Matt Blaze1d ago

Physical security and cryptography can learn from each other, part 11367:

Hotels wisely don't put the room number on guest keycards so if someone finds your card, they'd have to exhaustively search the hotel to find the room it opens.

Some hotels now have elevators programmed to only let you call the floor for which your keycard is coded, preventing guests from wandering to other floors.

But it also means the elevator can be used as an efficient oracle to determine the floor of a found key.

Show threadMatt Blaze1d ago
In other words, restricting the elevator in this way is a bad tradeoff. It makes it harder for guests to visit their friends on other floors, but it reduces the complexity for an outsider burglar from O(|rooms|) to O(|floors|) + O(|rooms_per_floor|), a much more feasible search space.
Show threadTrammell Hudson18h ago
@mattblaze I've also seen some hotel elevators where you swipe your keycard and it selects the correct floor for you, removing the O(floors) component.
Show threadAriadne Conill 🐰18h ago
@th @mattblaze yeah i encountered that recently in germany and was just like ????????????? why
Show threadEnola Knezevic17h ago
@ariadne @th @mattblaze What if you wanted to have a drink at the rooftop bar before going to your room?
Show threadAriadne Conill 🐰17h ago
@rhelune @th @mattblaze exactly
Show threadhalfa14h ago
@ariadne @rhelune @th @mattblaze floors with shared amenities are usually open to all cards (provided you have one). Some hotels also doing restric your floors, but simply required a valid card to take the elevator, trying to prevent non-customer coming into the hotel from being able to wander in the corridors. This is obviously defeated by stairs (that are usually present) or simply by riding the elevator with other people.
Show threadEnola Knezevic14h ago
@halfa @ariadne @th @mattblaze Sure but, if you scan keycard because there is a scanner in the lift and press the top floor to go to the bar, you do not want to be automatically taken to the third floor.
Show threadhalfa
@rhelune @ariadne @th @mattblaze ahhh I get it!
8:32pmWeb