MIT Students Release Code To 3D-Print High Security Keys 207
Sparrowvsrevolution writes "At the Def Con hacker conference Saturday, MIT students David Lawrence and Eric Van Albert released a piece of code that will allow anyone to create a 3D-printable software model of any Schlage Primus key, despite Schlage's attempts to prevent the duplication of the restricted keys. With just a flatbed scanner and their software tool, they were able to produce precise models of Primus keys that they uploaded to the 3D-printing services Shapeways and i.Materialise, who mailed them working copies of the keys in materials ranging from nylon to titanium. Primus high-security locks are used in government facilities, healthcare settings, and detention centers, and their keys are coded with two distinct sets of teeth, one on top and one on the side. That, along with a message that reads 'do not duplicate' printed on the top of every key, has made them difficult to copy by normal means. With Lawrence and Van Albert's software, anyone can now scan or take a long-distance photo of any Primus key and recreate it for as little as $5."
How quaint (Score:5, Insightful)
I'd hardly call any industry that uses a physical key "high security" in an age of individually-revokable key card technologies.
How secure can a facility be when the loss of one key means that everyone's keys have to be replaced in order to recode the lock?
Re:How quaint (Score:5, Insightful)
Thus ensuring that people who lose keys wait as long as possible before reporting it, in order to avoid retribution. Now you've lowered your loss rate *and* your security at the same time. :)
Re:How quaint (Score:4, Insightful)
Exactly! People love Objective Metrics (especially ones made of numbers, because numbers are super scientific) that are easy to measure; because they allow even the laziest among them to experience the warm, comforting, embrace of Knowledge. They hate, and thus tend to ignore, fuzzy metrics that are difficult or impossible to quantify (like 'security') because those are a morass of nescience and harrowing epistemic uncertainty.
By doing exactly the wrong thing, and encouraging blatantly insecure behavior (you also likely create a culture of casual key-sharing and letting just anybody who 'lost their key' in), you drive the metric that people are looking at through the floor (demonstrating your Epic Competence), and shove all the risk under the rug of the metric that everybody avoids looking at and politely doesn't mention!
Re:Unfortunately (Score:5, Insightful)
Not true. I used to work security in a building that had a lot of electronic locks. And ultimately, you can't enter them without leaving a trace. Sure, they might not know who it is that entered at 2:26 AM, but we would know that somebody entered at that time. Whereas with regular keys, we would at most know that somebody went to that floor around that time, but we'd have no clue as to which door they went into.
In other words, we could probably get video footage of the person that went into the door secured by an electronic lock, or at least narrow it down substantially, but would have no way of doing that with a traditional lock as we would have to have video of them getting into the elevator, not at the actual door.
What's more, with electronic locks, there's the ability to lock people out during periods of the day that you can't do with a traditional lock and you can change the key much more rapidly.
Yes, they aren't perfect and can be prone to attacks that a normal lock and key aren't. But, ultimately, suggesting that they're not any sort of improvement ignores reality.
3D Printing Hysteria (Score:5, Insightful)