Speaker 1: Brought to you by Toyota. Let's go places. Welcome to
Speaker 1: Forward Thinking, Pater and welcome to Forward Thinking, the podcast
Speaker 1: that looks at the future and says they take you
Speaker 1: away and throw away the key. I'm Jonathan Strickland, I'm
Speaker 1: Lauren bo and I'm Joe McCormick, and i want to
Speaker 1: ask you guys a question. I'll go to the prom
Speaker 1: with you. You guys are so sweet. It wasn't the prom,
Speaker 1: it was the enchantment under the seat. That's thank goodness,
Speaker 1: because it's two thousand and fifteen. You know what year
Speaker 1: that is. To the future too. Anyway, what's your what's
Speaker 1: your actual question? No, no, no, I may have made
Speaker 1: this comparison before, but I've got to make it again.
Speaker 1: Do you remember all the Internet paranoia in the nineties, Yeah, yeah,
Speaker 1: And so thinking back on it now, it's often very
Speaker 1: funny because we were all thinking back then, oh no,
Speaker 1: what if evil techno criminals used the net to do
Speaker 1: horrible things? And and it's funny how some of the
Speaker 1: fears we had back then turned out to be hilariously
Speaker 1: wrong and overblown, you know, like Sandra Bullock gets caught
Speaker 1: in the net. Yeah, it turns out. She was perfectly fine.
Speaker 1: She never got she got caught in a net, but
Speaker 1: it wasn't the net. But then, uh, some of it
Speaker 1: represented threats that we actually do have to deal with
Speaker 1: now that we're in this this internet, ubiquitous future. Identity, theft,
Speaker 1: privacy compromises. I mean, these were things people were worried
Speaker 1: about back in the nineties and that they turned out
Speaker 1: to become reality. Sure, yeah, not everything depicted in those
Speaker 1: films was completely off base, although it was almost always
Speaker 1: you know, because it has imagined in a hilarious way,
Speaker 1: overly dramatized. And that certainly that the user operating systems
Speaker 1: were like nothing that we've ever seen. I know this UM,
Speaker 1: and I think we're sort of living in a similar
Speaker 1: era for three D printing. Sure we don't know yet
Speaker 1: what we're worrying about too much and what we're not
Speaker 1: worrying about enough. Sure, well, especially for people who have
Speaker 1: had very limited experience with three D printers. They've heard
Speaker 1: about them but never had direct experience. Joe, as someone
Speaker 1: who has had direct experience with three D printers, would
Speaker 1: you say that the three D printer we have here
Speaker 1: in the office would be capable of printing anything that
Speaker 1: someone should be worried about remotely. Are you worried about
Speaker 1: tangled masses of plastic hair? Yeah? See, here's the thing.
Speaker 1: It sounds like the plot of a Japanese horror movie
Speaker 1: actually if it's in front of the person's face. Uh So,
Speaker 1: we have printed stuff out with a three D printer
Speaker 1: here at the office. It's just it takes a lot
Speaker 1: of of paying attention, Like you can't just hit the
Speaker 1: print and walk away because the materials themselves in our case,
Speaker 1: I think we're using p L A plastic, but the
Speaker 1: materials themselves are uh you know there. They need a
Speaker 1: certain temperature to operate at, and beyond that you're either
Speaker 1: not going to get the meltedness you need for extrusion,
Speaker 1: or it's going to be too warm and then the
Speaker 1: stability of the build will be compromised. Or the build
Speaker 1: plate isn't leveled, or you haven't aligned everything correctly in
Speaker 1: your your pre planning phase, trying to print at a
Speaker 1: level below where the plate is or something, or your
Speaker 1: design has a key element missing some kind of structural
Speaker 1: bit to it that just isn't quite there right. I
Speaker 1: recently had a mask three D printed for a costume
Speaker 1: and in that case, the mask was divided into three pieces,
Speaker 1: because if we had tried to print it as one
Speaker 1: full piece, it would have been very It would have
Speaker 1: been a miracle if it had come through with the
Speaker 1: structural integrity intact and not folded in on itself. The
Speaker 1: point being that three D printing, at least on the
Speaker 1: consumer level, has come a long way, but it's it's
Speaker 1: still fairly primitive, and it's it's not like you can
Speaker 1: hit print and you get a gorgeous coffee mug at
Speaker 1: the end of it. You're gonna get something that's made
Speaker 1: out of plastic. Depending upon the sophistication of your printer,
Speaker 1: it may be fairly there may be some fairly obvious edges,
Speaker 1: especially like just between the layers of the plastic that's
Speaker 1: been like a plastic plastic pixelation. Yeah, yeah, it's it's
Speaker 1: not like a smooth surface like you would get from
Speaker 1: something that was molded plastic. Well, I mean, certainly, to
Speaker 1: a certain degree, you're right, But also I mean, if
Speaker 1: you're willing to shell out a lot of money, there
Speaker 1: are some really good printers out there. These show absolutely
Speaker 1: and in labs and research labs, there are extremely good
Speaker 1: printers that can print with with metals and with glass even. Yeah,
Speaker 1: it's it's a little bit beyond even the pro summer
Speaker 1: level obviously, But the point being that, uh, some of
Speaker 1: the fears around three D printers might be a little premature, right,
Speaker 1: But but there are all kinds of fears people have
Speaker 1: because I mean, obviously it's not exactly analogous the Internet,
Speaker 1: because the Internet was a more ubiquitous kind of information technology.
Speaker 1: You know what, anything that people could do to you
Speaker 1: socially in general life that didn't involve physical contact they
Speaker 1: could do over the Internet. Sure, but there's there's there
Speaker 1: are fears that some of which are are vaguely valid
Speaker 1: in the like like especially for the future about three
Speaker 1: D printers. Uh, you know it's not all the like
Speaker 1: Oh no, cats and dogs three D printing together. Uh,
Speaker 1: copyright infringement. I suppose that the fair fear sort of
Speaker 1: the I mean, it's almost difficult to even call it copyright.
Speaker 1: It is certainly intellectual property. The idea of of let's
Speaker 1: say that you own a furniture store. Someone comes in,
Speaker 1: takes pictures of a table that you have designed, and
Speaker 1: then goes and uses additive manufacturing a three D printing
Speaker 1: process to essentially replicate that table. There's they're stealing your work.
Speaker 1: You could at least you could argue that this is
Speaker 1: my plastic table now. Yeah, or or especially with art
Speaker 1: or something like if you really wanted a sculpture and
Speaker 1: you had an extremely good three D printer, then you
Speaker 1: know that sucks for the artist. Yeah. I thought it
Speaker 1: was funny back when everybody freaked out that somebody three
Speaker 1: D printed a gun, because I was like, you can
Speaker 1: buy guns a lot more easily than you could three
Speaker 1: D print one. Well, let's say you've got a criminal record,
Speaker 1: but you also have a large bank account. You buy
Speaker 1: a three D printer and you can print as many
Speaker 1: guns as you would, But you can go into any
Speaker 1: you know, legitimate establishment and have difficulty buying guns. Not
Speaker 1: great if you have a criminal background. You probably also,
Speaker 1: i mean, assuming it's a large amount of money, you
Speaker 1: probably can illegally obtain a gun with you know, a
Speaker 1: good ten dollars anyway, Right, But it's still one of
Speaker 1: those things that you know, you think, oh, well, this
Speaker 1: could suddenly put a not only could it put guns
Speaker 1: in the hands of people, and that's kind of scary,
Speaker 1: you know, without any sort of regulations right. But also
Speaker 1: on the other side of it, beyond that scary thought
Speaker 1: is if the person is not careful with the materials
Speaker 1: they're using to build their gun, you could end up
Speaker 1: with something that maims the person who built it. Even
Speaker 1: if they are just like, Hey, look at this cool
Speaker 1: thing I built. I'm going to take it out to
Speaker 1: the shooting range and I'm going to shoot it there.
Speaker 1: I'm not playing on shooting anyone else. You're talking about
Speaker 1: using something that's you know, if you're not using the
Speaker 1: right plastic, the forces of a of a bullet being
Speaker 1: fired could be enough to shatter that and severely hurt
Speaker 1: the person who's actually using the gun. Oh. Absolutely, the
Speaker 1: type of plastic that Cody Wilson used in that demonstration,
Speaker 1: we were far beyond the grade of the usual p
Speaker 1: l A that's found in most commercial level three D printers. Yeah,
Speaker 1: his gun was called the Liberator. Jonathan and I did
Speaker 1: an entire episode in which we mostly contained our snark
Speaker 1: about defense distributed Tody Wilson um back in it was
Speaker 1: called printing a gun that was over on tech stuff.
Speaker 1: So if you somehow missed that story, you've been living
Speaker 1: under a rock for a couple of years and or
Speaker 1: you'd like to go back and hear some details about it.
Speaker 1: Go ahead and check that out. It is on the interwebs. Yeah,
Speaker 1: but like all of your security information, speaking of security, okay, Yes,
Speaker 1: that that seguates us into into a story about Yeah,
Speaker 1: it ends up getting us to a story about how
Speaker 1: three D printing could cause a threat to one element
Speaker 1: of security. In fact, has that. It's not could, it's
Speaker 1: it's happened. It's it's out there. It's going on right now.
Speaker 1: We're all do it's your keys, it's your key, specific
Speaker 1: your luggage. It could be any key, but specifically, we're
Speaker 1: gonna start talking about the t s A approved locks
Speaker 1: that you would use on your luggage. Yeah, so I'm
Speaker 1: gonna tell a little story. On November, the Washington Post
Speaker 1: ran a story by Ashley Halsey the third titled the
Speaker 1: Secret Life of Baggage? Where does your luggage go at
Speaker 1: the airport? It sounds like it sounds like one of
Speaker 1: the movies they would watch on Best of the Worst Media.
Speaker 1: It's so magical, like your luggage has a little magic
Speaker 1: gnome kingdom and you know, you know, I would have
Speaker 1: that plinky music that do do do do do do
Speaker 1: do do do do as you watch it go through anyway,
Speaker 1: Sorry you were saying no no. So it was an
Speaker 1: article looking into US Transportation Security Administration. So that's the
Speaker 1: t s A. You're probably familiar with it screening practices
Speaker 1: for checked bags, and it was telling the story of
Speaker 1: what happens to your stuff after you check it, and
Speaker 1: I thought it was a pretty interesting article. Actually, it
Speaker 1: talked about the machinery and the procedures used to screen
Speaker 1: traveling containers. And the key part of the story that's
Speaker 1: relevant to this topic is that the author talks about
Speaker 1: how the t s A has a set of master
Speaker 1: keys that can open all t s A approved locks
Speaker 1: on luggage, which makes sense if your job is to
Speaker 1: to be certain that stuff going through the airport, going
Speaker 1: onto airplanes doesn't contain dangerous materials. Right. The t s
Speaker 1: A started saying, well, we need to screen this luggage
Speaker 1: for important security purposes, but if people are putting locks
Speaker 1: on their luggage, then we might have to cut their
Speaker 1: locks off, which is, you know, a waste of that
Speaker 1: person's resources. So please buy these t s A approved
Speaker 1: locks that the t s A has master keys for,
Speaker 1: and then we can rifle through your personal belongings without
Speaker 1: destroying any of them on purpose, and you'll never know
Speaker 1: because the lock will be back on them again. Yeah,
Speaker 1: But anyway, so people are people. If you want to
Speaker 1: lock your luggage to keep people out of it, but
Speaker 1: you don't use the t s A approved lock, and
Speaker 1: the t s A agent wants to check what's inside
Speaker 1: your bag, they'll just use bolt cutters, which I guess
Speaker 1: is is at least a little better than you know,
Speaker 1: damaging your bag directly to get at what's inside of it, right,
Speaker 1: knife in the side of the bag just barely better
Speaker 1: than that. So the problem is that somebody published a
Speaker 1: version of this story that contained a very problematic picture.
Speaker 1: And I word it that way because I honestly can't
Speaker 1: tell if the image that I'm going to talk about
Speaker 1: originally ran with the story when it was published on
Speaker 1: the Washington Post page, or if it only appeared in
Speaker 1: a reprinting of the story on a site called Harold
Speaker 1: dot net, which some sources refer to. Uh. The Washington
Speaker 1: Post version of the story does not have the offending
Speaker 1: image anymore, if it ever did, got you, but that
Speaker 1: offending image would be a picture of a hand holding
Speaker 1: a series of the master keys for the various types
Speaker 1: of T s A locks. Yeah, it's a close up
Speaker 1: image of all of the master keys that can get
Speaker 1: into all your bags. So in other words, if you
Speaker 1: take a look at this, you can see the shapes
Speaker 1: of each of those keys. Whoops, which you know all right.
Speaker 1: Back in the day, it would have taken quite a
Speaker 1: lot of work to create a key to you know,
Speaker 1: use like a piece of metal and then grind it
Speaker 1: down just right based upon the way it looks in
Speaker 1: a picture. But that could have been done and we'll
Speaker 1: talk about that later. Yeah, well, certainly before computer run
Speaker 1: key creating machines. Words are apparently not in my head
Speaker 1: today it's terrific, and also before algorithms that can end
Speaker 1: up looking at a pattern and making a really close
Speaker 1: estimation of what that pattern represents. Right, Because the resolution
Speaker 1: on these images is not so high that you could
Speaker 1: just zoom. You couldn't zoom and enhance over and over.
Speaker 1: So you've got a good picture, you need you need
Speaker 1: a computer that has some good guesswork with it too.
Speaker 1: But now we're in the era, the combined era of
Speaker 1: sophisticated object recognition image software and additive manufacturing that is
Speaker 1: three D printing. Joe, Please tell me, please tell me
Speaker 1: that is impossible for someone to take the images that
Speaker 1: are here in front of us and turned that into
Speaker 1: an actual physical thing, thus manufacturing their own master keys
Speaker 1: for T. S A. Locks. Well, I don't know about
Speaker 1: this image, but it's definitely possible to do from a photo,
Speaker 1: and it has been done, and people have tried the
Speaker 1: keys and they work. So I'm going to tell the
Speaker 1: story of that now. Apparently somebody tried to delete this
Speaker 1: photo after they had published it, But silly person, Nothing
Speaker 1: gets deleted off the Internet. What's the rule about the Internet?
Speaker 1: The Internet is forever Archive dot org, We salute you,
Speaker 1: and so on. Auguste Remember that original article was last year,
Speaker 1: so it was out for a while. I don't know
Speaker 1: when the image got deleted, So I don't know exactly
Speaker 1: who was the first person to point out this problem,
Speaker 1: but several sources linked to an August one tweet by
Speaker 1: a guy who calls himself an independent journalist named Luke Rudkowski,
Speaker 1: and it shared the image of the master keys and
Speaker 1: said does at Washington Post and brilliant T s A. No,
Speaker 1: they just compromise their locking system by putting this out.
Speaker 1: So ouch, yeah, some hackers got to work. So I'm
Speaker 1: going to try to explain what happened as far as
Speaker 1: as best I can understand it, because there was a
Speaker 1: kind of complicated series of events. But in early September,
Speaker 1: a group of lock pickers and security hobbyists published to
Speaker 1: get hub, a collection of CAD files based on the
Speaker 1: images of the t s A master keys that have
Speaker 1: become available on the internet. And it looks like it
Speaker 1: probably wasn't just the Washington Post image. And I'll say
Speaker 1: more about that in a minute. But yeah, let's break down.
Speaker 1: Let's let's unpack a couple of terms for those of
Speaker 1: you who might not be familiar with get hub and
Speaker 1: cat images. Sure. So, get hub is essentially a repository.
Speaker 1: It's a place where you put open source code. Typically,
Speaker 1: so let's say that you create a program and you
Speaker 1: want to make it open source so other people can
Speaker 1: take your code, tweak it, change it, upload their own versions,
Speaker 1: you know, do transformative work with it. Get hub is
Speaker 1: sort of the centralized place that you would go and
Speaker 1: store that so other people could get at the code
Speaker 1: you had created. Right, So, if you want to make
Speaker 1: something like a Google deep dream available to the public.
Speaker 1: You can put it up on geth hubs, so people
Speaker 1: can make their own apps to do things with it, right, Yeah,
Speaker 1: but then also their CAD files. The CAD just stands
Speaker 1: for computer aided design. So if you want to put
Speaker 1: together a digital shape to make on your three D
Speaker 1: printer in three dimensions, you'll probably make it in a
Speaker 1: CAD program you can. You can think of a CAD
Speaker 1: program as a kind of MS paint for three D objects. Yeah.
Speaker 1: I remember I had a friend who did a lot
Speaker 1: of work with CAD programs back in high school. But
Speaker 1: that was specifically in design classes where you're trying to
Speaker 1: create a a three dimensional object, a plan for a
Speaker 1: three dimensional object. It's also used a lot in architecture
Speaker 1: firms that kind of thing, right. So CAD is bigger
Speaker 1: than just three D print, but it's a way to
Speaker 1: get the file you want to you want to print
Speaker 1: in a three D printer. So apparently after these files
Speaker 1: went up on geth hub, it was literally only a
Speaker 1: few hours before somebody downloaded them and printed one of
Speaker 1: these things and it worked. There are now images online
Speaker 1: of people using these three D printed keys based on
Speaker 1: these images to pop open their t s A approved
Speaker 1: luggage locks. Yeah, and you know, to be fair, some
Speaker 1: of the t s A locks feel like they could
Speaker 1: open if you sneezed on them. But maybe that's just
Speaker 1: my experience with t s A luggage locks. I've never
Speaker 1: used one I travel. I traveled just enough where I've
Speaker 1: used them a few times. Uh And and I often
Speaker 1: question why I go through the trouble, but I still
Speaker 1: do it. Yeah. Well, some users report being able to
Speaker 1: open the locks with unmodified prints of keys using plain
Speaker 1: old p l A. So these are plastic keys. You
Speaker 1: don't need a print him in metal or anything. And
Speaker 1: p l A is not not the sturdiest plastic. I've
Speaker 1: got some little p l A trinkets on my desk
Speaker 1: that I made in our in our printer in the office.
Speaker 1: I read about one user in this Wired article that
Speaker 1: I'm currently referring to who had to modify the scale
Speaker 1: of the key, but otherwise it worked. And this Wired
Speaker 1: article talked to a lockpicker and University of Pennsylvania compside
Speaker 1: professor named Matt Blaze about it, and he made some
Speaker 1: interesting points I thought. First of all, he pointed out that, uh,
Speaker 1: not that it really changes the thrust of the story,
Speaker 1: but just for the record, he thinks the image in
Speaker 1: question leaked somewhere before the Washington Post story, so they
Speaker 1: might not don't line up with your pitchforks only there.
Speaker 1: Yeah uh. He also says that a good lockpicker, you know,
Speaker 1: could probably pick the locks in less time and was
Speaker 1: with less trouble than it would take to print the keys,
Speaker 1: since he says, and I quote, I find it's actually
Speaker 1: quicker to pick the t s A locks than to
Speaker 1: look for my key sometimes. Yeah. Now, these are not
Speaker 1: terribly sophisticated locks. They're not meant to be. They're just
Speaker 1: meant to be a deterrent. And the other point he
Speaker 1: makes is that the parties in questions should have known
Speaker 1: better than allowing people to photograph the keys, because photo
Speaker 1: security and physical keys is a known issue, and we'll
Speaker 1: get to more about that in a minute. But there
Speaker 1: have been more developments since then. According to a timeline
Speaker 1: that I read, which was created by a lockpicker involved
Speaker 1: with the T s A Key story, which I found
Speaker 1: linked in another article for The Intercept by Jenna McLaughlin, boy,
Speaker 1: the trail of of sights here is is impressive. Well,
Speaker 1: I'm just trying to lead you through my thoughts. But anyway,
Speaker 1: the printed keys were actually based on additional imagery dug
Speaker 1: up by the hackers, So it wasn't just the Washington
Speaker 1: Post image that leaked, but it was sort of inspired
Speaker 1: by the Washington Post league that hackers said, I wonder
Speaker 1: if we can find any more images of these keys,
Speaker 1: and they went out and looked for him, and they did.
Speaker 1: They found, whether by legitimate or illegitimate means. I'm not sure,
Speaker 1: photos contained in a document called Guide to Travel Century
Speaker 1: pass Keys, which was created by a group called Travel Century,
Speaker 1: which they have a kind of complicated relationship with the
Speaker 1: t s A and the lockmakers. They are not lock
Speaker 1: manufacturers and they are not the t s A. But
Speaker 1: I understand that there's some sort of liaison organization. I
Speaker 1: got a third party kind of that. Yeah, like they
Speaker 1: according to this article, they generate and enforced security guidelines
Speaker 1: for T s A approved locks, whatever that means. Huh okay.
Speaker 1: So so in the face of this mishap, the t
Speaker 1: s A responded, Yeah, and this is one of the
Speaker 1: most troubling parts that that piece in the intercept I
Speaker 1: talked about got a t s A official to talk
Speaker 1: about the late the leak and the three D printed
Speaker 1: master keys, and I just thought i'd read a select
Speaker 1: quote this was pretty interesting. Okay, sure. The t s
Speaker 1: A spokesperson Mike England sent in an email to the
Speaker 1: Intercept the reported ability to create keys for t s
Speaker 1: A approved suitcase locks from a digital image does not
Speaker 1: create a threat to aviation security. These consumer products are
Speaker 1: peace of mind devices, not part of t s AS
Speaker 1: aviation security regime. And also, and the same guy said,
Speaker 1: carried in check bags are subject to the t s
Speaker 1: AS electronics screening and manual inspection. In addition, the reported
Speaker 1: availability of keys to unauthorized persons causes no loss of
Speaker 1: physical security to bags while they are under t s
Speaker 1: A control. In fact, the vast majority of bags are
Speaker 1: not locked when checked in prior to flight. So what
Speaker 1: they're saying is that, well, we're concerned with national security,
Speaker 1: not your luggage is security. So it's not really our problem. Yeah,
Speaker 1: not our problem. No, it's yeah, essentially don't matter. The
Speaker 1: t s A. The t s AS purpose is not
Speaker 1: to make certain that the bag you packed has the
Speaker 1: same stuff in it when you get to where you're
Speaker 1: going as when you left. It's just to make sure
Speaker 1: that you're not going to hurt the airplane or anybody
Speaker 1: on it, which I should put in is a is
Speaker 1: a valid thing to want. Yeah, this perhaps was maybe
Speaker 1: not the best way to communicate it, since it seems
Speaker 1: like it's by by this way, I mean, this quote
Speaker 1: almost seems like they are flipping me the bird and
Speaker 1: saying saying, don't worry your stuff doesn't matter. They might
Speaker 1: as well say, don't put a lock on it, you know,
Speaker 1: because here they're saying, well, you know, it's it's going
Speaker 1: to be within our care the whole time. I mean,
Speaker 1: no one else is going to have access to it.
Speaker 1: And I'm thinking the people that are handling the luggage
Speaker 1: all along the pathway from the point where I handed
Speaker 1: off to the point where I pick it up aren't
Speaker 1: all necessarily upstanding citizens. I say that because I know
Speaker 1: there have been incidents where people have found stuff missing
Speaker 1: from their I mean, there's there's also just the mere
Speaker 1: fact that if you're if you are distrustful of human people,
Speaker 1: and you perhaps don't make it to the baggage carousel
Speaker 1: exactly at the moment when your suitcase comes out, then
Speaker 1: you know, a dishonest human person could walk up and
Speaker 1: just kind of rummage through your stuff. It takes some
Speaker 1: of it out. Yeah, well, yeah, especially if it's one
Speaker 1: of those things where you ended up getting bumped on
Speaker 1: a flight. You're delayed, but your luggage got on the
Speaker 1: flight that you were supposed to be on, and then
Speaker 1: it's going to be waiting for you for hours at
Speaker 1: an airport. You know, there are a lot of reasons
Speaker 1: why this, to me is not exactly comforting. Yeah. Yeah,
Speaker 1: so perhaps not the most pc response from the t
Speaker 1: s A. However, this does speak to a larger issue
Speaker 1: with with three D printing and security. Yeah, because this
Speaker 1: thing that just happened, this t s A keys event,
Speaker 1: was not not a totally unique situation. I mean there
Speaker 1: are other ways that photo analysis or three D printing
Speaker 1: and things like that can affect physical security. I mean,
Speaker 1: there are these ideas of three D printed bump keys.
Speaker 1: I think you looked into this, Jonathan. Yeah, bump keys are, um,
Speaker 1: they're interesting. So the really weird thing about bump keys
Speaker 1: is you don't need a picture of the key to
Speaker 1: create a bump key. You need a picture of the lock.
Speaker 1: You need to see how the lock is shaped. From there,
Speaker 1: you can create sort of a generic key that has
Speaker 1: sort of generic little peaks and troughs in it, so
Speaker 1: they don't have to match the way the actual key fits.
Speaker 1: It just has to be low enough so it can
Speaker 1: slide into the depth of the lock, all right. They're
Speaker 1: called bump keys because you put the key in the
Speaker 1: lock and you hammer it with a mallet, which jolts
Speaker 1: the key into the lock, pushing the pins. The pins
Speaker 1: are what keep the lock from being able to turn.
Speaker 1: Pushes the pins up. It's like it's it's like you
Speaker 1: just gave it a quick shove, so the pins bounce up,
Speaker 1: and at that moment you have to turn the key.
Speaker 1: And as you start turning the key, it's as if
Speaker 1: you're using the actual key built for that lock, and
Speaker 1: it will unlock the lock in question. So you would
Speaker 1: three D print this kind of generic key and then
Speaker 1: just use that hammer to go quick a quick uh
Speaker 1: bump and then a turn. And apparently it takes a
Speaker 1: little practice, takes some some finesse to get the timing
Speaker 1: just right. Um, but it works. You can totally make
Speaker 1: keys that will unlock locks this way. Yeah. And of
Speaker 1: course there's just plain old lock picking, sure, yeah, which
Speaker 1: requires a little bit more. Uh, practice and access to
Speaker 1: lock picking tools, which are not hard to get, but
Speaker 1: the practice takes time. Like it's it's a learned skill. Yeah,
Speaker 1: it's not. As it's not as simple as as you
Speaker 1: might think, but it's not, you know, impossible to learn.
Speaker 1: There are plenty of lock picking groups out there, copy
Speaker 1: groups that U do this stuff all the time. Hopefully
Speaker 1: airport security people should be able to look at someone
Speaker 1: and determine that they're sitting there trying to pick a lock,
Speaker 1: sticking a lock pick gun into a lock, or or
Speaker 1: they they see a person just like I would like
Speaker 1: kneel down in front of a piece of luggage and
Speaker 1: then unfold my lock picks in front of me and
Speaker 1: picturing you like sitting on a skateboard and like and
Speaker 1: like rolling along next to baggage carousel, like with your
Speaker 1: with your little kit laid out on your knees. Yes,
Speaker 1: that would be a little bit obvious. But also way
Speaker 1: before three D printing, this was an issue too. Yeah.
Speaker 1: I mean, well, I mean people have been talking about
Speaker 1: various ways to reproduce keys from photos for years, right yeah, yeah,
Speaker 1: So for example, at the a c M Conference on
Speaker 1: Computer and Communication Security, a way back into the eight
Speaker 1: there were a trio of security experts who presented a
Speaker 1: product they called Sneaky as an E A K E
Speaker 1: Y why because we love you A system for duplicating
Speaker 1: a key that's not in your possession, so specifically by
Speaker 1: taking a picture of a key being able to create
Speaker 1: a copy of it. Uh. Here's here's a quote from there.
Speaker 1: The abstract of their presentation, the access control provided by
Speaker 1: a physical lock is based on the assumption that the
Speaker 1: information content of the corresponding key is private, that duplication
Speaker 1: should require either possession of the key or a priori
Speaker 1: knowledge of how it was cut. However, the ever increasing
Speaker 1: capabilities and prevalence of digital imaging technologies present a fundamental
Speaker 1: challenge to this privacy assumption. Using modest imaging equipment and
Speaker 1: standard computer vision algorithms, we demonstrate the effectiveness of physical
Speaker 1: key tele duplication extracting the key's complete and precise bidding
Speaker 1: code at a distance via optical decoding, and then cutting
Speaker 1: precise duplicates. We describe our prototype system Sneaky and evaluate
Speaker 1: its effectiveness in both laboratory and real world settings. Using
Speaker 1: the most popular residential key types in the United States,
Speaker 1: which is basically saying that if anyone has ever taken
Speaker 1: a photograph of a key that you have, there's the
Speaker 1: potential out there, even without three D printers, to produce
Speaker 1: a copy of it. That's right. So all you kids
Speaker 1: who wear your keys on your hips, yeah, start putting
Speaker 1: those in pockets. They can keep the chain on them,
Speaker 1: but put them in a pocket deep in those Jinko pockets. Yeah.
Speaker 1: So hey, I like my chinkoes. So one of the
Speaker 1: other things that that you want to talk about, Joe,
Speaker 1: was how this goes beyond the t s A goes
Speaker 1: beyond even physical locks and keys. Actually, oh sure, I mean,
Speaker 1: and of course it applies to physical locks and keys,
Speaker 1: but it's a broader security question because in in response
Speaker 1: to this incident, I've seen many writers and security analysts
Speaker 1: pointing out how that this is essentially a problem that's
Speaker 1: inherent with backdoor systems. We often think of backdoors in
Speaker 1: terms of software exploits, but the master key is a
Speaker 1: physical form of a security back door, right, So what's
Speaker 1: the idea of a backdoor. It's essentially that there is
Speaker 1: a there is a secret way around known only to
Speaker 1: supposedly legitimate authorities that can always get in through your
Speaker 1: security measures. Yeah, I um. I was on an episode
Speaker 1: of Daily Tech News show where we were talking about backdoors,
Speaker 1: were specifically talking about the n S A and and backdoors.
Speaker 1: Various law and law enforcement agencies often lobby to have
Speaker 1: backdoors inserted into popular types of software. Uh, the argument
Speaker 1: being that this would increase safety if they were able
Speaker 1: to get access to these things quickly and stop actors
Speaker 1: who would be who are who are trying to plan
Speaker 1: out something that's going to be harmful to others, often
Speaker 1: in the form of terrorist plans like sure so so
Speaker 1: the ability to kind of peek in on telephone communications
Speaker 1: along those lines exactly. And the point I made, and
Speaker 1: it's something I still believe in today, is that you
Speaker 1: do not increase security by introducing vulnerabilities into your system.
Speaker 1: And a backdoor is by its nature of vulnerability. Yeah.
Speaker 1: And frankly, they don't care about increasing security. I mean
Speaker 1: that's not the goal is to increase your privacy or
Speaker 1: your personal security. It's it's about another goal, which is
Speaker 1: even if you take the authorities who want backdoors and
Speaker 1: everything at their word and say they're not going to
Speaker 1: abuse their power no matter what kind of system we're
Speaker 1: talking about if there's a third party with a key
Speaker 1: that all always works, there are ways that third party's
Speaker 1: key can slip into the hands of the bad actors.
Speaker 1: So even if you totally trust the government, which you know,
Speaker 1: we're not saying it's not the point of the show
Speaker 1: right now, one way or another. But let's let's pretend
Speaker 1: you do totally trust the government and the authorities, it's
Speaker 1: still a bad idea to have these back doors because
Speaker 1: they always get out, and that that's exactly what what
Speaker 1: my point was was. The idea that a back door
Speaker 1: is is by its nature of vulnerability, it's it's a
Speaker 1: away other than the preferred way to access a system.
Speaker 1: Doesn't matter if it's a door, or if it's an
Speaker 1: operating system, or if it's a piece of software, or
Speaker 1: if it's a telephone, does not matter what it is.
Speaker 1: It is another way that an actor can gain access
Speaker 1: to a system, uh and and potentially cause quite a
Speaker 1: bit of damage in the process. So I it is
Speaker 1: my belief that back doors are nearly always a bad idea.
Speaker 1: We all saw what kind of havoc they wreaked in
Speaker 1: Jurassic Park. Yes, yes, oh, you're talking about Nedriya Nedri
Speaker 1: had a backdoor. Yeah, I don't know if that was
Speaker 1: for legitimate authorities, but that was for no. No, you
Speaker 1: didn't say the magic word related purposes. I'm extrapolating on
Speaker 1: the part. I mean, you know, did you create backdoors
Speaker 1: and suddenly dinosaurs can run them up? Well, that is
Speaker 1: a good part because it wasn't necessarily part of Nedri's
Speaker 1: plan to have a losci raptors eat everybody. It's just
Speaker 1: an unfortunate consequence. Yea, this this brings us back to
Speaker 1: this is unix I know this, but anyway, I think
Speaker 1: it would be interesting to talk about some of the
Speaker 1: implications of this kind of event. Yeah, so, obviously we
Speaker 1: could reach the conclusion that physical locks and keys have
Speaker 1: had their day. We've already known that there were these
Speaker 1: potential vulnerabilities. We've talked about those, We've talked about lock picking,
Speaker 1: and we talked about the ability to replicate a key
Speaker 1: simply from a picture. But this new story about three
Speaker 1: D printing, coupled with the rise of three D printing
Speaker 1: and popular culture, kind of drives at home yet again
Speaker 1: that the physical lock and key is not a beat
Speaker 1: all security measure, and that perhaps it's time to start
Speaker 1: looking at alternatives. We need retin a scanners on everything.
Speaker 1: Biometrics are part of it. But also this is not
Speaker 1: the only type of story, embarrassing story about a lock
Speaker 1: and a a way of getting access to that lock.
Speaker 1: Did you guys ever hear about There was a story
Speaker 1: that broke around two thousand five about the Kryptonite bike locks.
Speaker 1: So I got a buddy. His name is Brian Brushwood,
Speaker 1: and he's a magician and a scam artist, that's what
Speaker 1: he calls himself. And so he did an episode of
Speaker 1: Scam School recently where he actually showed this particular vulnerability
Speaker 1: in action. So back in two thousand five, Kryptonite released
Speaker 1: a bike lock that had a tubular lock to it.
Speaker 1: So it uses a cylindrical key to activate the pens
Speaker 1: and then you turn that it releases the lock. It's
Speaker 1: sort of like a like like whistle shaped almost, yeah,
Speaker 1: And so he showed that something that people had known
Speaker 1: for quite some time, that that particular style of luck
Speaker 1: could be defeated with a big pen casing. You take
Speaker 1: the pen out of the pen and then plastic. Yeah,
Speaker 1: you just wiggle that onto the lock and if you
Speaker 1: wiggle it the right way, you can activate the lock,
Speaker 1: and you've you've opened up a Kryptonite These are expensive locks,
Speaker 1: by the way, Kryptonite bike lock, thus getting access to
Speaker 1: not just the bike lock, but also the bike that
Speaker 1: was locked to it. And uh. And so there were
Speaker 1: some people who were criticizing Brian because they were saying, hey,
Speaker 1: why don't show people how to steal bikes? And I
Speaker 1: actually commented on his YouTube video and said, guys, he's
Speaker 1: not showing you how to pick locks. This is information
Speaker 1: that's been out there since two thousand five. What he's
Speaker 1: showing you is which lock you absolutely should not be
Speaker 1: using for your bicycle. All right, this is this is
Speaker 1: important consumer information, right. This is the it's the white
Speaker 1: hat hacker principle. Somebody shows you the vulnerabilities and your security.
Speaker 1: Hopefully that should spur you to create better security. And
Speaker 1: Kryptonite did do that. In in full disclosure, Kryptonite went back,
Speaker 1: they redesigned their lock, they went with a disc shape
Speaker 1: rather than a tube shape, and they offered an exchange program.
Speaker 1: So they did their due diligence once once the vulnerability
Speaker 1: was known, they you know, it wasn't like they washed
Speaker 1: their hands and backed away. This is their business. Yeah,
Speaker 1: so they went they did well, uh and uh and
Speaker 1: and held up their end of the bargain uh and and.
Speaker 1: Some other systems have certainly been created that are trying
Speaker 1: to move away from physical keys. You know, the little
Speaker 1: UH beepers on cars that will open your car door,
Speaker 1: having a numerical keypad on your on your house right right.
Speaker 1: A lot of them are things that are proximity based.
Speaker 1: Like you have a smartphone that has a particular app
Speaker 1: on it, you may be uh, you may have to
Speaker 1: put in a pen in order to activate a lock
Speaker 1: and unlock something as you're walking up to your front door.
Speaker 1: I've seen some systems that are so proximity base that
Speaker 1: you don't even have to do that. If you have
Speaker 1: your phone on, you've paired it with the lock system,
Speaker 1: and you get within range, it will automatically unlock. I
Speaker 1: don't know that I'm particularly in favor of that approach,
Speaker 1: but I do like the idea of using the pen system.
Speaker 1: It's not full proof. No security system is ever full proof,
Speaker 1: but it's an alternative to the physical key and lock. Now,
Speaker 1: a lot of these systems also have a physical key
Speaker 1: that you can use UM. So if that's if it's
Speaker 1: not a double lock system. In other words, if the
Speaker 1: same like physical lock and the digital lock are the same,
Speaker 1: you might not be in any better shape, considering that
Speaker 1: we've already talked about the vulnerabilities of physical locks. Yeah,
Speaker 1: and there's also vulnerabilities involved in inometric systems too. We've
Speaker 1: we've talked about that either here on tech stuff before
Speaker 1: and thinking Okay, but because it's it's at this current
Speaker 1: moment not all that difficult to fool a retina scanner
Speaker 1: or a thumb print scanner, right, Yeah, there there are
Speaker 1: certain ones that are are looking more promising, like the
Speaker 1: ones that trace the veins underneath the skin and check
Speaker 1: for blood flowing. Yeah, making sure that someone hasn't just
Speaker 1: cut off your hand and used it to slap on
Speaker 1: your front door. Um, in which case you may not
Speaker 1: be worried so much about the burglary. There might be
Speaker 1: other things that are pressing issues on your mind, like bleeding. Yeah,
Speaker 1: that could be way up there. But yeah, this is
Speaker 1: this is one of the things. We don't meant say
Speaker 1: this nor to to cause fear, uncertainty and doubt, but
Speaker 1: rather to raise awareness of security vulnerabilities. Maybe it's one
Speaker 1: of those things that just makes you think before you
Speaker 1: get a picture taken, like, oh, you know, I pres
Speaker 1: shouldn't have my keys out, or you know, anything along
Speaker 1: those lines where you want to practice good security measures. No,
Speaker 1: not necessarily to go out and like by the latest
Speaker 1: security system to outfit your your house. I mean, I
Speaker 1: just use a cave troll is what I've got right
Speaker 1: behind the front door. Very effective. But let's talk about
Speaker 1: your puppy like that. He's a monster. Now, what if somebody,
Speaker 1: the person who bred those cave trolls actually all taught them,
Speaker 1: taught them all a secret password that only the company
Speaker 1: has until they leak internal documents, and now people know
Speaker 1: they can get past your troll by saying the magic word,
Speaker 1: which is yar olsburg. I was concerned with that, but
Speaker 1: it turns out that this particular cave troll only goes
Speaker 1: into a grape vine if you say that. So apparently
Speaker 1: there was musical theater at that particular cave troll UH university.
Speaker 1: So I'm thankful for that. Uh. To be more serious, however,
Speaker 1: obviously it's it's good to think about these things whenever
Speaker 1: you're trying concerned about your security. When it comes to
Speaker 1: t s a locks, I mean I don't have any
Speaker 1: good advice for that at all right now. I don't
Speaker 1: even know if I'll be using them at this point.
Speaker 1: Oh yeah, well, I mean, you know, it's don't take
Speaker 1: anything valuable on a plane. Yeah, that's that's that's pretty good.
Speaker 1: The part part is when you go someplace and you
Speaker 1: pick up stuff for people you love to bring back
Speaker 1: to give to them. Like if I go on a
Speaker 1: trip and I start buying souvenirs for people, then I
Speaker 1: have a concern about that, although I could always ship it.
Speaker 1: I guess stop having people that you love. It's slowly
Speaker 1: turning out that way. I'm just getting grouchier as they
Speaker 1: get older. No, I don't know. I mean, you know,
Speaker 1: perhaps perhaps good advice if you have a few extra
Speaker 1: bucks on you is to buy a regular lock. But
Speaker 1: since even those aren't full proof. Yeah. I saw one
Speaker 1: comment or on one of the articles I read saying
Speaker 1: I always use zip ties. Interesting, is there cheap and
Speaker 1: if the t s A Needs to get in there,
Speaker 1: they'll just cut it off, Yeah, and then won't cause
Speaker 1: damage to the luggage. That's probably that's probably the best approach.
Speaker 1: And thinking that well, if they don't need to see it,
Speaker 1: everything safe and if they do need to see it, well,
Speaker 1: there's nothing I can do to stop them anyway, because
Speaker 1: that's their job. They're they're trying to practice security for
Speaker 1: a much larger group than just my stuff. They verify
Speaker 1: that my cans of dog food are not actually something else. Yeah. Yeah, well,
Speaker 1: at any rate, this was this was an interesting topic
Speaker 1: to cover. Uh, we didn't get quite as angry as
Speaker 1: we all thought we would, which I guess is good.
Speaker 1: I think I got about as angry as I was anticipating.
Speaker 1: I got about I think I got about three quarters
Speaker 1: as angry as I was anticipating. Yeah, yeah, I had.
Speaker 1: I had calm, dude, I'm calm. Alright, Well, I'm gonna
Speaker 1: abide by that. Guys, if you have any suggestions for
Speaker 1: future episodes of forward Thinking, I recommend you write to
Speaker 1: us and tell us what those are. The email addresses
Speaker 1: f W Thinking at how Stuffworks dot com. You can
Speaker 1: drop us a line on Facebook, Twitter, or Google Plus.
Speaker 1: At Twitter and Google Plus, we are FW thinking. Just
Speaker 1: search FW thinking on Facebook. We'll pop right up. You
Speaker 1: can leave us a message on there, and we will
Speaker 1: talk to you again really soon. We're more on this
Speaker 1: topic and the future of technology. This is forward sinking
Speaker 1: dot com, brought to you by Toyota. Let's Go Places,