Perfect Security

http://99percentinvisible.org/episode/perfect-security/

by js2 • 11 years ago

116 28 11 years ago

ejcx• 11 years ago

This article mentions Schuyler Towne at the end.

I've watched Schuyler talk[0][1] at RVASec (a small richmond va security conference) the last couple years.

If you find locks even almost remotely interesting, Schuyler is the guy who will talk until you think they are really interesting. He's super passionate about locks and gives a ton of easily digestable information about them.

[0] https://www.youtube.com/watch?v=3nROJz_UNQY

[1] https://www.youtube.com/watch?v=kTQWPrl_Tao

fabulist• 11 years ago

I concur that Towne is a great speaker on this subject, and would like to add that he's an HN user.

https://news.ycombinator.com/user?id=emhart

I discovered this by reading this comment, and as soon as I read "security anthropologist", I figured there couldn't be two of those.

https://news.ycombinator.com/item?id=8156030

verelo2• 11 years ago

Its funny watching the video of the lock being picked. I cant help but feel that if that style of lock was invented today, we would probably complain rather heavily about its insecurities. There is a clear vulnerability in that they produce sound and friction that enables a trained individual to pick the lock, gaining unauthorized access.

It's also interesting to think almost every house in the country has one of those locks, yet no one seems too concerned.

fweespeech3• 11 years ago

Most buildings in the country have:

A) A pickable lock

B) A door that can be kicked in [fire code requirements]

C) Unsecured windows that can be broken to gain entry.

D) Crawl spaces that can be used to force entry from the outside.

You need alot more than a lock to secure a building.

verelo2• 11 years ago

Good points. I guess its just people being present and social pressures (and more along these lines) that keep us honest.

seanp2k2• 11 years ago

Yep, and most apartments have worse versions of those, which the residents are contractually forbidden from doing anything about. I'd love to have a steel door with a solid frame and half-way-decent locks, but since my landlord is good with whatever was on sale at Home Depot, I don't get a say in the matter.

e12e4• 11 years ago

I think many people mis-understand locks. Locks are very rarely there to prevent entry. It's there to prevent undetected, unauthorized entry, or to make entry a little harder, but not impossible. With bump-keys, most locks actually fail at both (never mind lockpicks) -- and end up being a strange kind of security theatre -- where most people are in fact actors (ie: don't realize that so many, many locks are completely insecure in any meaningful way).

Another thing that people often mix up, are security and safety. A secure door/building is a death trap. If people can't get in/out in an emergency, that's usually terrible, for almost any kind of building. A building that you can't break into or out of in less than a minute, is unsafe.

Or to put it another way: what's the difference between being in prison and living in a castle? ;-)

nindwen• 11 years ago

Does anyone know how widely these are actually used?

When looking at the video, the key looked very "old fashioned", and I thought that surely they're not widely used anymore. In Finland, most locks are something called (after quick look to Wikipedia) disc tumbler lock, and I hadn't really thought about how common they're elsewhere.

They look like these http://www.bobi.com/assets/Products/Bobi-mailboxes/accessori...

zobzu2• 11 years ago

I think we'd just say something else is too inconvenient and that nobody cares (which is sort of true).

I can pick all the locks of my appartment in under a minute.. but im not worried.

The postman leaves packages in the lobby behind the building front door.. that door which he and everyone else has the code to, and everyone let everyone else in if they dont know it (or just give them the code really).

Never lost a single package.

I suspect the risk to gain ratio isn't popular.

kijin• 11 years ago

Differential cryptanalysis, side channel attacks... The analogues are all there, only in a more tangible form.

A well-designed electronic lock based on modern cryptography might be immune to almost all of these attacks, so in a sense we're pretty close to getting perfect security back. In real life, of course, nothing stops attackers from simply ignoring the lock and bashing the door in.

nik41tkins• 11 years ago

One of my dad's favorite quotes was "Locks keep honest people out".

Even if you get a secure lock, are you also going to reinforce the door frame? If someone wants in they will get in. It just costs more if you want to make it harder to perform certain type of attacks against your home defense.

bobbles• 11 years ago

Exactly, you could have every window and door barricaded up with steel and someone could still come along, take some tiles off the roof and get in easily that way.

KNoureen• 11 years ago

Not entirely true, the world is not that binary.

I can't remember where I read it, but a locked door is quite effective in preventing burglary as forcing the lock or crashing a window would greatly increase the chance being detected.

late2part• 11 years ago

Awesome article. My take away for the computer world... There's no safe, just safer. Security through obscurity is not as ridiculous as popularly believed. Make your secrets distributed and subtle, and protected in multiple ways for best likelihood!

zobzu2• 11 years ago

the major issue with security by obscurity is ignorance.

a very well secured secret that is also not talked about will be very safe.

a poorly secured secret that is also not talked about will not be very safe, and you probably wont even know when its stolen.

in the real world, the later happens most of the time. hence why security by obscurity is highly discouraged. it enforces the security mechanisms to be pretty good.

e12e4• 11 years ago

The "security by obscurity" that we have in the physical world, is closer to AT&T publishing personal data on their web site, and weev getting sentenced to years in prison for pointing it out, than many people realize.

The big difference, is that in the digital world, seeing is possession -- if someone walks up on your porch an reads the documents you've placed there, you'd never know.

(Writing this, I kind of realize how some seemingly sensible people think that the crazy laws on computer intrusion makes sense... but the don't. That's a discussion for another time, though. Along with how analogies may not be the best vehicle to determine sentencing guidelines new areas opened up by new technology...)

legulere• 11 years ago

And then there's so safe, that it can't be circumvented in the time the university exists.

mortehu• 11 years ago

I think defense in depth[1][2] might be the term you're looking for.

1. https://en.wikipedia.org/wiki/Defense_in_depth_%28computing%...

2. https://en.wikipedia.org/wiki/Defence_in_depth

elchief2• 11 years ago

I'm guessing that the Chubb that invented that lock is related to Chubb Insurance somehow...

elchief2• 11 years ago

Hm, perhaps not http://en.wikipedia.org/wiki/Chubb_Corp. (1882) vs http://en.wikipedia.org/wiki/Chubb_Security (1818)

Perfect Security

Related Stories