Matt Blaze3d ago

Physical security and cryptography can learn from each other, part 11367:

Hotels wisely don't put the room number on guest keycards so if someone finds your card, they'd have to exhaustively search the hotel to find the room it opens.

Some hotels now have elevators programmed to only let you call the floor for which your keycard is coded, preventing guests from wandering to other floors.

But it also means the elevator can be used as an efficient oracle to determine the floor of a found key.

Show threadMatt Blaze3d ago
In other words, restricting the elevator in this way is a bad tradeoff. It makes it harder for guests to visit their friends on other floors, but it reduces the complexity for an outsider burglar from O(|rooms|) to O(|floors|) + O(|rooms_per_floor|), a much more feasible search space.
Show threadMatt Blaze2d ago
(The point here is not about securing any specific hotel or keycard system. The point is that thinking about security in abstract terms can reveal properties and weaknesses that aren't otherwise obvious.)
Show threadrag. Gustavino Bevilacqua2d ago

@mattblaze

In the holiday house we rent there is a masonite panel in a closet under the stairs, with screws in the corners.
Since it seems to hide something (actually it hides just the heating pipes) I wrote on the wall behind it: "The safe is not here! Try again!".

Show threadKurt Weiske

@GustavinoBevilacqua @mattblaze reminds me of the person who put a party skeleton inside his wall during a remodel. Nothing like surprises for the next owners!

All I got was a rusty razor blade sculpture about 2 feet tall, from the razor blade disposal slot in the bathroom I remodeled.

Mar 28 at 8:00pmWeb