[00:00.850 --> 00:01.970]  Good day, Max.
[00:02.370 --> 00:03.310]  Can you hear me?
[00:04.610 --> 00:05.950]  No, not yet.
[00:06.830 --> 00:07.370]  Audio.
[00:07.770 --> 00:08.410]  Audio, yes.
[00:08.590 --> 00:08.790]  Hello.
[00:09.430 --> 00:10.430]  I'm Jos Weyers.
[00:10.610 --> 00:13.110]  I talk about keys and showing off.
[00:13.910 --> 00:19.030]  First off, well, showing off keys, not showing off as an activity.
[00:20.030 --> 00:21.210]  I'm a member of TOOOL.
[00:21.310 --> 00:22.990]  That's The Open Organization Of Lockpickers.
[00:23.110 --> 00:27.050]  We pick locks for a sport, as a sport.
[00:27.050 --> 00:29.070]  And we have certain rules.
[00:29.710 --> 00:30.550]  Just a few.
[00:30.730 --> 00:31.490]  They're quite easy.
[00:32.170 --> 00:33.970]  Rule number one, do not pick a lock.
[00:34.570 --> 00:36.550]  Well, only pick locks that you own.
[00:37.270 --> 00:42.590]  Or that you have explicit permission from the owner that you are allowed to pick those.
[00:43.050 --> 00:44.850]  And, well, that's basically it.
[00:44.850 --> 00:50.030]  If you abide to those two rules, there's an above-average chance to stay out of trouble.
[00:50.310 --> 00:55.110]  I'm also a member of Hack42, which is a hackerspace in Arnhem.
[00:55.110 --> 01:09.190]  And when Hackaday did a tour through Europe to figure out what hackerspaces look in Europe, they came up with the term most awesome place in Europe.
[01:09.530 --> 01:12.410]  So, yes, I agree on that one.
[01:14.170 --> 01:16.930]  First, start off with some clip.
[01:18.110 --> 01:19.590]  There's no audio in that one.
[01:20.630 --> 01:21.210]  Audio?
[01:21.430 --> 01:21.930]  Audio?
[01:22.170 --> 01:22.750]  Audio?
[01:23.110 --> 01:23.110]  Audio?
[01:24.890 --> 01:25.470]  Yes.
[02:33.610 --> 02:35.070]  At least the music was good.
[02:35.370 --> 02:35.990]  Music was good.
[02:36.230 --> 02:37.310]  Show of hands.
[02:37.510 --> 02:39.890]  Who thinks this is a good idea?
[02:41.170 --> 02:41.490]  Great.
[02:41.490 --> 02:41.970]  There's one.
[02:42.150 --> 02:42.690]  There's two.
[02:42.810 --> 02:43.350]  Two hands.
[02:43.570 --> 02:43.930]  Great idea.
[02:43.990 --> 02:44.190]  Brilliant.
[02:44.390 --> 02:44.830]  Great for us.
[02:45.930 --> 02:47.950]  Well, first of all...
[02:47.950 --> 02:51.350]  Well, there's one positive thing.
[02:51.350 --> 02:54.570]  This is brought to you by an insurance company.
[02:55.150 --> 02:58.930]  So, if your house gets raided as lease, they're gonna pay for it.
[02:59.370 --> 03:00.870]  So, but, well, yeah.
[03:01.170 --> 03:10.370]  And, of course, I don't know where you guys live, but where I live, it's quite harder to find a 3D print shop than a locksmith.
[03:10.710 --> 03:13.270]  But, well, it's fun.
[03:13.270 --> 03:16.350]  I mean, and yes, you can 3D print keys.
[03:16.610 --> 03:22.030]  What you saw them do is put a key in a jig that was turning.
[03:22.230 --> 03:25.590]  So, they were actually 3D scanning your lock.
[03:26.350 --> 03:32.450]  This insurance company operates out of Belgium, which is Europe, which is not America.
[03:32.970 --> 03:35.530]  And why do I say that?
[03:35.530 --> 03:42.110]  Well, because it's not America, they have a choice of which key to use.
[03:42.570 --> 03:47.230]  Because, in America, it's basically Kwikset, Schlage, expensive.
[03:47.830 --> 03:49.890]  That's our...
[03:50.410 --> 03:50.690]  Right?
[03:52.070 --> 03:53.410]  That's your 3 options.
[03:54.150 --> 03:57.350]  Either you have a Schlage, either you have a Kwikset, or very expensive.
[03:58.270 --> 04:01.530]  Normal people, normal households will go for option 1 or 2.
[04:02.570 --> 04:04.330]  Or go for option... I don't know.
[04:04.330 --> 04:09.450]  So, it was on the door when I bought the... bought it, whatever.
[04:09.690 --> 04:10.270]  So, they leave it on.
[04:10.750 --> 04:14.570]  So, basically, for normal people...
[04:14.570 --> 04:22.230]  Well, for an average key to be duplicated in this way, you only need 2 sorts of keys.
[04:23.030 --> 04:26.710]  So, then, maybe you don't need that turny thingy.
[04:26.910 --> 04:27.690]  And that's correct.
[04:27.890 --> 04:30.110]  Because this is a service called Schlüssel.
[04:30.310 --> 04:31.570]  At least, they're used to call Schlüssel.
[04:31.570 --> 04:35.470]  I believe they operate in this area-ish.
[04:35.910 --> 04:40.070]  And what they do, they don't take a 3D video render, God knows what.
[04:40.270 --> 04:43.030]  You just take your key, take a picture, send it to them.
[04:43.150 --> 04:46.490]  They send a copy to your house for $5.
[04:47.230 --> 04:49.130]  Well, I would not opt for the...
[04:49.130 --> 04:51.970]  I would not go for the option, send it to my house.
[04:51.970 --> 04:54.190]  At least use another address.
[04:56.730 --> 04:57.610]  But, well...
[04:57.610 --> 04:58.830]  Will they hand deliver it?
[04:59.490 --> 04:59.930]  Sorry?
[05:00.190 --> 05:01.570]  Will they hand deliver it to your living room?
[05:01.770 --> 05:01.870]  Yeah.
[05:03.390 --> 05:04.110]  Somebody would.
[05:04.970 --> 05:05.990]  We just came in.
[05:06.010 --> 05:06.590]  We just won't be there.
[05:07.810 --> 05:08.870]  Oh, that's next slide.
[05:08.990 --> 05:09.530]  You've been cheating.
[05:11.630 --> 05:13.550]  So, but it's kind of cool.
[05:13.830 --> 05:19.730]  I mean, you just take a picture and they make a key out of it.
[05:19.730 --> 05:21.570]  I mean, that is kind of cool.
[05:21.870 --> 05:27.090]  I mean, amazingly not wise from a security point of view, but bear with me.
[05:27.190 --> 05:27.570]  That's cool.
[05:28.130 --> 05:38.790]  And they have written some quite cool software that not just analyzes the picture, because they don't just duplicate your key.
[05:39.090 --> 05:45.230]  They actually figure out what the original key code was and cut it to spec on that one.
[05:45.230 --> 05:53.770]  So if you have a worn out key, there's an above average chance that your new key that they made for you works better than your old one.
[05:54.390 --> 05:55.390]  That's kind of cool.
[05:56.190 --> 05:59.490]  Still, I wouldn't want it shipped to my address, but it's cool.
[06:01.030 --> 06:02.030]  This is not new.
[06:02.410 --> 06:07.050]  Actually, some companies went a step further.
[06:07.290 --> 06:09.470]  Like this fellow here said, they come into your house.
[06:09.470 --> 06:10.010]  Yes, they do.
[06:10.210 --> 06:10.990]  As a service.
[06:11.910 --> 06:16.290]  This is Outbox that operates, I believe, solely in New York.
[06:16.370 --> 06:16.950]  I could be wrong.
[06:17.090 --> 06:17.930]  Sorry about that.
[06:18.470 --> 06:23.330]  What they do, that's basically a physical reverse mailman.
[06:25.070 --> 06:34.930]  What they do, they show up to your house, your physical house, take away the paper mail, including all the spam and all the bills and all the everything.
[06:34.930 --> 06:37.610]  They take you to their office, scan it and mail it to you.
[06:37.770 --> 06:38.910]  That's email, the last part.
[06:40.090 --> 06:44.190]  So you can get printed spam even when you're not at home.
[06:44.310 --> 06:44.450]  Cool.
[06:46.790 --> 06:50.330]  They probably have some filtery thingy on that, but I'm not sure about that.
[06:51.230 --> 06:53.210]  But how did they get into your mailbox?
[06:53.450 --> 06:55.350]  Your mailbox could be at several places.
[06:55.630 --> 06:57.530]  I mean, you have a lock on your mailbox, right?
[06:57.990 --> 06:59.850]  Well, if not, that's easy and they figured that out.
[06:59.990 --> 07:02.570]  Rule number one, outside your gate, no lock.
[07:02.570 --> 07:03.890]  Well, we'll just come on and take it.
[07:04.850 --> 07:06.370]  Is it locked outside your gate?
[07:06.490 --> 07:07.350]  Well, we'll need the key.
[07:07.850 --> 07:08.770]  Send us a picture.
[07:09.410 --> 07:10.570]  So they did this.
[07:10.690 --> 07:15.670]  So they actually have the same service incorporated in their business plan as Schlüssel had.
[07:15.850 --> 07:19.690]  So you just send a picture, click, go, and at...
[07:19.690 --> 07:26.630]  Well, they don't send you the key, but they come to your door with the key and they take it.
[07:27.290 --> 07:30.370]  So if it's inside your gate, well, they need the key of the gate.
[07:30.750 --> 07:31.150]  Picture.
[07:31.530 --> 07:32.410]  A door slot.
[07:32.570 --> 07:37.870]  And then, in the end, they go like, hmm, we don't really want to go into your building.
[07:38.330 --> 07:45.010]  So if you actually have, like most European have, I don't know how America does that, a slit in the door.
[07:45.210 --> 07:50.410]  So if you would then have to collect that mail, you have to be inside the door.
[07:50.410 --> 07:59.690]  But I guess with guns and all, they went like, no, if you have the mail inside your door, we'll supply you with a box outside your door.
[07:59.870 --> 08:01.330]  So we have the key to that.
[08:01.870 --> 08:13.430]  But still, I mean, so it's even part of business plans to make pictures, to make keys from a picture.
[08:14.650 --> 08:15.770]  And that's not new.
[08:15.770 --> 08:18.990]  Quite some years ago, there has been some research.
[08:19.910 --> 08:24.690]  And I believe that was, well, it has been on DEFCON and HOPE also, I believe.
[08:25.830 --> 08:26.930]  This is a camera.
[08:27.810 --> 08:30.570]  Well, it's actually more a lens with a camera than the other way around.
[08:30.810 --> 08:34.550]  But this is a kick-ass lens with a, well, decent camera.
[08:35.010 --> 08:37.350]  And what they did is they took pictures.
[08:37.610 --> 08:40.930]  You see a big picture, you see a terrace, you see a chair.
[08:41.230 --> 08:42.350]  Well, you see a table.
[08:42.810 --> 08:44.930]  There is, on the table is a book, quite a good book.
[08:44.930 --> 08:46.870]  And on the book are keys.
[08:47.350 --> 08:49.090]  So that's what the lens is for.
[08:49.210 --> 08:49.890]  You see keys.
[08:50.350 --> 08:54.930]  And as we've seen already, from keys, you could probably...
[08:55.630 --> 08:58.170]  Well, from a picture from keys, you could probably make keys.
[08:59.630 --> 09:08.290]  There is some software for it that actually can recognize what the actual code is.
[09:08.750 --> 09:10.670]  What you see is...
[09:10.670 --> 09:11.630]  This is a quick set, right?
[09:12.110 --> 09:12.530]  Yeah.
[09:12.670 --> 09:13.210]  It's a quick set.
[09:13.290 --> 09:16.530]  You can recognize it by the quite typical head of the key.
[09:16.730 --> 09:19.550]  It has some holes in it that are always on the same place.
[09:19.750 --> 09:30.130]  So even if your picture is distorted, because you didn't take it dead on, you can crop and resize that image until that head is the correct size and has the correct dimensions.
[09:30.130 --> 09:33.990]  And then you know the rest of the key also has the correct dimensions.
[09:34.710 --> 09:40.330]  And because cuts are always, well, in known increments, you know what the code is.
[09:40.590 --> 09:42.930]  And then, of course, you can cut it to code.
[09:43.610 --> 09:44.290]  Which is cool.
[09:44.550 --> 09:45.310]  And that works.
[09:48.350 --> 09:55.950]  So, having a picture taken, we've already seen, is enough to lose your key.
[09:57.150 --> 10:02.370]  And now we saw that you can have your picture of your key taken from a block away.
[10:03.610 --> 10:04.130]  Hmm.
[10:06.510 --> 10:13.830]  Security cameras getting more and more high res by the year, well, by the month actually.
[10:13.830 --> 10:15.830]  Moore's laws apply.
[10:18.710 --> 10:20.250]  We have Google Glass.
[10:21.590 --> 10:24.970]  People might be behind you, looking at you, using your keys.
[10:25.870 --> 10:29.730]  In, I don't know, half a year we'll have eye contacts or whatever.
[10:30.030 --> 10:31.370]  You won't be able to see that.
[10:31.970 --> 10:33.910]  So, whoa.
[10:35.110 --> 10:36.730]  Don't show your keys, basically.
[10:37.770 --> 10:42.750]  Another example, also good old days, is this.
[10:43.690 --> 10:46.630]  This is Ray, who is somewhere in the audience.
[10:47.210 --> 10:47.790]  There he is.
[10:47.930 --> 10:48.110]  Hello.
[10:48.650 --> 10:50.510]  He's a good friend of us from Germany.
[10:50.510 --> 10:51.530]  He's a member of SS Dev.
[10:52.930 --> 11:01.750]  And being a log geek from Germany, and actually one of his specific loves is handcuffs.
[11:02.350 --> 11:08.110]  He had the handcuff key from the German police department.
[11:08.950 --> 11:11.210]  So, handcuffs are key the like.
[11:12.030 --> 11:15.290]  That's the same, as far as I know, all over the world.
[11:15.530 --> 11:18.750]  Well, every country has his own keys, of course, hopefully.
[11:18.750 --> 11:27.070]  And so, every American cop has a key that fits to the locks of other American cops.
[11:27.710 --> 11:33.250]  That, if you think about it for a tiny little bit, that sounds stupid.
[11:33.550 --> 11:37.610]  Because if you lose one key, you can open all the handcuffs.
[11:37.610 --> 11:40.010]  But if you get arrested, it's actually a good idea.
[11:40.190 --> 11:41.630]  Not so much that you can get out of them.
[11:41.830 --> 11:51.010]  But if police officer one arrests you, coughs you, and hands you off to another one, that other one is able to remove your shackles.
[11:51.570 --> 11:52.910]  Which would be useful.
[11:52.910 --> 11:56.070]  Otherwise, they use bolt cutters quite a lot.
[11:57.290 --> 12:01.190]  So, Ray had the key to German handcuffs.
[12:01.830 --> 12:04.310]  And he was on a security conference.
[12:04.430 --> 12:06.110]  Not unlike this, but that was in the outdoors.
[12:06.470 --> 12:07.430]  And in the Netherlands.
[12:07.750 --> 12:10.190]  And there were Dutch policemen out there.
[12:10.630 --> 12:14.030]  Ray saw that they were sporting Lips handcuffs.
[12:14.230 --> 12:17.110]  And he said, those look quite the same as the German ones.
[12:17.710 --> 12:21.030]  Dear Mr. Police Officer, can I try this key in your handcuffs?
[12:21.290 --> 12:23.090]  And he said, f*ck off and turn around.
[12:25.770 --> 12:29.210]  The turning around part was, well, there it is.
[12:34.350 --> 12:38.970]  So, well, this picture is not the best picture in the world.
[12:39.930 --> 12:44.050]  I mean, you can maybe decode it or maybe not.
[12:44.750 --> 12:47.870]  But you see, it's a high-low, high-lower-ish.
[12:48.350 --> 12:49.740]  You can vaguely see...
[12:50.210 --> 12:52.950]  Well, I mean, if you get the original picture, it's a bit clearer.
[12:53.130 --> 12:54.130]  But it's not...
[12:54.130 --> 12:59.190]  I mean, I wouldn't be terrible comfortable to actually decode it from this picture.
[13:00.350 --> 13:06.090]  But claiming that it's probably the same one as this, yes.
[13:06.470 --> 13:07.990]  That's quite easy-doable.
[13:08.130 --> 13:13.130]  Because I don't know the exact code, but this looks about the same-ish as the other one.
[13:14.350 --> 13:20.550]  And then, of course, because it was a hacker conference, they put the files online that you can print your own.
[13:20.750 --> 13:22.830]  I mean, because that's what you do, right?
[13:24.450 --> 13:27.350]  And, well, they live happy after, and so that's not a problem.
[13:27.910 --> 13:30.450]  So, after that, you tried it with another policeman, right?
[13:31.050 --> 13:33.170]  Actually, after the talks, they allowed us to try.
[13:33.170 --> 13:33.570]  Okay.
[13:34.550 --> 13:38.390]  So, it was a lose-lose situation anyhow, and they allowed you.
[13:38.530 --> 13:38.650]  Okay.
[13:39.150 --> 13:39.630]  But it's cool.
[13:39.850 --> 13:43.210]  I mean, and now all over the world are printing these keys, which is cool.
[13:44.490 --> 13:44.930]  Okay.
[13:45.210 --> 13:49.670]  So, flashing your keys as a tail may be not the best idea.
[13:50.650 --> 13:51.330]  Other keys.
[13:51.690 --> 13:54.030]  Where do we hide or unhide keys?
[13:54.030 --> 13:56.370]  There's a typical clean desk environment.
[13:56.630 --> 13:58.630]  At least, that's the way I envision them.
[13:59.370 --> 14:00.150]  And, hello.
[14:02.250 --> 14:05.130]  And you see a whole lot of crap, and I see keys.
[14:06.470 --> 14:08.970]  And next to these keys is a coin.
[14:09.950 --> 14:13.030]  Which is cool, because if you take a picture of that coin with...
[14:13.910 --> 14:15.610]  Oh, it happens to be a key there also.
[14:17.190 --> 14:18.930]  We kind of know the size of that coin.
[14:19.510 --> 14:33.250]  So, if we take this picture and print it off at the correct size, so the coin has the correct shape and the correct size, then the key was in the same plane, so the key is also the correct size.
[14:33.610 --> 14:52.030]  Well, if it's a crap lock, and we kind of guesstimate that it is, what we can do is put some metal behind it and do some kindergarten exercises and stay within the lines, bits and pieces, and with some luck, boom, open.
[14:52.970 --> 14:57.850]  So, that's not high-tech key duplication, but see if I care.
[14:57.990 --> 14:58.550]  The lock is open.
[15:00.470 --> 15:01.390]  So, that works.
[15:05.620 --> 15:10.360]  So, leaving keys out in public, potentially bad idea.
[15:12.920 --> 15:15.040]  This story, a couple of years ago.
[15:17.260 --> 15:20.480]  This was covered by a lot of people.
[15:20.580 --> 15:27.000]  Ray was talking about it at a former, at some conference, random man was using it in a talk.
[15:27.220 --> 15:30.280]  But this being New York, I was like, I need to get this in.
[15:31.320 --> 15:39.380]  Some years ago, it was possible to buy a key online that was essentially the master key to the subway system of New York.
[15:40.720 --> 15:47.200]  And, I mean, there's ways to troll that in a way that you probably shouldn't.
[15:47.800 --> 15:48.860]  But, well, yeah.
[15:49.300 --> 15:53.780]  And some newspapers got a hold of that idea, and they were like, Oh, outrage!
[15:54.040 --> 15:55.540]  This key should not exist.
[15:55.760 --> 15:59.160]  Actually, this key should not exist.
[16:02.410 --> 16:13.870]  And just in case this picture is not high-res enough for us to actually read it, they put it on a known map-sized thingy, so we have reference of how to cut that.
[16:16.430 --> 16:17.150]  Thank you.
[16:18.470 --> 16:20.410]  So, well, maybe not the best idea.
[16:21.550 --> 16:23.730]  So, reporters showing keys.
[16:24.150 --> 16:25.270]  Yeah, let's try something.
[16:26.550 --> 16:27.370]  Gas pumps.
[16:27.630 --> 16:29.650]  Gas pumps, you can pay with a card.
[16:29.850 --> 16:31.490]  A card, well, swipey.
[16:31.830 --> 16:32.970]  Punch numbers in.
[16:33.210 --> 16:39.450]  If you want to skim that, for God knows why, but then there are several options.
[16:39.590 --> 16:45.210]  You can make nifty plastic hardware you put over it or start your own gas station, that would be an option.
[16:45.990 --> 16:46.850]  And then...
[16:46.850 --> 16:54.170]  But if it's possible to open this hardware in a neat way, you can put all your evil hardware inside.
[16:55.490 --> 16:59.410]  And so everything looks like the real deal, because, guess what, it is the real deal.
[17:00.130 --> 17:02.310]  So, then this happens.
[17:05.700 --> 17:07.490]  I kind of need audio on this one.
[17:07.660 --> 17:11.560]  I think it seems unbelievable that one golden key, so to speak, unlocked so many pumps.
[17:11.560 --> 17:13.120]  We were surprised, too, Raj.
[17:13.220 --> 17:14.720]  You could call it the key to the kingdom.
[17:14.970 --> 17:21.700]  It is a remnant from back in the day when all gas station pumps were made with the same lock to make it easier for inspections and maintenance.
[17:21.990 --> 17:27.800]  Now those keys are just providing easy access to a very lucrative crime using new high-tech technology.
[17:28.030 --> 17:29.950]  And in the end, we are all on the hook.
[17:30.860 --> 17:38.340]  Hidden behind here, a new Bluetooth-enabled skimmer that can rip off your credit or debit information in seconds.
[17:38.340 --> 17:45.030]  This universal gas pump key is making it even easier for thieves to install these new skimmer.
[17:47.700 --> 17:50.970]  Let's bring in NBC Bay Area's investigative reporter, Vicky Nguyen.
[17:51.240 --> 17:52.060]  Vicky seems...
[17:52.060 --> 17:52.600]  Here you go.
[17:54.580 --> 17:57.950]  That's not the most complex key in the world.
[17:58.560 --> 18:02.340]  So I can read this, and I know which blank to order.
[18:05.860 --> 18:08.380]  But, but, but...
[18:13.190 --> 18:17.270]  If you know what the temp would prove, see what it's supposed to look like.
[18:17.490 --> 18:17.830]  Yes.
[18:18.530 --> 18:19.510]  There's a thing called Amazon.
[18:19.990 --> 18:20.330]  It is.
[18:20.510 --> 18:20.610]  Oh.
[18:22.070 --> 18:22.930]  Didn't know that.
[18:23.610 --> 18:26.970]  So yeah, I mean, at least they tried to make it secure.
[18:27.170 --> 18:29.270]  That was, that was after the program, I reckon.
[18:29.730 --> 18:29.970]  Yes.
[18:30.090 --> 18:30.870]  That was their fix.
[18:32.630 --> 18:33.490]  Say fix.
[18:35.250 --> 18:36.010]  Tiny one.
[18:36.410 --> 18:36.890]  But it's a fix.
[18:38.250 --> 18:38.730]  Okay.
[18:39.650 --> 18:40.790]  Another one, example.
[18:43.530 --> 18:47.890]  Like I said, that, that, that key to the subway system.
[18:48.430 --> 18:49.190]  There's more.
[18:49.470 --> 18:51.070]  There's more of those sets of keys.
[18:51.310 --> 18:52.010]  Especially in New York.
[18:52.690 --> 18:53.170]  Because, well.
[18:55.150 --> 19:05.690]  If police department shows up, or the fire department, you don't want a fire, a firefighter to carry a shitload of keys.
[19:05.930 --> 19:09.250]  Because we're talking about a serious shitload of keys.
[19:09.250 --> 19:20.670]  If every decent building in New York would be mandated, or would be, should have given their key to the fire department.
[19:21.330 --> 19:30.430]  So, if there's a fire somewhere, God knows this and this street, somebody goes to a cupboard and goes like, I need key 760, 50B.
[19:31.650 --> 19:32.790]  Anybody got that?
[19:34.690 --> 19:35.810]  So, no.
[19:35.810 --> 19:43.890]  So, you need a couple of keys, master coded, and maybe not to the building, but to a box that has the key to the building, or whatever.
[19:44.050 --> 19:53.250]  So, it kind of makes sense for a safety point of view to have a couple of keys that are basically the keys to the kingdom.
[19:54.590 --> 20:11.130]  But for a security point of view that we're talking about, well, I don't know how many firemen there are in New York, but sharing a secret with a shitload of people is not considered a secret.
[20:12.530 --> 20:13.810]  It doesn't scale.
[20:14.850 --> 20:20.090]  I mean, handing out keys, well, it scales to some extent, but then it doesn't.
[20:21.110 --> 20:22.170]  So, this happens.
[20:22.870 --> 20:27.990]  Well, the apocalypse might be coming because a New York Post reporter just scooped a legitimate story.
[20:28.210 --> 20:34.250]  An intrepid reporter for America's third dumbest paper has found a slightly disturbing item for sale on eBay.
[20:34.750 --> 20:40.350]  Former locksmith Daniel Ferraris sold the undercover reporter a New York City fireman's key ring for $150.
[20:40.930 --> 20:47.570]  The keys give the owner the ability to control elevators, circuit breakers, subway entrances, and traffic lights all over the city.
[20:47.890 --> 20:50.870]  They essentially become the key maker from The Matrix Reloaded.
[20:52.870 --> 20:57.310]  I only learned yesterday that I'm not allowed to quote that movie.
[20:58.570 --> 20:59.270]  Thanks, Dev.
[20:59.870 --> 21:00.770]  For the heads up.
[21:00.970 --> 21:02.530]  But, well, at least he did.
[21:04.210 --> 21:04.690]  Yeah.
[21:05.970 --> 21:08.110]  $150 for five keys.
[21:08.930 --> 21:12.290]  Well, you don't need to pay that because you know what they look like.
[21:14.370 --> 21:20.850]  And they went down in price because that subway key, that's in between.
[21:20.870 --> 21:22.270]  That's the second from the left.
[21:23.490 --> 21:24.490]  How do I know that?
[21:24.710 --> 21:26.730]  Well, it's a news outlet.
[21:27.050 --> 21:31.190]  And all these news agencies, well, they don't come up with all the news themselves.
[21:31.450 --> 21:34.010]  They copy quite a lot.
[21:34.530 --> 21:38.570]  So other news agencies jumped on it and came up with this picture.
[21:43.190 --> 21:50.690]  Which exactly outlines who should have it, where it's been used, and what to do evil with it.
[21:54.090 --> 21:55.090]  For $150.
[21:56.550 --> 22:02.770]  But they're not that stupid, because I don't know which paper it was, if it was this or the former one.
[22:03.130 --> 22:11.850]  But they did call up a locksmith asking, will it be a problem if he put these pictures online or show them to the world?
[22:11.850 --> 22:20.210]  Because, well, we don't want to leak that info if that's useful for terrorism or God knows what the buzzword today is.
[22:21.070 --> 22:26.210]  And that locksmith said, I never produced keys from pictures.
[22:27.310 --> 22:28.270]  Nope, it's okay.
[22:32.010 --> 22:33.690]  So, producing keys from pictures.
[22:34.250 --> 22:34.690]  Okay.
[22:35.970 --> 22:40.250]  Like I said, I'm a member of Hack42, which is a hackerspace in Arnhem, which is in the Netherlands.
[22:40.250 --> 22:41.990]  So is Amsterdam.
[22:42.290 --> 22:44.290]  Amsterdam has his own hackerspace.
[22:44.430 --> 22:47.630]  Actually, they have two or that's considered a makerspace.
[22:47.790 --> 22:49.250]  There's one hackerspace in Amsterdam.
[22:49.950 --> 22:50.910]  It's called Tech Inc.
[22:52.310 --> 22:56.190]  And being in the same country, we tend to troll each other.
[22:56.830 --> 22:58.170]  In a friendly manner.
[22:58.170 --> 23:02.350]  I mean, we have a special set-aside troll budget.
[23:02.790 --> 23:03.390]  You know.
[23:05.450 --> 23:07.790]  Because trolling does scale, as you know.
[23:08.410 --> 23:09.110]  It does work.
[23:09.730 --> 23:09.810]  Okay.
[23:10.090 --> 23:10.610]  Tech Inc.
[23:12.830 --> 23:17.450]  They got a new place to hack their stuff.
[23:18.230 --> 23:19.650]  And they were...
[23:20.110 --> 23:21.030]  New space.
[23:21.250 --> 23:21.450]  Brilliant.
[23:21.790 --> 23:23.450]  It was bigger and better and all good.
[23:23.650 --> 23:25.090]  Of course, they got new keys.
[23:25.170 --> 23:26.130]  Because, well, that's useful.
[23:26.870 --> 23:30.150]  And so, Bug Blue, one of Hack42 members.
[23:30.230 --> 23:31.950]  And he's a decent troll.
[23:33.130 --> 23:36.310]  He was on RSC, chatting with the Tech Inc.
[23:36.590 --> 23:36.590]  guys.
[23:36.730 --> 23:38.690]  And he said, are you sure that's a good key?
[23:40.910 --> 23:45.270]  Because one of our members, he kind of knows locks.
[23:46.010 --> 23:52.010]  So if you send a picture of your key, maybe put a coin next to it.
[23:52.690 --> 23:56.910]  So we can assess if that's a secure key or not.
[23:58.590 --> 23:59.230]  Uh-huh.
[24:02.470 --> 24:02.990]  Okay.
[24:03.290 --> 24:05.970]  So this is a quite nice, blown-up picture.
[24:06.750 --> 24:12.510]  I don't know what the code is, but I can tell you it looks about this.
[24:14.670 --> 24:15.170]  Agree?
[24:16.030 --> 24:18.510]  So, I can draw this.
[24:19.450 --> 24:19.950]  Right?
[24:20.070 --> 24:21.270]  That's basically what I just did.
[24:22.110 --> 24:22.610]  Yes?
[24:23.430 --> 24:27.890]  And I'll load this in the machine that's the newest, because that's what you do.
[24:28.290 --> 24:33.110]  Because, I mean, the day before we got a laser cutter, so we put this on the laser cutter.
[24:34.070 --> 24:37.950]  It's a good thing we didn't get, I don't know, milk machine.
[24:39.150 --> 24:41.730]  But, so, because this is useful on the laser cutter.
[24:41.850 --> 24:45.970]  So we put it on the laser cutter, and we put some plastic in there.
[24:46.650 --> 24:50.650]  First, we put a label on there, because we have, of course, a shitload of plastic keys.
[24:51.890 --> 24:54.450]  So, if you lose it, you at least know where to use it.
[24:56.390 --> 24:57.670]  Newest machine, first video.
[24:57.830 --> 24:58.370]  Yes, it's long.
[25:02.900 --> 25:03.820]  We're not there yet.
[25:04.240 --> 25:04.980]  Hello, Google.
[25:07.520 --> 25:09.380]  So that's the label, and that's the bird.
[25:10.120 --> 25:11.800]  You see fumes going on.
[25:12.160 --> 25:13.440]  That's before we had the...
[25:14.760 --> 25:19.460]  Yeah, after that we got the draft going, but now...
[25:19.460 --> 25:19.520]  Nope.
[25:21.040 --> 25:25.260]  So we come up with something that looks like a key.
[25:26.060 --> 25:31.280]  And I know the code is correct-ish, because, oh, it's the same shape.
[25:32.720 --> 25:33.700]  And there you go.
[25:34.420 --> 25:37.180]  So it comes up with something like this, and it is the same shape.
[25:37.500 --> 25:42.860]  But, of course, this will never fit in your lock, because this is a thick piece of plastic.
[25:43.500 --> 25:44.460]  But the shape is good.
[25:44.640 --> 25:48.080]  So what we do, we put this on a normal key copying machine.
[25:51.070 --> 25:56.170]  So here's the piece of plastic, there's a blank, and you need to have some knowledge about that blank.
[25:56.570 --> 25:56.970]  Granted.
[25:57.230 --> 26:03.230]  But, I mean, it looks like a dirty block, and we kind of guesstimate, yeah, that'll fit.
[26:03.450 --> 26:08.670]  So we take the thinnest blank we could find, and we got it.
[26:09.630 --> 26:10.290]  Very good.
[26:10.290 --> 26:17.410]  And being a hackerspace, open-sourcy, shared data, we put this project on the wiki.
[26:22.840 --> 26:26.320]  And, well, I don't know if the lock worked.
[26:35.750 --> 26:39.070]  You can hear when people reach the last line, that's fun.
[26:40.070 --> 26:40.530]  That's...
[26:40.530 --> 26:40.830]  Yep.
[26:48.010 --> 26:51.970]  And as, well, Dr. Wax stated, you'd better install these new cylinders.
[26:52.950 --> 26:56.250]  Well, officially, we didn't hear that, of course, because the bug was kicked.
[26:56.870 --> 27:00.830]  But, well, we got that all planned and installed and whatever.
[27:00.830 --> 27:07.410]  Because within 24 hours, we were there swapping the cylinders for a way better one.
[27:07.730 --> 27:14.070]  And having, I believe, 90 blanks, or 90 cut keys for them to actually redistribute to their members.
[27:14.690 --> 27:17.190]  Then they were like, no, no, no, next week would be better.
[27:17.450 --> 27:18.130]  F*ck you.
[27:19.330 --> 27:20.450]  New lock in there.
[27:20.530 --> 27:20.890]  Your problem.
[27:20.890 --> 27:24.470]  And, oh, because that's what you have a budget for.
[27:25.150 --> 27:30.710]  So, and after that, they were like, now you don't have the keys to our hackerspace anymore.
[27:31.010 --> 27:33.310]  I was like, who supplied that lock?
[27:35.130 --> 27:36.390]  They were like, oh.
[27:39.110 --> 27:43.510]  So then I become a member and got a discount because they didn't need to give me a key.
[27:45.550 --> 27:46.550]  Which is cool.
[27:47.010 --> 27:47.510]  I mean...
[27:47.510 --> 27:49.510]  Yes, it is.
[27:50.310 --> 27:51.270]  Somewhere in the world here.
[27:51.830 --> 27:51.870]  Okay.
[27:53.310 --> 27:54.070]  More fun.
[27:54.290 --> 27:54.350]  Okay.
[27:54.570 --> 27:54.870]  Amsterdam.
[27:55.270 --> 27:57.450]  We're going a bit more south to Belgium.
[27:57.790 --> 28:01.310]  Because Belgium, if you believe it or not, has speedcams.
[28:01.510 --> 28:03.070]  As more countries have.
[28:04.570 --> 28:05.530]  And those...
[28:06.050 --> 28:07.310]  There was a weird story.
[28:07.410 --> 28:09.250]  A story that I truly don't get.
[28:10.130 --> 28:12.990]  Apparently it was possible to not obtain the keys.
[28:13.130 --> 28:13.610]  Well, yes.
[28:13.930 --> 28:17.010]  But also the locks that go into these speedcams.
[28:17.150 --> 28:19.070]  I have no idea how that came apart.
[28:19.510 --> 28:24.910]  But there was a program showing you could, well, buy those locks.
[28:25.210 --> 28:26.870]  Key the like to a speedcams.
[28:27.570 --> 28:28.350]  It is in Dutch.
[28:28.650 --> 28:29.730]  We made up some subtitles.
[28:30.130 --> 28:30.750]  So bear with us.
[28:30.750 --> 28:31.610]  E-mails.
[28:31.730 --> 28:34.510]  There are often people who have tried to use the ones who have one thing.
[28:35.710 --> 28:40.530]  They JEFF COMMONS I don't want to use the ones.
[28:40.530 --> 28:42.570]  Anybody who have found all these emails.
[28:42.570 --> 28:43.990]  For example, e-mails.
[28:45.310 --> 29:03.890]  We have received emails like this, that we have given the emails that you have set up And... a cylinder slot.
[29:05.130 --> 29:08.010]  According to the mailschrever, this is in the flitspaal.
[29:08.590 --> 29:11.950]  And I can open it with these buttons the flitspaal.
[29:12.770 --> 29:14.170]  And how much has that cost?
[29:14.890 --> 29:17.330]  That cost €14,23.
[29:17.990 --> 29:23.190]  If this works for €14,23, that's very much cheaper than a flitspaal.
[29:24.110 --> 29:26.730]  This is it, this paal.
[29:26.730 --> 29:30.370]  There were in Vlaanderen a lot of action for these flitspaals.
[29:31.130 --> 29:35.470]  They shot them, they shot them, they shot them, they shot them.
[29:35.470 --> 29:36.290]  They even cut them off.
[29:36.290 --> 29:38.750]  But actually, that's not necessary for our mailschrever.
[29:39.570 --> 29:42.930]  Because the secret of this paal is in this box.
[29:43.750 --> 29:49.450]  This robust box is the steering, the steering, of the flow of that flitspaal.
[29:49.850 --> 29:50.890]  This sleutel.
[29:51.190 --> 29:53.430]  That you can make this combination with this.
[29:53.430 --> 29:54.410]  And then...
[29:55.370 --> 29:57.090]  Yeah, the clip is open.
[29:59.690 --> 30:00.890]  The sleutel will be passed.
[30:03.530 --> 30:04.810]  The door opens.
[30:10.350 --> 30:15.890]  Here you can even use them, hand- and automating, and automatically, to put them in and out.
[30:16.910 --> 30:17.830]  Let's take this out.
[30:19.970 --> 30:20.650]  Let's take this off.
[30:20.650 --> 30:22.290]  And then we are back at the end.
[30:25.070 --> 30:25.690]  It's completely new.
[30:26.630 --> 30:27.370]  This is very demanding.
[30:28.190 --> 30:28.930]  This is not possible.
[30:32.670 --> 30:35.490]  Okay, so you can buy the lock.
[30:36.030 --> 30:37.250]  I'm not going to buy the lock.
[30:37.450 --> 30:41.910]  I want to see if I'm capable or able to produce that key.
[30:42.290 --> 30:42.970]  Won't that be cool?
[30:43.610 --> 30:44.590]  Who would have thought of that?
[30:45.330 --> 30:47.710]  So from that video, we lifted this still.
[30:49.510 --> 30:50.130]  This one.
[30:50.490 --> 30:50.970]  Oh, useful.
[30:51.650 --> 30:52.550]  And boom.
[30:53.670 --> 30:54.270]  Thank you.
[30:55.110 --> 31:00.110]  That's probably going to save me 13.24 euros, that is.
[31:00.850 --> 31:04.700]  Because from this key, I can see it's a BKS, which is in Europe...
[31:05.170 --> 31:06.810]  Well, that's the same as the quick set.
[31:06.930 --> 31:08.570]  It has a peculiar head.
[31:09.070 --> 31:10.650]  So I can recognize this.
[31:10.650 --> 31:15.530]  And knowing that size, and well, what would these spacings be like?
[31:15.870 --> 31:17.050]  Well, kind of about this.
[31:17.690 --> 31:21.990]  This is, well, go online, figure out what the normal spacing is, what the depths are...
[31:21.990 --> 31:27.650]  And basically look very close at the picture, guesstimate a bit, make a key, compare...
[31:28.410 --> 31:29.270]  Yeah, that's about it.
[31:31.590 --> 31:41.250]  So this, we assume, du, at that time, is the key to all Belgium speedcaps.
[31:42.450 --> 31:44.390]  Maybe I shouldn't show this.
[31:45.270 --> 31:46.030]  I don't know.
[31:46.190 --> 31:46.430]  Too late.
[31:46.590 --> 31:46.690]  Done.
[31:48.130 --> 31:49.650]  But then, of course, dilemma.
[31:50.730 --> 31:52.090]  Because I can't use this.
[31:53.070 --> 31:55.670]  Well, one different continent.
[31:56.190 --> 31:57.430]  But rules.
[31:58.110 --> 32:01.910]  I'm not allowed to pick a lock that's not mine and I don't have permission for it.
[32:02.270 --> 32:06.190]  I'm pretty sure they're not going to give me permission to try this.
[32:06.990 --> 32:07.890]  So I can't.
[32:08.670 --> 32:11.430]  And I don't want to drive to Belgium, but you have to.
[32:11.430 --> 32:12.730]  Buy a speedcaps.
[32:13.230 --> 32:13.770]  Sorry?
[32:13.970 --> 32:15.290]  Buy a speedcaps.
[32:16.070 --> 32:19.810]  That was exactly what we did, you know.
[32:24.000 --> 32:29.740]  Through various ways, we were able to obtain totally legit a speedcaps.
[32:29.840 --> 32:30.820]  Heck yeah, it works.
[32:32.000 --> 32:33.000]  That's fun.
[32:34.560 --> 32:38.920]  Sometimes your trolling budget is, well, it takes a dive, but f*ck off.
[32:41.040 --> 32:44.980]  But of course, like I said, I mean, you could buy the lock with the keys with it.
[32:45.380 --> 32:54.540]  And of course, having the keys, not just the picture, but the actual physical key, well, it's the holy grail, basically, because then you can just dupe it.
[32:55.140 --> 32:58.160]  Because like we did with the plastic, just put it in a duplicator and go.
[32:59.160 --> 33:03.460]  Yeah, but there are other keys that have a restricted key ray, right?
[33:03.580 --> 33:07.760]  So you can't put that other piece in a duplicator, because it doesn't exist.
[33:07.760 --> 33:08.740]  You can't buy that.
[33:09.160 --> 33:17.000]  Well, not if you can be more resourceful than your normal guy, and actually buy that or make that.
[33:17.220 --> 33:17.880]  Make that.
[33:18.000 --> 33:18.300]  That's cool.
[33:18.620 --> 33:20.440]  This is an easy entry machine.
[33:21.180 --> 33:24.820]  And it basically does the same as a normal key copying machine.
[33:25.180 --> 33:27.920]  It scans your key, and it makes those grooves.
[33:29.240 --> 33:30.640]  But on the other side of the key.
[33:31.460 --> 33:36.380]  It takes slugs of brass that you put in the machine.
[33:36.640 --> 33:42.280]  And what it does, a normal key machine would mill this, right?
[33:43.000 --> 33:45.020]  And now it basically mills this.
[33:46.820 --> 33:51.980]  So it creates, out of a solid piece of brass, a blank.
[33:52.720 --> 33:56.440]  That you can then put in a normal key copying machine and do the other side.
[33:57.220 --> 33:57.800]  Way cool.
[33:59.020 --> 34:00.740]  It's kind of an expensive machine.
[34:00.900 --> 34:02.100]  Well, maybe not for locksmiths.
[34:02.520 --> 34:06.380]  But for a sports group, it kind of takes a hit.
[34:06.600 --> 34:08.400]  We do have one, but...
[34:10.140 --> 34:10.800]  Well, duh.
[34:14.020 --> 34:15.340]  So Germany has one.
[34:16.100 --> 34:17.080]  The U.S. has one.
[34:17.180 --> 34:17.820]  The Netherlands has one.
[34:17.940 --> 34:21.120]  But normal locksmith groups would be way too expensive for this.
[34:21.380 --> 34:22.080]  So, yeah.
[34:23.380 --> 34:24.500]  But it's doable.
[34:24.800 --> 34:30.860]  But even if you can't afford, or want to have, or whatever, this machine, there are other ways.
[34:30.980 --> 34:33.680]  If you have access to the key.
[34:34.860 --> 34:35.620]  Tin soldiers.
[34:35.960 --> 34:37.760]  Why the hell has he put tin soldiers?
[34:37.760 --> 34:40.320]  Well, you can cast stuff, right?
[34:40.860 --> 34:48.340]  And it even works for stupid keys that you haven't even got an idea how to cut those.
[34:48.600 --> 34:50.800]  I mean, weird angles and whatever.
[34:51.080 --> 34:53.280]  So, there are kits for that.
[34:53.500 --> 34:56.380]  This is actually an okay set for a low security lock.
[34:56.500 --> 34:58.760]  And there are better two-component stuff.
[35:00.440 --> 35:01.920]  But, same-o, same-o.
[35:02.860 --> 35:06.840]  A key, a normal key, is a piece of metal.
[35:07.760 --> 35:09.480]  In a certain form.
[35:10.260 --> 35:12.240]  That you could probably duplicate.
[35:14.260 --> 35:15.340]  This is cast.
[35:15.960 --> 35:19.040]  And you see, it's not a perfect copy.
[35:19.740 --> 35:24.620]  I mean, there's some stuff here, and it's not as blingy as the other one.
[35:24.760 --> 35:25.960]  But, it works.
[35:26.620 --> 35:30.880]  And if it doesn't, you can re-melt that and try again.
[35:31.860 --> 35:35.280]  Because it's just tin or any solder or God knows what.
[35:35.460 --> 35:37.980]  But, I mean, you can try everything.
[35:39.020 --> 35:57.240]  So, having your keys, losing your keys for, I don't know, two minutes, that's way enough time, if it's planned ahead, to not make a duplication, but take all the measurements for the mold, or actually making the mold, that's enough.
[35:57.820 --> 36:04.460]  So, if you lose your key for two minutes, in the wrong situation, it's considered lost.
[36:06.720 --> 36:09.160]  And if you find it back, it's considered a souvenir.
[36:09.160 --> 36:09.360]  You can hear?
[36:13.120 --> 36:13.600]  Okay.
[36:14.020 --> 36:14.900]  Showing keys in public.
[36:15.020 --> 36:16.080]  What can possibly go wrong?
[36:16.440 --> 36:18.120]  This is Rop Gonggrijp.
[36:19.080 --> 36:23.160]  And, well, if I give this talk in Europe, everybody goes like, yes, that's Rop Gonggrijp.
[36:24.020 --> 36:25.820]  Rop is in the Netherlands.
[36:25.940 --> 36:27.660]  He's the most well-known hacker.
[36:28.040 --> 36:32.800]  He founded the first public ISP access role.
[36:33.040 --> 36:33.880]  So, he's a good guy.
[36:34.680 --> 36:35.880]  And he's a hippie.
[36:37.580 --> 36:38.860]  And, let's do a movie.
[36:40.840 --> 36:41.400]  He's a...
[36:44.260 --> 36:46.380]  We are now at station Weespotplein.
[36:46.620 --> 36:47.820]  We are at the local Amsterdam.
[36:47.980 --> 36:52.060]  And we are going to run a little here to let us see what we gathered here in the 90's.
[36:54.860 --> 37:04.340]  We spoke to the beginning of the year, while we came here, and we had through all kinds of Joy to survival, and a slot in hand was made by the netrosystem in the way.
[37:04.660 --> 37:06.360]  The slot belongs to there literally in the world.
[37:06.360 --> 37:10.560]  And now it's the case that under this station all the interesting things are...
[37:10.560 --> 37:11.800]  ...and bunkers.
[37:12.500 --> 37:13.240]  Vreselijks spannend.
[37:13.520 --> 37:14.760]  Especially in that time was it wonderful.
[37:35.770 --> 37:36.790]  We're in the lift.
[37:36.930 --> 37:38.090]  I'm not going to press the button.
[37:38.410 --> 37:40.070]  I'm going to try the magische sleutel.
[37:42.350 --> 37:43.590]  We're going to close the door.
[37:44.410 --> 37:45.810]  We're not going to the pool.
[37:48.050 --> 37:49.430]  We're going to get used to the lift.
[37:50.530 --> 37:51.490]  We're going to go through.
[38:10.950 --> 38:15.790]  And then you have hackers in your super secret underground bunker.
[38:20.290 --> 38:21.490]  What's wrong with this picture?
[38:24.650 --> 38:26.690]  It's a tad out of focus, yes.
[38:27.630 --> 38:28.730]  It's a bit crooked.
[38:30.010 --> 38:32.910]  And, I mean, he's a hacker for God's sakes.
[38:33.690 --> 38:34.630]  He's security fuzzy.
[38:35.390 --> 38:35.910]  Chevy.
[38:36.910 --> 38:37.710]  He's savvy.
[38:37.870 --> 38:38.550]  He knows security.
[38:39.110 --> 38:39.930]  Talk about it.
[38:40.910 --> 38:41.890]  That's not the key.
[38:43.770 --> 38:44.890]  That's not the key.
[38:46.990 --> 38:47.990]  Let me repeat.
[38:48.170 --> 38:48.950]  That's not the key.
[38:50.910 --> 38:52.050]  But you didn't know that, right?
[38:52.690 --> 38:55.030]  I mean, the drama and getting in.
[38:55.270 --> 38:56.150]  Dunk, dunk, dunk.
[38:56.610 --> 39:02.290]  So, we take nothing away from this new segment by faking it.
[39:02.890 --> 39:03.730]  They had the key.
[39:03.890 --> 39:04.730]  Yeah, you saw them use it.
[39:05.130 --> 39:05.790]  That's different.
[39:05.930 --> 39:09.010]  This is just a cabinet key laying around, God knows what.
[39:09.010 --> 39:11.410]  That's not even close to the actual key.
[39:13.590 --> 39:21.070]  That's a perfect, valid way, in my opinion, to bring that story.
[39:22.090 --> 39:25.130]  So, you don't have to leak info.
[39:25.530 --> 39:26.930]  You don't have to.
[39:29.750 --> 39:31.850]  Because we all get this.
[39:32.230 --> 39:36.990]  We all get that in normal situations, this is a bad idea.
[39:36.990 --> 39:37.830]  Yes?
[39:38.470 --> 39:46.870]  I mean, we can even convince users that this is maybe a bad idea.
[39:48.070 --> 39:51.630]  The idea is probably even worse than we imagined at the moment.
[39:52.930 --> 39:55.170]  Because this is not just looking with glass.
[39:55.310 --> 39:58.390]  No, this is looking with glass from across the room.
[39:58.550 --> 39:59.690]  That's what this research is.
[39:59.710 --> 40:01.090]  That's quite recent, I believe.
[40:02.630 --> 40:03.150]  And...
[40:03.710 --> 40:05.350]  But that also...
[40:05.350 --> 40:06.990]  Because this is your key.
[40:08.630 --> 40:09.990]  This is the same as your key.
[40:10.210 --> 40:11.090]  So, I...
[40:11.730 --> 40:16.250]  Well, showing your key in public is, to me, the same.
[40:16.570 --> 40:18.730]  Well, it's basically giving out your password.
[40:19.490 --> 40:20.410]  Which is wrong.
[40:21.430 --> 40:22.530]  Which we shouldn't do.
[40:23.890 --> 40:27.470]  And please let not be too stupid about it.
[40:28.650 --> 40:30.090]  Because this is a...
[40:30.090 --> 40:31.110]  This is a bad man.
[40:31.830 --> 40:34.490]  This is a killer, who are considered bad men.
[40:35.250 --> 40:35.810]  And...
[40:35.810 --> 40:37.230]  He got convicted.
[40:38.010 --> 40:38.910]  Thrown in jail.
[40:39.330 --> 40:40.430]  And he walked out.
[40:40.610 --> 40:41.670]  Of that same jail.
[40:44.090 --> 40:44.650]  Because...
[40:44.650 --> 40:50.590]  The design of the master key was printed on front of the prisoner's information handbook.
[40:51.610 --> 40:56.910]  A copy of that book was given to all inmates on arrival at that prison.
[41:04.320 --> 41:06.640]  High security facility.
[41:08.080 --> 41:09.660]  And that's one sentence.
[41:09.860 --> 41:11.120]  I don't know what's wrong with that sentence.
[41:11.240 --> 41:17.840]  But there's something wrong with the mixture of those words and these face-palmy thingies.
[41:19.000 --> 41:22.380]  What I'm trying to say is...
[41:22.380 --> 41:24.060]  It's...
[41:26.180 --> 41:27.060]  Insecurity...
[41:28.000 --> 41:28.880]  It's...
[41:28.880 --> 41:32.280]  Sometimes quite straightforward to do things good.
[41:32.600 --> 41:40.620]  But it's mostly way easier to find one person f*cking that up.
[41:43.330 --> 41:44.610]  I have a bit of time.
[41:44.830 --> 41:45.410]  I just...
[41:45.410 --> 41:46.490]  I mean...
[41:46.490 --> 41:51.090]  Last week I heard a story about a nuclear power plant in Austria.
[41:51.290 --> 41:53.050]  It's totally unrelated, but I want to share.
[41:53.950 --> 41:54.470]  And...
[41:55.170 --> 41:57.350]  Being a nuclear power plant...
[41:57.350 --> 41:58.010]  Well, they...
[41:58.010 --> 42:00.190]  Safety is quite high on their list.
[42:00.650 --> 42:01.510]  Security also.
[42:01.690 --> 42:02.550]  But safety...
[42:02.550 --> 42:02.570]  Whoa.
[42:03.790 --> 42:04.310]  It's...
[42:04.310 --> 42:04.870]  Well, kinda.
[42:05.130 --> 42:05.730]  It's nuclear.
[42:06.670 --> 42:07.190]  So...
[42:07.810 --> 42:11.770]  There's these guys that we do not have enough fire extinguishers.
[42:11.990 --> 42:14.410]  And they do buy the right type.
[42:14.850 --> 42:15.290]  And cool.
[42:15.510 --> 42:17.350]  So they hire a guy going in there.
[42:18.010 --> 42:18.770]  Hazmat suit.
[42:18.870 --> 42:19.150]  I don't know.
[42:19.350 --> 42:20.130]  I'm making that up.
[42:20.290 --> 42:21.250]  But he's...
[42:21.250 --> 42:24.270]  So he comes in to install fire extinguishers.
[42:24.590 --> 42:26.590]  And halfway through this job, it's like...
[42:26.590 --> 42:27.550]  This is a stupid wall.
[42:28.410 --> 42:32.350]  Why do they use nine-inch steel plate on this normal wall?
[42:33.030 --> 42:34.750]  Drill, drill, drill, drill.
[42:35.730 --> 42:36.790]  Drill, drill, drill.
[42:37.230 --> 42:38.130]  New drill bits.
[42:38.650 --> 42:39.010]  So...
[42:39.010 --> 42:40.190]  On their...
[42:41.070 --> 42:44.810]  Primary containment vessel, they now have eight holes.
[42:46.690 --> 42:48.670]  But they do have fire extinguishers.
[42:50.470 --> 42:52.590]  But they can't pressurize it anymore.
[42:52.890 --> 42:53.490]  So...
[42:53.490 --> 42:54.030]  Out of commission.
[42:54.990 --> 42:55.590]  One...
[42:55.590 --> 42:56.310]  F*ck up.
[42:57.930 --> 42:58.530]  One...
[42:58.530 --> 42:58.890]  F*ck up.
[42:59.530 --> 43:02.870]  And your safety, security, whatever, can be rendered mute.
[43:03.290 --> 43:04.030]  That was all.
[43:04.030 --> 43:04.650]  Thank you very much.
[43:11.870 --> 43:14.730]  If there's any questions, please use the microphones.
[43:17.470 --> 43:18.190]  And there's not.
[43:18.370 --> 43:18.870]  Thank you very much.
[43:19.210 --> 43:19.890]  Oh, there is.
[43:20.970 --> 43:21.770]  There is a question.
[43:21.950 --> 43:22.610]  There's a question.
[43:22.810 --> 43:23.190]  There's two.
[43:23.430 --> 43:23.750]  There's more.
[43:23.910 --> 43:24.030]  Wow.
[43:24.450 --> 43:25.030]  Bring it.
[43:25.590 --> 43:25.990]  There's two.
[43:25.990 --> 43:27.090]  Who hates to be hackerspace in Arnhem?
[43:27.350 --> 43:27.750]  Sorry?
[43:27.950 --> 43:29.350]  Who hates to be hackerspace in Arnhem?
[43:29.550 --> 43:29.930]  Uh...
[43:29.930 --> 43:30.230]  Hact...
[43:30.230 --> 43:30.990]  Hactweervieter.
[43:31.170 --> 43:33.930]  She was asking what the name of the hackerspace in Arnhem was.
[43:36.050 --> 43:36.450]  Uh...
[43:36.450 --> 43:37.610]  Another example.
[43:37.610 --> 43:40.750]  There wasn't all sorts of elevator stupidity.
[43:40.890 --> 43:41.550]  We've been here earlier.
[43:41.850 --> 43:43.170]  Did you have something with that?
[43:44.270 --> 43:45.550]  Come to the talk on Sunday.
[43:45.810 --> 43:51.410]  There's a talk about failability with keys and losing them tomorrow.
[43:51.650 --> 44:03.950]  There was another instance where there was, I want to say South Africa, where they were showing off this brand new prison and everything like that and taking a news crew around.
[44:04.150 --> 44:07.310]  And the news crew got pictures of the keys.
[44:07.310 --> 44:07.690]  Yes.
[44:07.690 --> 44:14.890]  And they billed the news crew for replacing all the locks because they didn't trust them anymore.
[44:14.930 --> 44:15.430]  You f*cked up.
[44:15.590 --> 44:18.690]  Well, at least they didn't issue them on the front of a manual.
[44:20.010 --> 44:24.730]  Well, I mean, you can release numbers to keys in several ways.
[44:24.850 --> 44:28.310]  There was some big school complex somewhere in America.
[44:29.670 --> 44:31.410]  Could be somewhere.
[44:31.570 --> 44:32.070]  It doesn't really matter.
[44:32.290 --> 44:36.190]  And they had some financial problems and there were some questionable things.
[44:36.190 --> 44:43.110]  So with a freedom of information construction, the media managed to get some papers out.
[44:44.130 --> 44:53.270]  And among these papers were the bills or the technical specs for the locks that got installed.
[44:54.150 --> 44:55.010]  The invoices.
[44:55.010 --> 44:55.050]  The invoices.
[44:55.070 --> 44:56.110]  That was the word I was looking for.
[44:56.250 --> 45:00.090]  And the codes for those particular locks were on the invoice.
[45:00.090 --> 45:01.270]  Hmm.
[45:01.490 --> 45:12.510]  I mean, I can't imagine that some bookkeeper who has to get these papers out kind of makes that wrong decision to not blur out those numbers.
[45:12.510 --> 45:13.970]  I kind of get that.
[45:14.930 --> 45:15.050]  Ish.
[45:15.730 --> 45:19.350]  I mean, maybe it shouldn't be their decision, but I mean, it's understandable.
[45:19.630 --> 45:20.770]  It's a f*ck up, yes.
[45:20.990 --> 45:23.110]  But I mean, she's not the security person.
[45:23.350 --> 45:24.710]  She has numbers of...
[45:24.710 --> 45:25.510]  Well, she, god damn.
[45:25.770 --> 45:30.970]  That particular person is not the security guy slash woman slash else, whatever.
[45:30.970 --> 45:33.510]  But, yeah.
[45:34.850 --> 45:38.710]  But then, they were looking at, okay, this is gonna cost money.
[45:38.810 --> 45:42.810]  Because they have a shitload of buildings, so a shitload of keys.
[45:42.950 --> 45:43.790]  They're all master keyed.
[45:43.990 --> 45:49.190]  To change them all out, that was, what was it, 700 grand or something?
[45:49.290 --> 45:50.490]  That was their initial idea.
[45:50.810 --> 45:51.290]  I don't know.
[45:52.150 --> 45:53.570]  A bundle of, maybe more.
[45:53.710 --> 45:53.910]  I don't know.
[45:53.970 --> 45:54.590]  A bundle of money.
[45:54.590 --> 45:56.650]  But then they figured out, no, no, no, no, no, no.
[45:57.210 --> 45:58.630]  We have a restricted key way.
[46:00.110 --> 46:00.850]  That's good.
[46:01.450 --> 46:03.610]  Because copies can't be made.
[46:04.110 --> 46:05.330]  It's impossible.
[46:05.630 --> 46:07.390]  Doesn't happen in this world.
[46:09.330 --> 46:12.810]  Some of the keys they used were not restricted, so we only changed them about.
[46:12.990 --> 46:17.630]  So the cost price was about 15% that initially thought of.
[46:18.330 --> 46:20.790]  But then restricted key profiles, we looked at that.
[46:22.910 --> 46:26.710]  And, like, I mean, I don't know who you guys were in the talk yesterday.
[46:27.550 --> 46:30.390]  If I can see your key way, you're f*cked.
[46:33.050 --> 46:35.750]  And I don't need to make a bump key, because I have your codes.
[46:36.650 --> 46:38.610]  I only need the key... So, there you go.
[46:39.170 --> 46:39.790]  Any more questions?
[46:42.770 --> 46:43.170]  Ray?
[46:43.470 --> 46:47.430]  No, no question, but if we still have time, possibly another short story.
[46:47.610 --> 46:47.610]  Not that much.
[46:47.650 --> 46:48.910]  Yes, five minutes we have.
[46:49.090 --> 46:50.030]  Just one minute.
[46:50.250 --> 46:58.550]  Related to the last HOPE conference, I remember some crazy guy released, or not released, but showed how to make two different handcuff keys at the last HOPE conference.
[46:59.110 --> 47:00.890]  It was some German, wasn't it?
[47:00.970 --> 47:02.590]  Yeah, I'm not... Don't you remember the name.
[47:02.790 --> 47:03.130]  No, but...
[47:03.130 --> 47:06.990]  But actually, there was two different keys he presented.
[47:07.230 --> 47:13.790]  One was a very easy-to-obtain key he got from eBay, and the other was a key to a handcuff which wasn't even released at that time.
[47:14.490 --> 47:19.830]  So, one of the keys he put on Thingiverse, the other one he didn't put on Thingiverse because he's a responsible guy, of course.
[47:19.830 --> 47:20.250]  Of course.
[47:20.410 --> 47:20.870]  That's what you do.
[47:21.030 --> 47:25.010]  And there was a reporter in the room who made a nice story about that.
[47:25.230 --> 47:25.370]  Of course.
[47:25.450 --> 47:31.590]  And he quoted Ray saying, I put one key on Thingiverse, and I won't put the other because it's too secret.
[47:32.070 --> 47:35.370]  With a photo of both keys directly next to it.
[47:37.670 --> 47:39.590]  But Daniel did apologize for that, right?
[47:39.590 --> 47:42.810]  He apologized for that later in the block, but the photo was out, so...
[47:42.810 --> 47:43.330]  But still, yeah.
[47:43.470 --> 47:49.650]  Now there's a model of Thingiverse done by someone else who said, Oh, I tried to make it from the photo of the block.
[47:49.910 --> 47:53.590]  Which is allegedly possible, yeah, to make keys from photos, yeah.
[47:54.190 --> 47:56.990]  But I won't admit that I tried it and it worked, so...
[47:56.990 --> 47:57.430]  Cool.
[47:58.250 --> 47:58.950]  Good one, Ray.
[47:59.470 --> 47:59.790]  Render.
[48:00.730 --> 48:02.590]  Since we're talking about *uck-up stories.
[48:03.130 --> 48:04.910]  Not one I was involved in, thank God.
[48:05.290 --> 48:05.550]  Heck no.
[48:05.570 --> 48:15.210]  One I did here was apartment building, which, you know, lots of people coming and going, and, you know, you've got keys not being returned, you know, all those sorts of problems.
[48:15.370 --> 48:22.850]  So, you know, oh, yeah, it's really expensive to re-key everything every time, you know, somebody doesn't turn their key in when they leave and everything like that.
[48:23.190 --> 48:26.830]  So the maintenance guy got himself a pin kit.
[48:27.210 --> 48:27.570]  Great.
[48:27.790 --> 48:28.130]  Cool.
[48:28.970 --> 48:40.790]  So what he would do was make it work for pretty much any key that was there, and they'd just go and get a new kind of key keyed and, you know, do a master key.
[48:41.130 --> 48:45.110]  Well, over the years, this thing was nothing but wafers.
[48:46.410 --> 48:50.290]  You could shove anything into this thing and it would open.
[48:50.570 --> 49:01.630]  Because if you understand master keying, like, you basically have a pin at every single possible level on every single position, and, yeah, you could shove a twig in this thing and it would open.
[49:02.310 --> 49:10.810]  So, you know, some people who think they understand, you know, locks and security, maybe shouldn't.
[49:10.810 --> 49:13.130]  Well, they understand how they work.
[49:13.310 --> 49:14.870]  Well, they understand enough to f*ck up.
[49:14.890 --> 49:15.110]  But they don't understand what they're there for.
[49:16.290 --> 49:17.150]  It's basically here.
[49:18.310 --> 49:18.490]  Cool.
[49:19.170 --> 49:19.390]  Thank you.
[49:19.430 --> 49:19.970]  Any other good stories?
[49:20.250 --> 49:21.750]  I mean, we can line up for stories.
[49:22.150 --> 49:23.170]  Forget about questions.
[49:25.290 --> 49:26.030]  Oh, that's it.
[49:26.710 --> 49:27.530]  Oh, there's no one.
[49:27.610 --> 49:28.250]  Oh, oh, oh, oh.
[49:28.350 --> 49:28.870]  Def's here.
[49:29.050 --> 49:29.310]  Def.
[49:30.910 --> 49:31.210]  Yes.
[49:31.650 --> 49:40.770]  By the way, just for reference, he and I were sitting next to each other at a hope, God knows how many years ago, and learned lockpicking at the same time.
[49:42.110 --> 49:44.390]  And it's amazing what this man has done in that time.
[49:44.910 --> 49:46.170]  Yeah, he's got two books.
[49:46.170 --> 49:48.930]  Like, I just want to give props to this guy for taking...
[49:48.930 --> 49:52.110]  Like, sitting next to him and learning and seeing how far he's going is just awesome.
[49:52.430 --> 49:53.590]  I got a story also.
[49:53.750 --> 49:54.650]  Def, can you hold on for just a second?
[49:54.650 --> 49:55.110]  Yeah, go for it, man.
[49:55.770 --> 50:00.050]  At some security conference in Vegas, maybe?
[50:00.350 --> 50:00.890]  I don't remember.
[50:01.950 --> 50:05.010]  There was a security thingy going on.
[50:05.250 --> 50:08.330]  And we kind of blew some fuses at some point.
[50:08.430 --> 50:10.310]  That's not the one that there's videos of.
[50:10.370 --> 50:12.750]  That's another totally not related event.
[50:13.470 --> 50:14.270]  Do not Google.
[50:14.270 --> 50:14.950]  Or maybe do.
[50:15.150 --> 50:15.850]  See if I care.
[50:16.590 --> 50:20.130]  And fuses blown.
[50:20.690 --> 50:21.510]  Fuses blown.
[50:21.710 --> 50:25.670]  And workshops hold and help.
[50:26.870 --> 50:27.350]  Housekeeping!
[50:27.770 --> 50:28.290]  Or whatever.
[50:28.510 --> 50:28.950]  Janitor.
[50:29.090 --> 50:29.690]  Who do you call?
[50:30.230 --> 50:32.310]  Well, it goes, well, it could be.
[50:32.490 --> 50:36.930]  Well, some guy with the keys to the kingdom from that way too expensive hotel showed up.
[50:37.310 --> 50:40.730]  And, of course, he had keys, keys, keys.
[50:41.370 --> 50:42.130]  Lots of them.
[50:42.130 --> 50:48.910]  But one of those keys on his quite massive keyring looked way more worn than all the others.
[50:49.690 --> 50:52.830]  They were all bright, shiny, new.
[50:53.350 --> 50:54.050]  Except that one.
[50:54.830 --> 50:59.730]  Which tells us that's the key he used every day, all day.
[51:00.710 --> 51:08.130]  There's a quite above-efforts chance that that's your master key dangling in plain view.
[51:09.690 --> 51:17.230]  Walking into a room of hackers, nerds, who fiddle around with locks and have high-def cameras.
[51:19.650 --> 51:20.850]  My story stops here.
[51:21.010 --> 51:21.530]  That would be better.
[51:21.670 --> 51:22.110]  Def.
[51:23.490 --> 51:29.770]  Well, just to talk about the Mr. Farias, the lock picker, the locksmith, who was selling the fire keys in New York.
[51:30.090 --> 51:33.970]  The fireman's key, which gets you also into the subway gates and things.
[51:34.550 --> 51:36.590]  That's been so publicly described.
[51:36.890 --> 51:39.770]  And what you showed was the New York Post story with the quote and everything.
[51:39.990 --> 51:42.790]  You know, we checked with somebody and, you know, you cannot make this key.
[51:43.190 --> 51:44.830]  That's mentioned in our talk tomorrow.
[51:44.830 --> 51:47.910]  And we were mentioning, we were all laughing at it, ha, look at those jerks.
[51:48.410 --> 51:52.610]  What was not mentioned in Yost's talk, but we've decided after we checked with legal.
[51:53.210 --> 51:55.690]  And we found out that they've replaced some and haven't replaced others.
[51:56.210 --> 52:00.150]  We're going to go ahead and drop the full bidding code in our talk tomorrow on that key.
[52:00.450 --> 52:04.830]  And you'll understand why it's not the security breach you think, but it's still something.
[52:04.990 --> 52:06.870]  So you should come to the elevator hacking talk at noon.
[52:08.670 --> 52:09.250]  Thank you.
[52:11.550 --> 52:12.550]  I believe we're done here.
[52:13.050 --> 52:13.910]  Thank you very much.
[52:13.910 --> 52:14.690]  Have a good one.