Schneier on Security

Clive Robinson • December 13, 2023 8:06 AM

@ Bruce, ALL,

The USPS “Arrow Key” security is appaling and nobody knows how many there are out there, becaise the control system is a failure,

https://postalemployeenetwork.com/news/2023/02/12/usps-arrow-key-management-controls-ineffective/

https://www.uspsoig.gov/reports/audit-reports/arrow-key-management-controls

Worse there are photos of the Arrow Keys that can be found on the Internet, so making your own is just a “basic skill” issue.

We’ve seen all of this sort of nonsense before with TSA Keys and theft from luggage.

Apparently the USPS is going to move from mechanical keys to “electronic locks”.

Personally I suspect that the electronic locks will be very low price, and thus probably not realy any better than the security of the current mechanical locks.

Clive Robinson • December 13, 2023 9:31 AM

@ PaulBart,

“Wonder how arrow keys were fine for decades, but now aren’t.”

What has changed is society not the locks and keys, that were always a joke, and the crime has followed the changes

The arrow locks have always been insecure as people easily hand made keys. This story was from 2017,

https://www.sacbee.com/news/local/crime/article160733069.html

But there are others, including one where the criminals made the fake keys from cheap store bought scissors.

What has changed is the way people make purchases and return goods, gets credit cards and other small items of value. Which makes postal crime have greater returns for the criminals.

If the crooks are “smart” then the crimes would be lower risk, but those few that have been caught don’t appear to be that smart. Which suggests the captures are the exception rather than the rule.

The C19 lockdown will have made “on line” purchase and postal return way more socially acceptable, thus on the principle of “low hanging fruit” the criminals follow, and I would expect this sort of crime to go up proportionately.

Clive Robinson • December 13, 2023 10:12 AM

@ Bruce,

Remember the TSA put up photographs of their keys…

Well it looks like the LAPD did not get the memo,

https://cdns.abclocal.go.com/content/kabc/images/cms/automation/vod/2257050_1280x720.jpg

And well as I said,

https://dl-uk.apowersoft.com/en/arrow-usps-mailbox-master-key-template.html

You can see that the key is deliberately “over complicated” and a true minimal “master key” would be much less so, due to the simple nature of the locks which are easily available and easy to open and require very little expertise to cut a key for.

Also you could “cut a key and lock” whereby your minimal master key would open “Arrow Key” locks as well as your lock, but… An “Arrow Key” would not open your lock.

But the real issue of making the key over complicated is it’s not easily visually recognised. It’s seen as a security feature by many “lock smiths” but the reality is it’s anything but. At best it’s a realy terrible example of “Security by Obscurity” and it’s been “blown” as a security measure for a couple of decades or more. So much so it’s appeard as a major plot feature in TVcrime dramas like “Bones” and “Castle” where the proces of getting a photo and using a 3D printer is explained in enough depth for people to use it as a basic recipe.

But a question arises, It’s a Federal offence to possess an actual “Arrow Key” but a key that is not an actual “Arrow Key” but one for your home “lock-box” or similar?

How are you supposed to know the key works as an “Arrow Key” if it does not look like one, or even have the same key profile?

No doubt at some point it will get “argued out”…