Will this get me fired?

well, if a locksmith charges the "building/owner" for generating the system ? the "building/owner" owns the system...

my2¢

It all depends what was in the contract. If the contract was silent on the matter, then there would seem to be no obligation on the locksmith to disclose the bittings of the system.

If the system is 'restricted', then access to the bittings may be 'moot', since the terms of use of the system may mean another locksmith is not permitted to work on the system even if he happened to have the blanks.

A customer as a condition of ordering could always include a requirement that the bitting be made available upon request for a reasonable copying charge and that the job file is endorsed to the effect that the bitting sheets are the customer's property.

It doesn't much matter. MK systems like what you describe are virtually all fatally flawed. They are vulnerable to Matt Blaze's incredibly simple rights amplification attack which allows virtually anyone to create a MK without even taking apart any locks in the system. Edwards, who it appears advised you, knows that too and yet I don't see any mention of it in your letter. These systems are a ticking time bomb in terms of liability and there is really no way to fix them without upgrading to restricted keyways or eliminating the master keying altogether.

I bet Billy's book doesn't say anything about the rights amplification attack I mentioned huh?

How many units in the complex? The first thing that your employer should be asking themselves is whether or not a MK system is really even needed. Is it actually necessary or is it just a convenience? MK destroys security to such a degree that in many instances it's hard to justify doing it at all.

Unless this is a restricted Schlage keyway, and he doesn't say that it is, how is he going to generate a correct system? Any system he designs will still be vulnerable to the Matt Blaze rights amplification attack which can easily compromise the whole system. Hard to believe a board full of locksmiths don't know about that since it was published years ago but nobody has told him anything about it.

Matt Blaze subjects has been discussed here many times. no real need to do it again..

That doesn't address the issue. He is concerned about liability. The system he is working with is fatally flawed and really cannot be fixed. It will always be vulnerable to the attack Blaze describes. It should be scrapped and totally replaced. If it isn't his employer and perhaps he himself if he is a licensed locksmith who should know better are civilly liable if it's compromised.

I am not the one that brought up Matt Blaze..

I responded to him at the beginning of this thread telling him basically the exact same thing you just responded above. (less the Blaze reference)

Be that as it may, but some of these time bombs have been ticking a very long time. If there were continuing and significant problems then the insurance industry would surely have insisted on upgrades by now.

What exactly are your qualifications to determine such sweeping generalizations like "MK destroys security to such a degree that in many instances it's hard to justify doing it at all" ???

You come across as more of a Blaze groupie than someone who is actually qualified to discuss designing a Master Key System...

Evan, ~~ formerly a maintenance man and now also a former college student...

To generate a "correct system" one would follow the minimum acceptable professional standards of the trade...

If you are so up on the technique described by Mr. Blaze then you are well aware of the fact that even systems that utilize "restricted keyways" are still vulnerable to the "rights amplification attack"... The fact that the system being attacked uses a "restricted keyway" only makes the attack slightly more difficult -- not totally impossible...

So you are in your zealous defense of Mr. Blaze still incorrect in your advice if you were out to tell this gentleman asking what to do with his poorly designed Master Key System... Since even "restricted keyway" systems are still vulnerable, it would not solve the problems that you have raised by criticizing how easy it is to compromise security by using Mr. Blaze's method...

What I find hard to believe is that Mr. Blaze didn't realize (or research) the fact that his "attack" was previously discovered in 1958 by James Dayton, Jr. and has been referred to by members of the trade that know about it as the "Dayton Method"...

I wonder if either you or Mr. Blaze were aware of that ???

All you and others who support the work of Matt Blaze are doing by carrying his torch and waiving his banner as if you were members of some crusade are doing by making this so controversial is encouraging people who before Mr. Blaze published on this topic had absolutely no knowledge of the "attack" to use the method... Since you are a Blaze supporter, let me put it into terms you might better understand:

"A legitimate hacker finds a security hole in a system... Someone else comes along and finds his "wares" that will exploit this security hole and use them without ever understanding anything on how the "wares" work or why... I believe such people are called "Script Kiddies" by the real hackers who actually know what they are doing..."

So which are you ??? Someone who actually knows what he is talking about or a banner waiving Script Kiddie who spent a few minutes reading Blaze's work who know thinks he knows everything about the entire locksmithing industry ???

Evan, ~~ formerly a maintenance man and now also a former college student...

My experience is having used the Blaze method and also other methods like picking to defeat MK locks in a number of instances. The Kwicksets non-high security Schlage and other locks of that ilk usually rake open in seconds when MKed and the Blaze attack worked on everything I tried it on. Nevermind the blatantly obvious attack of anybody with a lock on the system e.g. an apartment dweller with one on their front door taking it apart to make a MK. Security of most locks is mediocre at best. When they are MKed it's abysmal.

And you come across as having a stick rammed deep in your rectum and being unable to remove it. Go find someone to help you pull it out.

Flunked out?

Ah... I see... And prior to your reading Blaze's publication did you know how to do the thing that you claim excellent proficiency at doing ???

Not to mention that it takes time and effort to do the Blaze attack... Why would you waste such time when you could procure ONE bump key that could be used against ALL locks using the keyway rather than ONLY the ones keyed to the Master that you have just decoded ???

Hmm... Also your earlier reply mentioned nothing of picking or drilling -- two things more likely to occur than a Blaze attack...

I'll ask again, who are you to make such claims that ALL locks are inferior when you proclaim to be nothing more than a criminal proficient in something that will eventually catch up with you ???

Also -- when you run into "real locks" rather than the stock off-the-shelf Kwikset or Schlage let me know how successful you are at picking them and/or using the Blaze trick...

Which would still leave the lock vulnerable to the rights amplification attack since the trade has pretty much played Ostrich on the whole issue much like they have on bump keying.

In practice it makes it a lot more difficult no matter how much you try to spin it.

Quote one line where I zealously defended Matt Blaze. I merely cited his article and have since pointed out some rather obvious facts that you seemed to have missed. Try not to get so emotional. Take a Valium or whatever you need to do to get yourself under control.

still

Better be careful there. You're giving away 'secret' information. See you're just like Blaze, except he seems to have done it for academic purposes and you are doing it just to make some point or prove what a smart guy you are.

it would not solve the

At least I raised the issue. You posted to the thread over and over and didn't say one word about the rights amplification attack so I suspect you're knickers are now more in a twist over the shortcomings of your own advice than over anything I wrote. If you are such an expert on the rights amplification attack why did you choose to remain silent on it when somebody was specifically worried about liability issues which it is extremely relevant too? Well?

If you actually read the Blaze paper instead of just blathering on you would have seen that Blaze acknowledges that the method is not new and was probably independently discovered multiple times before he wrote about it. Since I actually read the paper I'm aware of this.

Practically speaking it doesn't make any difference, other than perhaps to make anyone who implements these systems MORE liable since according to you the flaw has been known for far longer.

Horse Hockey. The industry has been using a fatally flawed method of MK'ing for, according to you, at least 49 years and you want to blame the person who blew the whistle on it? Now that's hysterical. Let me give you some advice: If you set up these systems and are ever sued under no circumstances should you take the stand in your own defense. You will bury yourself.

to use the method...

Actually you have no evidence to claim I'm a Blaze supporter. He wrote a paper. The paper is technically accurate. I referenced the technically accurate paper. That's it.

let me put it into

This is basicly the failed argument advanced by everyone who defends a flawed security product whether it be a lock or software or anything else. Your argument with regard to security doesn't even begin to hold water because you have no way to know or prove who knows about the flaw and you have no way to prevent those who find out about it from disclosing it to whoever they want for whatever reason they want. This is all doubly true over an exploit so ridiculously simple that it has probably been independently discovered hundreds if not thousands of times. Your arguments are just an irrelevant rant directed at anyone you see as blowing the whistle on what you foolishly think should be kept a secret, even from those who pay for the systems. The only solution is to fix the problem. Period.

LOL You definitely need that Valium. I can see you foaming at the mouth as you write this. I never said anything about knowing everything about the entire locksmithing industry. I merely mentioned a documented attack on MK systems and alluded to the fact that in many cases they are dangerously insecure, which they clearly are. Forget the rights amplification attack written about by Blaze. With most systems anybody can simply take apart the lock on their front door and determine the MK biting to get in numerous other apartments or whatever the case may be. You are good at babbling off on irrelevant tangents I'll give you that. None of your irrelevance has anything to do with the fact that someone who has liability concerns regarding a system he is working on should be aware of the rights amplification attack on MK systems. None of you posting to the thread said a word about it. I brought it to his attention. Now he knows.

You responded to my post about the rights amplification attack. That was the issue brought up in that post.

Maybe you could be so kind as to quote it because I can't find where you said one word about the rights amplification attack with or without a reference to the author.

This is such a convoluted interrogatory I'm not even going to try to figure out what it means.

To test the Blaze method OBVIOUSLY. As far as practical application and security in general I hate to break the bad news but bump keying doesn't work all the time on all locks. It's noisy. It leaves marks and someone standing at a door tapping on a key tends to get noticed so I would say a compromised MK is a bit worse than a lock that can maybe or maybe not be bumped.

So your point is what? That most locks are hopelessly insecure and vulnerable to a wide range of attacks? Agreed. Still drilling leaves evidence of entry, makes noise and takes more time than using a MK. Picking takes more time than using a MK and requires sticking something which obviously isn't a key in a lock for anyone to see. A compromised MK is obviously a bigger threat and harder to detect than either of these things.

I never said "ALL locks are inferior" since that wouldn't even make sense unless I said what they were inferior to. I'll leave the nonsense to you, you seem to have a knack for it. It doesn't really matter who I am. YOU are the one making the points about lock vulnerabilities every time you post. All I brought up was the rights amplification attack and picking with a casual mention of bumping related to industry non-action. You just confirmed bumping and added drilling to the list of vulnerabilities.

when you proclaim to be nothing more

Is English your second language? Quote where I used the word "criminal" or said I had done anything illegal. The fact is if that's your assumption you probably are one yourself and thus assume others have similar motives to your own.

Well you've already pointed out for us all that the "Blaze trick" can be used on restricted keyways, so just what "real locks" did you have in mind? Medeco? Still vulnerable albeit with more effort, especially according to you since higher security locks like Medeco tend to rely more and more on restricted keyways as the desired level of security increases. You have already claimed that restricted keyways provide little protection against rights amplification so according to you one of the main features seen with many high security designs is nearly worthless.

correct, I responded about Blaze only after you mentioned him. again, Matt Blaze subjects has been discussed here many times. no real need to do it again..

you won't find it because I never mentioned the Matt Blaze amplification attack to the OP. what part of (less the Blaze reference) did you not understand ?

When you criminally trespass by tampering with door locks that do not belong to you in your "experiences" with the Blaze method... You have admitted somewhat anonymously that you trespass into the property of others on a routine basis...

So that would make you a criminal... If you don't understand that I'd love to see the look on your face when the day comes and you get caught in the act while performing your precious "rights amplification attack" and most of what you have in your pockets will carry charges of a separate count of "possession of burglary tools" for each item you have on you... That would truly be a Kodak moment if there ever was one...

Ok... LOL... More power to you if you can hand-file a Medeco keyblank so you can be quiet during your "attacks" that also still operates the lock when you are done... The machines that can originate those keys make a lot more noise than a bumping tool... Or do you sneak back and forth to the door each time you cut the key to the next depth like some kind of rodent ???

Oh, and I bet you have a collection of the Medeco "restricted keyway" blanks on hand as well... Just because your smart ass replies seem to attempt to cover all the bases...

So let me ask you this ??? If you feel that many of the high security designs are "worthless", since they are vulnerable to the "attack" you really really admire and use, how would you go about securing a door that you wanted to keep unauthorized people from opening ???

He has admitted nothing of the sort. You make a lot of assumptions which lead to a lot of stupid, and frankly libelous statements. Matt Blaze reportedly tested this method too. Do you think he tested it without the owners of the systems giving their permission? What makes you think this guy did? Do you know he doesn't own the systems he tested it against? Got any evidence at all he committed any crime?

The machines that

Good luck Bumping Medecos. That said there is no comparison between the loss of a master keys biting which would enable undetectable entry over and over on a continuous basis and other bypass techniques that have to be done from scratch each and every time.

Or do you sneak back and forth to the door each time you

That's probably exactly what someone trying the Blaze method on Medecos would do. Someone trying it out on their own door to their own private space would set a key machine up inside. Pretty simple really.

You're the one who couldn't resist pointing out to him that restricted blanks (in your opinion) didn't provide much protection.

Just because your smart ass replies seem

To be blunt and honest with you you provoked most of his sarcasm. You make claims that he said things he never said and assumptions that you have no logical basis for.

Here's an example of what I just said. He didn't claim that "many of the high security designs are "worthless". He said: "You have already claimed that restricted keyways provide

He claimed "worthless" was essentially your position with regard to a single feature. You then twisted it around into something entirely different. The fact is you made this point for him. My advice is to you is quit while you're behind because you're getting trounced. It's painful to watch.