Hacker News new | ask | show | jobs
by g_p 916 days ago
Worth being aware that, as well as keyfobs being super fragmented, many are woefully insecure. Think "they just say their ID number when you put them in a reader field".

That means you can trivially clone them. Not hugely exciting for access to a (common) hallway in a large building. If cloning someone else's fob gets you free car charging, the incentive is there to clone them. Also, not all buildings will use unique fobs per "unit" (and you'd likely need to support per-resident/tenant fob uniqueness... And something for guests!) -- sometimes it's a single hardcoded value for the whole block or door zone that the fob opens...

You can, of course, build something proper using NFC (and a smartcard running a smartcard applet), which is effectively like your own custom mini "chip and PIN" EMV system -- you would have to design and implement the wire protocol to authenticate the card etc etc, and all the security design around that, but it could be done. That would at least let you have something more than simply shouting your tag ID number into the air like a super basic NFC tag (or RFID keyfob).
1 comments
ClumsyPilot 916 days ago
> That means you can trivially clone them.

i have cloned keyfobs for like 5 building at a local laundry. Never met a fob they couldn't clone

link
g_p 916 days ago
Yeah - there's even some fairly capable "cloners" available on eBay for most of the common formats. I guess that the ongoing use of (derived from magnetic stripe) Wiegand interfaces mean that most can be cloned like this.

There are absolutely some unclonable (without massive expenditure on defeating CC EAL 5+ smartcards) access control systems, but those are never the cheapest, so they don't get adopted outside of (very) high security environments.

I wondered if we'd see a shift once the Flipper Zero hit the ground, but it's probably still a bit too early on that.

A lot of hotels used to use insecure (and pretty easily cloned with an Android app) Mifare Ultralight NFC on room keys, but I've not seen one of those recently - most seem to be Mifare classic now, which is secure if your keys aren't compromised.

link