opportunist perps taking advantage of a weakness, usually on the spur of the moment. Back doors propped open by people out for a smoke, simply walking in during business hours wearing a suit, etc. All this spy crap people have in their heads about about burglars picking locks and James Bonding into their houses is fantasy bullshit. Real burglars wait till you're not home and throw a brick through the window, or let themselves in with the key you gave the cleaning service. All this hoo-hah over making a medeco key with a credit card is total yawnsville, and if anyone thinks they can get into the white house with a shrinky dink key, they're totally on crack. The whit House has things like SECRET SERVICE AGENTS, and ALARM SYSTEMS because they know keys alone are not enough.

  13. Re:Back to the topic... on USAF Enlists Shrinks To Help Drone Pilots Cope · · Score: 1

    The word is properly spelled in the Northern German Hochdeutsch.

    Really? I can find no reference to that spelling anywhere. And "hochdeutsch" is a term used to refer to "standard" or "common" German, not any regional dialect. If anything, the hochdeutsch spelling would be the common one, "schadenfreude".

  14. Re:Welcome to warfare on USAF Enlists Shrinks To Help Drone Pilots Cope · · Score: 1

    Killing a person changes you? killing ANYTHING changes you a lot.

    I would argue that I was already changed by the time the trigger pulling happened. I always found it quite odd when people would suggest that, until I had a person in my sights, there's no way I could know I would be able to pull the trigger. I always maintained they were wrong. They might not know if I was going to pull that trigger, but I definitely did. When the time came, it was a simple matter of "aim, squeeze... aim, squeeze". Maybe I'm unusual in that I took my job seriously and never pretended that it was a make believe. Maybe most guys in my position ignore the reality of their job duties until the very last possible moment. Maybe it's a fallacy left over from the days of conscription, when few were volunteers. I know I was ready to pull the trigger long before the time came.

  15. Re:People should search for AC-130 videos on USAF Enlists Shrinks To Help Drone Pilots Cope · · Score: 1

    The difference is the UAV operators do that and then drive home to their families. When people are deployed there is an insulation from "normal" life during the deployment. That's the difference and that's what the AF fears is a problem. When you're stuck in the sandbox for 3 months, you get wound up, do your duty, then unwind and come home. That cycle is happening daily instead of over a 90-120 day period.

    I dunno. It's not like Air Force pilots are living out in the field like we infantry guys were. At the very least they fly back to a fairly civilized airbase, where they have electricity, hot showers, cooked meals, etc. The extreme case is the B-2 pilots, who fly 40-odd hour missions from freakin' Missouri. They most definitely go home after work. I think the problem is that the Air Force isn't treating these guys like combat pilots, which to a large extent they are. I bet they treat them like IT staffers and are (foolishly) surprised that guys who drop bombs on the enemy in real time via satellite suffer almost the same stress as live pilots. It's just the natural result of idiotic "fighter jock" attitudes you still find in the general staff.

  16. Re:People should search for AC-130 videos on USAF Enlists Shrinks To Help Drone Pilots Cope · · Score: 1

    I don't see how this all that different from the gunners on an AC-130 who watch everything they shoot. It's not all fire and forget pushbutton in the Air Force. Sounds just like an old problem in a new role, not much worth noting. Killing people isn't supposed to be fun or normal, that's not news.

    Yeah, it's just a lack of training combined with erroneous expectations. People tend to join the Air Force expecting "softer" military service than you'd find in the Army or USMC, and for the most part they're right. In the army we were continuously reminded that our job was to kill people and break stuff. The Air Force would do well to do the same for those it puts into a similar role.

  17. Re:UAV missions more demanding that you might expe on USAF Enlists Shrinks To Help Drone Pilots Cope · · Score: 0

    I fully respect that from time to time, horrible things must be done...Guilt is important. Guilt is what reminds us what is morally right. When the operator pushes the button that fires the missile people die. Again, I understand that sometimes it must be done. But the decision to kill should be tough and difficult and fraught with guilt.

    Hogwash. Utter nonsense. Guilt is a feeling that arises from doing something wrong. Your very first sentence admits that these horrible things are a necessity at times. If they are necessary, then they cannot, by definition, be wrong. Guilt over killing people in military circumstances is not a good thing. It arises as a result of conflict between a person's religious/moral code and the rules of war. Feel free to argue that all killing is wrong, and that the military ought not exist, or that what these RPV pilots have done is morally wrong, and no one should ever do such a thing; but you're completely wrong to argue that they did the right thing, but should still feel guilty.

  18. Re:What "study"? on Study Suggests Music Industry Embrace Piracy · · Score: 1

    You can't really produce large-scale music without a label anymore. What you mean is "non-major label". Year Zero was the last on the Interscope label. The Slip etc are on the "The Null Corporation" label.

    While what you say is true in a very narrow technical sense, it completely misses the GP posters point. The Null Corporation is Trent Reznor. It's a shell company that does nothing but produce NIN music. It's essentially a record_label "wrapper class" around the band Nine Inch Nails that allows the existing publicity infrastructure to work with it via a "common interface". The GP poster's point was that you don't need a giant resource-hogging, badly designed record_label class from an outdated class library supplied by a dinosaur trade cartel--- you can "write" your own.

  19. Re:What "study"? on Study Suggests Music Industry Embrace Piracy · · Score: 3, Insightful

    I guess Google searches are more or less influenced by the country you're at. Google.com.br returns lots of results for "Banda Calypso"... Banda is portuguese for band.

    Heh. Looks like the GP poster isn't as bright as he fancied himself:

    "I've never heard of them. A quick Google search turns up nothing either. Searching for Calypso brings up results for calypso music.... but no band. Searching for "Calypso band" is similarly barren

    Always there are subtle pitfalls when you try to look sharp... like remembering that other countries speak languages other than English, and that when searching for a Brazilian band, perhaps one ought to use the Portuguese word for "band"... and maybe even searching google.com.br...... or perhaps even coming to the conclusion that "calypso", being a a word already heavily associated worldwide with an entire genre of music, might not return a hit on the first few dozen pages for a small, locally famous band in Brazil...

  20. Re:One company doesn't succeed at once on SpaceX Launch Fails To Reach Space · · Score: 4, Informative

    Perhaps you can clue me in as to what the specific need is for this rocket to begin with. I guess NASA doesn't have a suitable one

    You guess wrong. NASA has plenty of "suitability" with the Delta rocket. This program is an attempt to get the job done cheaper.

  21. Re:It's misnamed on "Mobile Plate Hunter" Cameras Raise Questions · · Score: 2, Insightful

    Now, over in the common sense corner, how many people do you know with enough liquidity to cover more than a minor fender-bender who lack proper insurance ...I'm guessing the answer is a small-ish number.

    Vanishingly small! People who have money have insurance not to pay for body work costs in minor fender benders, but to shield their assets from liability from lawsuits. If you're in an accident and the other guy gets the slightest idea that you might have money, there's a very real possibility that he'll suddenly develop all sorts of nebulous neck and back pain. The only time rich folks post a bond rather than pay for insurance is when they're driving something otherwise uninsurable, like certain exotic sports cars.

  22. Re:Poor choice of words on New Results Contradict Long-Held Chemistry Dogma · · Score: 1

    Really? For science I rather find the more we understand, the more we realize we don't understand.

    That's a pretty inaccurate overgeneralization. Really, the more we understand, the more things we discover that are unknown. We fill in the large gaps in our knowledge, but find many smaller gaps around the edges. We're constantly pushing the envelope, not backtracking and starting over.

    500+ years ago scientists thought the earth was flat.

    No they didn't. Eratosthenes calculated the circumference of the earth in 200 BC. Man knew the earth was round around the same time as basic astronomy was started. Simply observing that the shadow cast on the moon during lunar eclipses is always rounded clearly indicates the earth is a sphere, as the only thing that always casts a round shadow is a sphere. For about the last 3000 years, the "flat earth" crap has only been believed by the ignorant. Scientists knew better.

    Scientific theories only hold out until something else comes along with more facts that change our understanding. My 2 cents.

    Your 2 cents aren't worth a plugged nickel. No recent discovery has truly overturned any great swathe of knowledge, invalidating huge chunks it. What new discoveries almost always do is refine what we already know.

  23. Re:How utterly useless on Senate Passes Bill Targeting College Piracy · · Score: 1

    This is the type of crowd that only parts with money when they have to, because the vast majority are putting themselves further and further into debt with each passing semester. A disposable income is the dream a college student's future, not a reality. In my experience, most, if denied the ability to partake without paying would simply not partake.

    Indeed, this is what astounds me the most. I've heard people wonder over why college students are always looking for free stuff, not just online, but in Real Life. Clearly these people didn't experience the same college life I did. The life of a debt-ridden college student is best summarized by the following: "ramen, bus pass, stolen toilet paper"

  24. Re:I always know when I'm in a college town ... on Senate Passes Bill Targeting College Piracy · · Score: 1

    ...They also HATE it when they are reminded how retarded the anti-copyright position is, so try to mod down pro-copyright posters so they don't get seen. Sad isn't it?

    Yeah, because calling something "retarded" is the height of rational debate. There's a reason posts that say little more than "ALL U COLLIGE STUDENTS AR THEIVES AND U KNO IT!!!" get modded down, and it's not because copyright opponents feel the cut and thrust of the counterarguments damages their own position on the matter...

  25. Re:Neither the RIAA/MPAA nor the EFF would care... on Senate Passes Bill Targeting College Piracy · · Score: 2, Insightful

    Even if they're performing copyrighted works (doing an artistic interpretation), just in this case they can't do that for profit without obtaining the rightowner's permission. So it looks someone is extorting money from the universities...

    Cite, please? In most jurisdictions, including the US as far as I'm aware, public performance is a protected right under copyright, and just because something is not for profit, that does not automatically qualify it as a fair use (or whatever your jurisdiction calls the equivalent exemption).

    I think you missed his point. He didn't say it was legal for students to do this, but that perhaps it's not the university's job to police such things. Seriously, under what line of crazed reasoning does the university bear responsibility for three jackasses in the dorm stairwell singing "Dancing Queen"?