Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hotel-room hacks: Picking the lock

economist.com

Post reply on HN
Print view View original

61–70 of 71 posts

Re: Hotel-room hacks: Picking the lock

#61

Post by tzs »

saturdayplace wrote: post #40
larrys wrote: post #37

Earlier quoted context omitted.

Well for one thing less people would know about the flaw and potentially be able to take advantage of it.

That's called "security through obscurity," which isn't really security at all. It didn't prevent daeken from discovering the vulnerability, which means it's likely others with more malicious intent also know about it and are keeping the fact quiet. When the problem goes unpublished, unsuspecting customers will continue to trust the locks on their rooms. When published, customers can make more informed decisions abou…

> That's called "security through obscurity," which isn't really security at all

That phrase is misused and misunderstood on the net almost as much as Benjamin Franklin's statement on freedom and security.

It means that you should not rely on obscurity to keep a system safe. In the long run, you have to assume the bad guys will find out all your bugs. If someone were suggesting that the flaw not be disclosed and that it would be OK for the vendor to not fix it since it is not disclosed, that would be attempting "security through obscurity" and would be bad.

We aren't talking about the long run here. The relevant question here is if in the time it takes to deploy a fix, will more people be harmed if the flaw is widely known than if the flaw is kept quiet while the fix is being deployed.

To answer this question, you need to consider several factors, including (1) what steps customers who learn of the flaw can and will actually do to mitigate its effect on them, (2) whether customers will actually learn about it, (3) how many bad guys who would not have discovered it on their own will exploit it after it is disclosed.

Re: Hotel-room hacks: Picking the lock

#62

Post by tzs »

jrockway wrote: post #33
sopooneo wrote: post #23

Earlier quoted context omitted.

It's going to happen. Even with full care and diligence there will still be some products shipped with security flaws. It is not ethical to give the company no heads up, not even anonymously.

You're assuming that the security researcher is the first person to discover the issue. That's rarely the case. Keeping quiet just gives users a false sense of security and ensures that they can't mitigate the security impact on their own (without the help of the vendor). Knowledge is power. We shouldn't censor ourselves because someone somewhere can be evil with some information. They have other ways of getting the…

The following is meant to be general, rather than about this particular case.

Assuming the goal is to minimize harm, then when to disclose depends on an interplay of several factors. Here are some of them:

1. How many people will discover and exploit the flaw on their own if it is not publicly disclosed.

2. How many people will exploit it if they find out about it, but will not discover it on their own.

3. How fast knowledge of the flaw will spread to the people of #2 without public disclosure. E.g., through word of mouth in hacker or researcher circles.

4. How many users of the flawed system will be able to use knowledge of the flaw in order to protect themselves from the people of #1 and #2.

5. How long the flaw will remain available.

6. How lessons from this flaw will teach others to build more secure systems.

Disclosure affects #2 (disclosure increases harm), #4 (disclosure decreases harm), sometimes #5 (disclosure might push a vendor to action), and #6 (disclosure decreases harm).

Re: Hotel-room hacks: Picking the lock

#63

Post by brown9-2 »

lmm wrote: post #57
nodata wrote: post #49

Earlier quoted context omitted.

> When you leave, take your valuables. So I'm in a foreign land, and I should carry around all my worldly possessions with me? How is that safer? (Why can't the hotel provide a lock that works?)

Leave them in the hotel safe (many will give you one in your room) if you prefer. It just doesn't seem worth the hotel putting serious effort into the lock on the room door, because that's always going to be insecure, if only because the minimum-wage cleaning staff need access to all the rooms.

I think you assume that the room safe is harder to break than the lock. Is this true?

Re: Hotel-room hacks: Picking the lock

#64

Post by saturdayplace »

tzs wrote: post #61
saturdayplace wrote: post #40

Earlier quoted context omitted.

That's called "security through obscurity," which isn't really security at all. It didn't prevent daeken from discovering the vulnerability, which means it's likely others with more malicious intent also know about it and are keeping the fact quiet. When the problem goes unpublished, unsuspecting customers will continue to trust the locks on their rooms. When published, customers can make more informed decisions abou…

> That's called "security through obscurity," which isn't really security at all That phrase is misused and misunderstood on the net almost as much as Benjamin Franklin's statement on freedom and security. It means that you should not rely on obscurity to keep a system safe. In the long run, you have to assume the bad guys will find out all your bugs. If someone were suggesting that the flaw not be disclosed and that…

Your reply contains exactly the kind of nuance I should have used above. I'm constantly complaining (mostly on facebook) about how arguments devolve into one-dimensional two-sided affairs, and here I fell into the same trap. Thank you for providing that clarification.

Re: Hotel-room hacks: Picking the lock

#65

Post by jusben1369 »

nopassrecover wrote: post #41
jusben1369 wrote: post #28

Earlier quoted context omitted.

No no you're missing the point I think. Nearly every hotel room has a big old manual separate bolt set up higher and away from key based locking system. Slides open maybe 2 inches etc. Twice in my life the hotel person has given my room to someone else by mistake (I travel a lot for work). That is, I'll be in there, twice late at night, and someone else puts in a key and it works. After the first time I always set th…

I think you're missing the point - Onity locks don't usually have this "big old manual separate bolt" as they're sold as "deadbolt inclusive".

It's pretty rare to not see them (can't remember when i haven't) due to the reason I list.

Re: Hotel-room hacks: Picking the lock

#66

Post by dalke »

lmm wrote: post #60
dalke wrote: post #59

Earlier quoted context omitted.

What's the point of mentioning minimum-wage here? Would your logic change if the staff weren't paid minimum wage? If you are staying at a hotel were the staff was paid above minimum wage, would you feel more secure? The BLS says that the median wage for "Maids and Housekeeping Cleaners" is $9.32. Federal minimum wage is $7.25 per hour. Obviously then, most are not paid minimum wage. In any case, people also want a lo…

>If you are staying at a hotel were the staff was paid above minimum wage, would you feel more secure? Yes. Seriously, is that even a question? Wouldn't you? Higher wages mean two things: the staff have more to lose by being fired, and by implication the hotel puts more effort into its staff. Which means they're probably recruiting more carefully and putting more effort into staff loyalty once they're there.

Then my point is that most hotel cleaning staff is paid more than minimum wage, so the scenario of the minimum wage staff is the uncommon scenario.

I don't think wages affect honesty to any great extent, no. I think bad working conditions affect honesty a lot more.

If you believe this to be true, do you ask the hotel how much they pay their cleaning staff, and choose the one with higher base pay? How much more are you willing to pay to be in a hotel which pays their employees a higher wage?

Higher wages mean other things than those two. It could mean that it's harder to get staff because there is better employment elsewhere, so there's less risk to being fired for suspicion of theft because it's not hard to find a new job. It could be because the union is strong and able to negotiate better than management, while management actively wants to break the union by treating their cleaning staff poorly in the hopes that the staff will steal, so management has reason to fire them and blame the union for protecting thieves.

(Yes, the latter sound much less likely than the former.)

Re: Hotel-room hacks: Picking the lock

#67

Post by ljensen »

lmm wrote: post #57
nodata wrote: post #49

Earlier quoted context omitted.

> When you leave, take your valuables. So I'm in a foreign land, and I should carry around all my worldly possessions with me? How is that safer? (Why can't the hotel provide a lock that works?)

Leave them in the hotel safe (many will give you one in your room) if you prefer. It just doesn't seem worth the hotel putting serious effort into the lock on the room door, because that's always going to be insecure, if only because the minimum-wage cleaning staff need access to all the rooms.

People have posted many videos/blog posts about how easy it is to open a hotel safe if the hotel fails to reset the factory code: http://www.dailydot.com/news/hotel-safe-security-flaw/

Since seeing this video last year, I have yet to find a hotel safe the I can open with all zeros. In the end, I figure that if someone really wants to steal my stuff, they'll eventually find a way.

Re: Hotel-room hacks: Picking the lock

#68

Post by wglb »

daeken wrote: post #45
kamaal wrote: post #43

Earlier quoted context omitted.

You were planning to do a Reddit AMA on reversing in General. Did that ever happen? Have you written anything on that?

I did indeed -- http://www.reddit.com/r/IAmA/comments/yeiac/iama_reverse_eng... It went better than I could've ever imagined; it was topping the front page for a while! Seriously awesome experience.

And I thought it went very well--it answered all the questions that I was going to ask you via email.

Thanks for doing it.

Re: Hotel-room hacks: Picking the lock

#69

Post by lmm »

dalke wrote: post #66
lmm wrote: post #60

Earlier quoted context omitted.

>If you are staying at a hotel were the staff was paid above minimum wage, would you feel more secure? Yes. Seriously, is that even a question? Wouldn't you? Higher wages mean two things: the staff have more to lose by being fired, and by implication the hotel puts more effort into its staff. Which means they're probably recruiting more carefully and putting more effort into staff loyalty once they're there.

Then my point is that most hotel cleaning staff is paid more than minimum wage, so the scenario of the minimum wage staff is the uncommon scenario. I don't think wages affect honesty to any great extent, no. I think bad working conditions affect honesty a lot more. If you believe this to be true, do you ask the hotel how much they pay their cleaning staff, and choose the one with higher base pay? How much more are yo…

>I don't think wages affect honesty to any great extent, no. I think bad working conditions affect honesty a lot more.

Sure, but the two are closely correlated.

>do you ask the hotel how much they pay their cleaning staff, and choose the one with higher base pay? How much more are you willing to pay to be in a hotel which pays their employees a higher wage?

I'd be surprised if they handed that information out, and it's not worth a great deal of research. But if I do happen to know then it changes how much I'm willing to pay for a given hotel, yes. I haven't calculated every facet of my internal hotel-pricing model (and it's almost certainly nonoptimal in some way - just not worth the effort to optimize), but I've certainly been known to pay more for a hotel I had a better impression of that, and on the (IIRC unique) occasion when I happened to know what the cleaners at one were paid I'm pretty sure that was one of the factors.

Re: Hotel-room hacks: Picking the lock

#70

Post by dalke »

lmm wrote: post #69
dalke wrote: post #66

Earlier quoted context omitted.

Then my point is that most hotel cleaning staff is paid more than minimum wage, so the scenario of the minimum wage staff is the uncommon scenario. I don't think wages affect honesty to any great extent, no. I think bad working conditions affect honesty a lot more. If you believe this to be true, do you ask the hotel how much they pay their cleaning staff, and choose the one with higher base pay? How much more are yo…

>I don't think wages affect honesty to any great extent, no. I think bad working conditions affect honesty a lot more. Sure, but the two are closely correlated. >do you ask the hotel how much they pay their cleaning staff, and choose the one with higher base pay? How much more are you willing to pay to be in a hotel which pays their employees a higher wage? I'd be surprised if they handed that information out, and it…

If people started asking, and making decisions based on that knowledge, then perhaps salaries and working conditions would improve for the cleaners. But you are right, people (including myself) use other proxies instead.
Post reply on HN