Schneier on Security

Clive Robinson • April 6, 2015 7:46 AM

@ Moderator,

We appear to have a “link looney” that’s all atwitter about their own inability to be popular, they have posted their junk on this blog several times over the past few days.

Clive Robinson • April 7, 2015 12:18 AM

Having concluded that,

1, It does not add to the physical security of the door or frame.
2, It potentially adds many new vulnerabilities.

So in the scope of the door and frame, it’s at best on par but more likely a downgrade on security.

So let’s widen the scope a bit to a single user, this is where it gets more interesting because on the surface it removes the need to have and control duplicate keys… But does it?

Actually no, because if you lose the physical key you use day to day, you still need a pattern key to cut a replacment for it, and thus this pattern key still needs to be controlled.

However even if you are carefull, and never lose your day to day key, you still need a pattern key, because your day to day key will become worn with use and potentialy break/snap, so you will need to cut a new one every few years.

So what do you do with your pattern key? Well unlike an emergancy key you can keep it inside the locked area somewhere. But this has other issues such as the old “Fagin’s Boy” attack. That is someone gains entry via a small window left open for ventilation etc, to either let the crooks in or to find keys to pass on / sell to crooks (oh and don’t be like everyone else and leave them in the kitchen / desk draw…). Similar attacks occur in server rooms / offices where people lift ceiling tiles to use the void to get over the door.

But the point Nick P is making about a “fake rock” applies not to a pattern key but to one or more emergancy keys which have to be outside the locked area for traditional systems. However if this is the only use for it, then like “smoke detectors” you will need to change the batteries way more often than you will use it, oh and you will also need to install the app on your new phone you upgrade about once every 18months, if the app is still available and will work on it in a couple of years time.

Thus the potential weakening of the security of the door and frame by adding this lock needs to be considered against the weakening of security caused by an emergancy key. Similar logic applies to “other access” keys used by other family members / office workers and “occasional / one time access” keys used by trades people etc.

You can make various “security tree” maps and assign your own weights of probability / risk to them, importantly though as consumer grade battary powered electronics are used don’t forget to include that in the security tree, it will be by far the most significant risk.

But… don’t forget the human element, ask yourself a question, what is your ratio between forgetting your keys and forgetting to charge your phone… most people I know very very rarely forget or lose their keys, forgetting or more often not being able to charge their phone is a weekly or monthly event…

Also ask your self the “putting out the trash” question, which are you more likely to do pick up your keys, pick up your phone or neither, when you carry out those trash bags leaving the door ajar, for a gust of wind etc to slam the door behind you?

From my point of view such a lock is going to be way way more trouble than it’s worth even as a “geeky gimic”. Because the only time I’ve ever had to call a locksmith was when some one had broken in and in trying to get out had turned a “blind dead bolt” the previous owner of the property had installed, and that was more than a quater of a century ago. All the locksmith did was use a chisel to lift the doorframe beading, and cut through the cheap deadbolt with a pad saw. He did this in preference to removing the quater light window and putting his arm through –which male idiot burglars tend to do– because as he pointed out, the patterned glass might be difficult to replace.