this post was submitted on 12 Nov 2023
1479 points (96.1% liked)
tumblr
3451 readers
332 users here now
Welcome to /c/tumblr, a place for all your tumblr screenshots and news.
Our Rules:
-
Keep it civil. We're all people here. Be respectful to one another.
-
No sexism, racism, homophobia, transphobia or any other flavor of bigotry. I should not need to explain this one.
-
Must be tumblr related. This one is kind of a given.
-
Try not to repost anything posted within the past month. Beyond that, go for it. Not everyone is on every site all the time.
-
No unnecessary negativity. Just because you don't like a thing doesn't mean that you need to spend the entire comment section complaining about said thing. Just downvote and move on.
Sister Communities:
-
/c/TenForward@lemmy.world - Star Trek chat, memes and shitposts
-
/c/Memes@lemmy.world - General memes
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Mechanical lock manufacturers are a fucking clown show and the very concept is fundamentally flawed. I don't know if I hate it more than the IoT/cloud bullshit, but it's up there.
Mechanical locks CAN be designed well. If you put good security pins in there and have decent springs in them and make the exterior of the lock out of a good material they can be way more secure than any digital "smart" lock
You can always just smash a window.
Windows can be fortified against that kind of attack.
Your windows aren't buglary proof?
So can even the most superfluous IoT devices, though. It's just that they aren't.
Typical mechanical locks are fundamentally flawed. Think of it like this: They are opened by a short combination of digits, represented by the key. There is no lock-out mechanism if someone keeps trying to guess the combination, even if they try many per second and there is no user-friendly way of resetting the combination if it has been compromised.
The tolerances, even in good locks, have to be high enough to enable attackers to guess the combination digit by digit, not as a whole, significantly reducing the time needed to guess it. You can try to mitigate this a little with special pins and weird key ways, but it's ultimately a necessity, otherwise the lock would constantly fail to open or even break.
When you have a master-keyed system, the digits represented by the master key (the root password, essentially) will always be lower or equal to any non-master key you find. This, too, can be exploited, allowing an attacker to safely derive a master key from any other key in the system.
Also, keys can be reproduced from photographs. That alone is a disastrous flaw. Just imagine the CVEs that would be written about the flaws above, and the manufacturer's response. "But you need skills for that" is never an excuse in the digital realm, it shouldn't be in the analog either.
Meanwhile a well-implemented digital lock has all the important components on the other side of the door, exposing only a contactless card reader to interact with. The cards or tokens aren't dumb data storage, they support public/private authentication, meaning they can not be copied by someone walking up to you with a high-powered reader. There is no port to connect to, no pins to jiggle, just a dumb NFC reader that you can't even open non-destructively.