Schneier on Security

Clive Robonson • November 6, 2025 5:18 AM

@ MarkH,

It’s funny that you should mention,

“the password for the system controlling the Louvre’s surveillance cameras was ‘Louvre’”

Because it reminded me of a similar issue in a well known UK “Building Society”[1] way back last century. I should warn you this falls into the classification of “war story”, where tales of heroic wins and total failure are recounted for others to enjoy and learn from. Unfortunately this one falls entirely on the “fails” side of things…

It involved the Building Societies network of ATMs and the passwords for them.

The bank tried and failed to run it as a “two key” physical security system which was the sort of a standard system when both safe locks and keys were “turn together” like those “Two Man” nuclear launch systems you see in a movie. With one Key held by the Branch manager and one held by the Assistant manager.

This sort of physical security does not map back into information security for various reasons, but in the case of this Building Society the attempt to do so made everything insecure at so many levels and thus a total failure.

Firstly due to the fact the then ATM network used “apparently” required all the ATMs on it to use the same “password”. For reasons still not clear to this day if actually true. One possibility was a botched centralized security system. But that is just a probabilistic argument based on “knowledge of security malpractice” endemic at the time five decades ago.

Also somebody in senior management steeped in the old physical security ways picked the Key…

Further the password was only the then computer industry standard “eight characters”… To try and make it into two keys they split it into two halves… And due to “human memory issues” it was decided to make them “4 digit PINs” in form…

But there was another issue they tried to solve. In a physical “two key” system it does not matter what order you put the two keys into the safe as long as they are both in and then turned together. To stop this issue of PINs being put in the wrong order arising with the split in half password they made the Branch and Assistant manager PINs the same…

But they clearly did not understand the difference between physical keys and information keys such as PINs…

Because as happens when an Assistant manager gets promoted they take over at a different branch. Under the physical “two key system” they would hand back the Assistant Key at the branch they were from, and get given the Branch Manager key at the new branch they were taking over. Which is all well and good for physical keys that are different for every branch and the keys “supposedly” only could be cut by “specialists in the lock industry”[2]…

To cut the story short, all new Branch Managers became aware that the two PINs were the same, and it did not take much longer for all the Assistant managers to work it out either. Likewise others such as service technicians became aware, and like the ripples on a pond the password spread.

The other thing you need to know was like physical keys that don’t change with time, the Building Society never changed the password…

So it became known to many others that the PINs were “1234” and thus the password “12341234”…

Eventually somebody who knew blabbed and a tech journalist got to hear about it over a social pint of beer as a “war story” one evening, and wrote it up into a “no name” story, and their editor ran with it.

Thus “changes had to be made” but I’m told by a journalist, that “no heads rolled” in “Senior Management”. But one or two had taken a well greased early retirment a very short while later.

Proof if you will that “secrets escape” and “ripple out” when they do.

[1] It can be hard to describe accurately what a “Building Society” was in the UK back then because of Thatcher prescribed “Deregulation”. Now you would be hard pushed to tell them apart from a bank. They however started by groups of people forming a “mutual society” finance organisation to help mutual members buy their homes and share in any profits. As what was technically a partnership not a company there were quite strict business and finance rules put upon them. Deregulation was portrayed as a massive opportunity. However predictably for Thatcher Mantra Deregulation was without doubt a disaster, and “the country very much the worse for it”. Amongst other things it brought us the sociopath “Fred the Shred” who gained control of the Halifax Building Society and ran the share price up in a process that hollowed out the business into a fragile bubble. In the scandal he created, the business had to be put on “life support” by the UK Government followed by a forced breakup and sale to another bank, where the influence of Fred spread out like a plague, and the bank that took over the “retail bank” side of Fred’s empire became diseased as well.

[2] This idea of an “uncopyable” physical key is a compleat nonsense as any honest working locksmith knows about. It’s a myth the industry used and still does as a “Guild Secret” to make their members more money in various ways. There is an old saying that,

“Only three numbers make sense in our physical universe zero, one, and infinity.”

The reasoning is that a physical object.

1, Does not exist thus there are “zero” of it.

2, It can be unique thus there is only “one” of it.

3, If not unique there can be any unknown number of them thus there could be an “infinity” of them

Further is the old saying of,

“What can be done by man, can be undone by man, and done again”.

Thus all physical keys have to be considered “infinite” that is copyable by a craftsman. Or just a curious kid under ten with a birthday present set of “needle files” which is where my key duplication and lock picking abilities started over a half century ago unconstrained by “Guild Secrets”.