Hacker News Reader

Comment by Nextgrid | Hacker News Reader

There's definitely a need for a secure (based on actual cryptography) door entry control system.

Most of what I've seen in the field is either HID iClass (no idea how secure they are) or Mifare Classic. The latter doesn't even attempt to use the card's crypto features (which are broken, but it would've at least been an attempt) and just uses the UID of the card which is broadcast in the clear and even the card's datasheet explicitly warns against using it for any kind of security.

View on HN

In the commercial space, sure. In the residential space, it would be a pretty small market. A door lock is there to slow down an attacker, or to force them to make a destructive entry via a window. Going much beyond long screws to prevent kick-in, and good tolerances to prevent trivial bump keys is rarely cost-effective.

I've talked to a few people who were victims of burglaries, and the value of the stolen stuff never worried them. The violation of their home was what worried them. It messes with you when you know someone broke into your home.

So people probably don't worry about cost-effectiveness of their home security system, they just want to feel safe in their home.

Even if cost is no object, every commercial electronic entry system I've ever seen has had at least one door with a bypass with a conventional key, in case the electronic entry system fails. And any electronic lock with a manual lock in parallel with it can never be more secure against attacks like lockpicking than the manual lock alone.

Of course, there are security benefits if you have a cleaner/dog walker/whatever and want to give them access you can revoke without the cost of changing your lock. Or if you're running a commercial installation like an office or AirBnB.

Still, I don't think electronic door locks will become mass-market until someone makes one so reliable it doesn't need a mechanical bypass key, which might be impossible.

You can pin a lock that's practically impossible to pick by permanently blocking when one attempts to pick them. Yes, the owner needs to drill the lock after such a picking attempt, but it prevents non-destructive entry.

But residential space is full of potential targets, so it's useful to make your space look like a less attractive target. Oversized hinges and kick panels, security film on the windows, etc.

Of course, the best bang for your buck is still the simple stuff - a few motion detecting lights, some security company stickers and a clean, well-kept yard.

The problem is that with insecure crap flooding the market there’s no way to tell the good stuff (if it exists) apart from the garbage. It’s not like they clearly explain how it works or publish the code. Worse, people involved in this usually come from a physical security background and the electronic aspect of the system somehow gives them a false sense of security where it’s actually even easier to break than picking a good mechanical lock.

I’ve seen hotels and student dorm rooms using insecure systems (the latter of which I exploited as a teenager to make a second keycard to sneak into my GF’s room without having to borrow her only key. How easy the attack was worried me quite a bit).

Exactly this. Locks only keep out "honest" people. I used to work in the access control space with a commercial bluetooth lock and app and our goals were always the following: 1) No systemic vulnerabilities (each user had a digital key specific to them, the lock and the time) and 2) Make a stone through the window the weakest link in the chain.

Reply on news.ycombinator.com