A different perspective on Matt Blaze

The bottom line is that 90% of low to medium security locks can be quickly compromised in one way or another. The vast majority of those that want and can afford high security locks have them already. Many of those that don't will NEVER upgrade them for a variety of reasons. Upgrading locks is more time consuming and costly than going to a software vendor website and downloading the latest security patch. The result of the Blaze paper is that a relative few systems will be upgraded to something more secure and the vast majority will not be and will be left open to a now much more well known attack.

I like that! Great security, just hide it and hope it goes away. Matt Blaze is a well-known expert in his field. He may actually be right.

Very well put!

Matt Blaze is an expert in computer security. There is little similarity in patching holes in computer security and patching holes in physical security. I notice you carefully avoid taking issue with any of the points I made.

Excellent post calocksmith!

Virtually all of the criticism dumped on Dr. Matt Blaze so far is totally based on conjecture. It's all alarmist suppositional reasoning totally unsupported by any facts or events. No evidence in the form of crime methodology statistics is offered to show that any correlation exists to support a claim that any prior disclosures of esoteric security information ever caused an increase in crime. On the contrary, security is usually improved as a natural consequence of any security assessment that exposes vulnerabilities. However, the truth will never satisfy those unable to recognize it or respect it.

Is there any credible evidence that any previous disclosures of lock or security system vulnerabilities directly attributed to the increase in crimes specifically applying that information?

If so, let's see the critics present right here, right now!

Since you're making the challenge here I can't help but find it a bit strange that you support none of the documentation you seek to back up your statement with regard to improved sucurity.

There was a foul mouthed self admitted felon who posted techniques for compromising security on this very forum. Here's a first person account of somone using his information obtained on this forum for criminal purpose:

Should have said:

Since you're making the challenge here I can't help but find it a bit strange that you provide none of the documentation you seek to back up your statement with regard to improved sucurity.

Well of course the successful duplication and use of a master key doesn't necesarily leave any evidence of a crime. Concievably a sophisticated burglar could perpetrate a series of thefts in a given premises. The evidence would be missing property - without obvious damage these tend to fall into the realm of "mysterious disappearnces". In facilities like large office buildings the number of potential suspects can easily reach into the hundreds. It woudl become apparent that something was amiss when the number of similar incidences became to large to explain away. Common thieves are the least of our worries in this kind of attack. Of more concern is the more sophisticated thief who is seeking sensitive information; or to compromise data communication systems or perhaps plant listening devices to name a few exposures. of course criminals at this level (or terrorists) probably have been aware of the weakenesses in MK systems for decades. Perhaps one solution is for the industry to avoid making MK systems overly grand - e.g. separate systems for perimeter doors, and sensitive areas for example.

I have to agree with nospamzapper on this one. The critics have not proven their case. You need to carefully read what nospamzapper asked. The burden of proof is on the critics who focused their criticism on Matt Blaze, and their case needs documentation, not conjecture. Any judge would laugh you out of court if your "evidence" was a "newsgroup entry" from a boastful "self-admitted felon" and one of his friends. The word is "credible" evidence.

Certa (snip)

I notice you aren't as eager to comment on the articles regarding computer hacking. I also noticed nospamzapper posted no "credible" evidence, or any evidence at all for that matter, to back up his/her assertion that release of security information is in any way beneficial either. I notice that unsurprisingly you have also failed to do so.

Um gee you don't think that the fact that there is little documentation that this has occurred in the physical security area is because those of us concerned with physical security aren't in the habbit of making the information publicly available in the first place do you? No that couldn't be it.

On the other hand where computer security is concerned there is plenty of evidence that the general openess with regard to security holes has made it possible for every wannabe cracker in existence out there to go out and break into at least some systems that they would never have been able to access if the vulnerbilities had not been handed to them on a silver platter. I'm sure if most people involved in physical security were to take the same approach as our computer security counterparts you would see the same thing occur with regard to physcial security, which is much harder to patch after the damage has been done. THAT'S WHY WE DON'T DO IT.

I posted the CERT policy a few days ago. They generally delay in releasing news of vulnerabilities to allow the vendors to react before making the news generally available.

Why would they go to this trouble unless they felt that immediate release of a vulnerability would cause in increase in crime?

Is CERT enough of an authority for you?