Master Key Questions

Use a different design.

Bingo.

Only a minority of this additional cost is due to the better design. The majority is due to how many are produced.

However, come to think of it, don't the common masterkeyed pin tumbler locks have this vulnerability?

If so, then UL-437 using those designs isn't good enough. (But I think that there are MK-able pin tumbler locks which aren't vulnerable.)

Unfortunately there are costs associated with lots of things - and a good locking system is one on a long list.

If you discovered this many years ago - then I suspect that this wasn't a great secret being kept from all criminals.

By the way, the article was available over half a year ago. If all MK locks have been killed, somehow I've missed the news.

I am unhappy the Matt Blaze published his paper, but I don't think that the paper does more than slightly alter the security situation.

The concept is the same either way.

Just have to rekey.

Get it? Reboot? Rekey?

Get it? Reboot? Rekey? "

Unfortunately Chris the lock on my apartment I one that I have to live with... Can't re-key it... Someone a while back did that and the management company broke the door down once because some water was leaking... Cost the poor lady lots of money to fix the door...

Evan the maintenance man

patch" that will 'secure' the arrow lock on my apartment door which can now be compromised by any neighbor (an 'insider' who possesses some access rights) in my building who desires to 'reverse engineer' the master key -- perhaps you know where to find it that 'new security protocol which will assist me ??? Or should I ask Matt Blaze ???

have to live

and the

water was

door...

sure you can. you may have to have the appartment managment furnish their master key or they just may require that you give them a key. they may want to have their locksmith or maintenance man do it and charge you for it. anyway, it should be done on your request.

my2 "Key"

---snip---

You don't think the same neighbor could have just (and more easily) disasymbled their own lock and made a key based on that? The Blaze article is questionable with regard to harm/good ratio but it has been blown well out or proportion.

First off -- not for nothing -- I barely trust the maintenance staff here where I live to change a light bulb... In the 12 years I have lived here only about 40 different people have been employed in the two staff positions at the apartment complex... Second... They have not rekeyed anything in the 12 years I have lived here... They only do that when the occupancy of a given unit changes... As far as paying to have the locks changed by THEIR locksmith -- if I wanted to spend $100 on having a new lock (also operated by the master) I wouldn't... I would take apart the cylinder on my door and deduce the master for myself and key up a lock I could purchase for $40 myself... The whole point is that the door locks HAVE to be operated by the master key... With Matt Blaze publishing IN DETAIL how to reverse engineer a master key the 5pin AR-1 keys that operate my lock seem to have become much less secure... Can you do the math ???

Anything can be done at anyone's request... The point was that the lock will still have to remain masterkeyed... Why would I want to pay $100 to have a new set of keys that are still open to the form of attack I seek to keep out ???

Evan the maintenance man

My wife comes from a family of apartment managers (mother and sisters). None of the apartments they are/were in charge of were ever mastered. Still doing the box in the office with 200+ keys on racks. Don't know if mastering just never caught on down here or if it was for another reason. Plenty of mastering going on in commercial side around here though.

Maybe that is just a regional difference -- or maybe they just don't want to be held liable to rekey all of the locks if they loose a master key... Every apartment I have lived in have had locks master keyed... That is just how it is around here in Massachusetts...

Evan the maintenance man

Well, if you can't do anything about it, then maybe don't ask the question?

managment furnish

them a key they may

charge you for it.

maintenance staff here

have lived here

two staff positions

rekeyed anything in

the occupancy of a

changed by THEIR

lock (also operated

cylinder on my door and

purchase for $40

be operated by the

reverse engineer

to have become

the apartment

years = ?????

where they copy the

keys have there

too many..

are you sure about that ? I do not know of any apartments that operate that way. (guess anything is possible)

to pay $100 to

attack I seek to

its not really your choice to make. its the landlords. relating to my origional statement above. if I owned the building and chose to have my locksmith service my locks and master system. (would also be in my rental contract) then a tenet (like yourself) took apart my cylinder on my door and deduced the master? that tenet would have serious legal problems to deal with.

my2

In article <K4SZb.15182$ snipped-for-privacy@newsread3.news.atl.earthlink.net>, Evan snipped-for-privacy@hotmail.com wrote: :40 people who have been employed as maintenance techs in the apartment :complex + AR-1 keyblanks + No rekeying in (at least)12 years = ????? How :many keys are out there ??? I know I have three change keys and that one :also resides inside the lock box in the maintenance room where they copy the :keys... So that is 4 change keys -- but how many master keys have there :been ??? : :Anything can be done at anyone's request... The point was that the lock :will still have to remain masterkeyed... Why would I want to pay $100 to :have a new set of keys that are still open to the form of attack I seek to :keep out ???

In comparison with the 40 people who have held master keys over the years and the ease with which a cylinder could simply be disassembled and decoded, the liklihood of someone doing a "Matt Blaze" reverse engineering of your building's master key is, IMO, a negligible added risk.

No math required. There are easier methods to get the master applicable to anyone with a lock on their door which responds to the same master. Casual visitors to the building might be another story.

So based on that reason alone why do you rent there??

The real problem from everyones perspective though is that the landlord might well never know irregardless of method used to obtain the master key.

Unless a tenant was caught redhanded with a master, probably while breaking into something, any burglary(s) believed to have been committed with a master key would most likely be blamed on the landlord, or other individual known to be in possesion of, or have access to a legitimate master key.

In the end the solution for renters is A. If at all possible don't rent, buy, then the decisions are up to you. I can still tell you though that with most houses the locks are not going to be the weakest link (except to someone with a previous copy of a key if you don't rekey, which would be a bad idea) no matter how crappy they are. B. If you must rent don't rent from someone that won't meet your security needs with regard to keying of units and anything else you require for that matter.

So where would you draw the line ??? Local town bylaws and State Board of Health regulations only require that locks are changed on turnover of tenancy to a new person... It doesn't say when systems need to be remastered... How many employees would you have changed all the locks at ??? At what point in the turnover of tenants would you rekey all the building entrance doors ???

I know what my answers are... And with unrestricted keyways it would be quite often... On a system where you know people can not obtain keyblanks and the person who is leaving does not have access to either the blanks nor the system bitting sheets I would not get into changing the locks... But on an open system where maintenance guys go off to Home Depot quite often for supplies and things the hardware aisle is so tempting... I can hear the key machine cutting another key right now a 'spare' just in case they lock themselves out...

Evan the maintenance man

He doesn't need to draw the line. Neither does some governmental agency. YOU DO. You are the one paying the rent. Don't rent from someone who uses keying practices you feel are unsafe. If you must rent from someone who does, and why would you? The solution has been posted here and other places again and again. Get the landlord to agree to allow a lock to be added to the door with a key provided them sealed in laminant or some other means which provides clear evidence if it is opened. If they won't do that don't rent from them. Other than these options there are no others except to whine about the problem.

Not being able to buy a correct blank is not nearly the problem to anyone with a modicum of intelligence some would have you believe for reasons I won't go into here. Restricted systems offer protection from casual copying and that's about it. That protection increases somewhat with true high security designs e.g. sidebars etc.

But on

This has nothing to do with your criticism of the Blaze article. It is however a more realistic concern.

Simple...

One... Because I have lived in the unit for over twelve years...

Two... Because the rent here is cheaper than it is anywhere else in town...

Even the big fancy apartment complexes around here don't remaster locks... I do know enough people who live in town to know that locks are not changed often...

Evan the maintenance man

Not being able to buy a correct blank is not nearly the problem to anyone with a modicum of intelligence some would have you believe for reasons I won't go into here. Restricted systems offer protection from casual copying and that's about it. That protection increases somewhat with true high security designs e.g. sidebars etc. "

Umm No I don't need to draw any lines... The landlord has control over all of the locks and keys... That is a fact of life... They own the building... Just like someone renting an office has no control over the locks and keys used on the space if their lease doesn't allow them to... As far as your idea of putting a key inside a plastic 'break-open' device thats a waste of time and money... They aren't going to let me 'visit' it over in the office... Once it gets used then what ??? Take it back form them and get another one ??? How many times in a large apartment complex of four story buildings do you think maintenance has to enter a unit to check things ??? I keep valuable stuff out of sight and locked up in the bedroom far away from all sources of water so there is no reason to need to enter that room without me being there... But I have come home to work to find water having leaked from the ceiling above in the bathroom and someone had to cut a hole to get at the pipe where it broke in the wall... I would not want to have to pay for replacing a door and locks on it just to keep people out... The apartment complex has the right of emergency entry into units they own... Locks only keep out the honest people...

Evan the maintenance man

Then why are you complaining about the master key vulnerability? Do something about your situation if it bothers you. Don't whine about it if it doesn't.

How would tenants know if a lock was remastered? As far as that goes how would most of them know if it's mastered at all?