Results 1 to 8 of 8

Thread: Should a customer be made aware of a security flaw?

  1. #1
    Regular Member Freedom1Man's Avatar
    Join Date
    Jan 2012
    Location
    Greater Eastside Washington
    Posts
    4,690

    Should a customer be made aware of a security flaw?

    If you discovered an interesting security flaw in a customer's security, in this case it being the customer's own fault, should you point it out?

    In this case I noticed that building sites use a construction key and construction balls. The way that things are setup if you gained access to a construction key and at least one end user key, you can cut one key that would open almost all the homes in a development. More so with one brand of lock than another.



    Sent from my SM-G386T using Tapatalk
    Provision for free medical attendance and nursing, for clothing, for food, for housing, for the education of children, and a hundred other matters, might with equal propriety be proposed as tending to relieve the employee of mental strain and worry. --- These matters obviously lie outside the orbit of congressional power. (Railroad Retirement Board v Alton Railroad)

  2. #2
    Centurion
    Join Date
    Jun 2008
    Location
    Pleasant Grove, Utah, USA
    Posts
    3,828
    Certainly would encourage the END USER to CHANGE ALL THE LOCKS when taking possession.
    RIGHTS don't exist without RESPONSIBILITY!
    If one is not willing to stand for his rights, he doesn't have any Rights.
    I will strive to stand for the rights of ANY person, even those folks with whom I disagree!
    As said by SVG--- "I am not anti-COP, I am PRO-Citizen" and I'll add, PRO-Constitution.
    If the above makes me a RADICAL or EXTREME--- So be it!

    Life Member NRA
    Life Member GOA
    2nd amendment says.... "...The right of the people to keep and bear arms SHALL NOT BE INFRINGED!"

  3. #3
    Regular Member
    Join Date
    Feb 2013
    Location
    Thru Death's Door in Wisconsin
    Posts
    13,154
    Customer suggests OPie is a contractor with deficient professional ethics. Would the same dilemma arise were he an employee?
    I am responsible for my writing, not your understanding of it.

  4. #4
    Regular Member solus's Avatar
    Join Date
    Aug 2013
    Location
    here nc
    Posts
    6,875
    Freedom, as i am sure you are aware, a construction key is not the same as a master key. once the homeowner uses their personal property key, the 'balls' are pushed into a cavity and therefore render the construction key inoperable. now if the new homeowner doesn't walk around to use their key in all locks, there is an opportunity to leave an outside lockset in construction mode. additionally, having a user's key and construction key you should only gain you access to the one property key was from.

    where the problem ensue is if the builder is the financier and has a long term interest in the development and properties and maybe asked for locksets which are construction keyed as well as master keyed so there may be a 'master key' or physically pinned to have one key open each of the property locksets.

    fyi, there are perhaps no more than 30-35 construction key combinations currently in use as well as construction keys have been around a long time with minimal issues to date.

    Bottom line, a known risk

    i personally knew who lived in my current adobe and still upgraded to dbl keyed deadbolts around the property...some fool might get in through a window...but they aren't getting out through a door.

    ipse
    Last edited by solus; 04-12-2016 at 04:50 PM.
    I'm only human; I do what I can; I'm just a man; I do what I can; Don't put the blame on me; Don't put your blame on me ~ Rag'n'Bone Man.

    Please do not get confused between my personality & my attitude. My personality is who I am ~ my attitude depends on who you are and how you act.

    Remember always, do not judge someone because they sin differently than you do!

    Get your facts first, and then you can distort them as much as you please. Mark Twain

  5. #5
    Regular Member Freedom1Man's Avatar
    Join Date
    Jan 2012
    Location
    Greater Eastside Washington
    Posts
    4,690
    Quote Originally Posted by solus View Post
    Freedom, as i am sure you are aware, a construction key is not the same as a master key. once the homeowner uses their personal property key, the 'balls' are pushed into a cavity and therefore render the construction key inoperable. now if the new homeowner doesn't walk around to use their key in all locks, there is an opportunity to leave an outside lockset in construction mode. additionally, having a user's key and construction key you should only gain you access to the one property key was from.

    where the problem ensue is if the builder is the financier and has a long term interest in the development and properties and maybe asked for locksets which are construction keyed as well as master keyed so there may be a 'master key' or physically pinned to have one key open each of the property locksets.

    fyi, there are perhaps no more than 30-35 construction key combinations currently in use as well as construction keys have been around a long time with minimal issues to date.

    Bottom line, a known risk

    i personally knew who lived in my current adobe and still upgraded to dbl keyed deadbolts around the property...some fool might get in through a window...but they aren't getting out through a door.[emoji38]
    ipse
    The construction balls though normally replace only one pin. I go for as many as I can.

    And the master pins that are installed to allow the construction key to work, stay there.
    So, normally only one pin changes when the user key is used leaving 4 out of 5 pins with 2 numbers that will clear that position. So the construction key, with one number smaller, will open most of the locks.

    I demonstrated that today. Boss is being an Ahole told me that we cannot tell our customers that this could be an issue to be aware of.

    Instead, home owners are getting houses that an odd ball key could be used to open their front door. The same key could be used to open up 90+% of all the homes in many developments.

    Sent from my SM-G386T using Tapatalk
    Provision for free medical attendance and nursing, for clothing, for food, for housing, for the education of children, and a hundred other matters, might with equal propriety be proposed as tending to relieve the employee of mental strain and worry. --- These matters obviously lie outside the orbit of congressional power. (Railroad Retirement Board v Alton Railroad)

  6. #6
    Regular Member
    Join Date
    Feb 2013
    Location
    Thru Death's Door in Wisconsin
    Posts
    13,154
    Deficient ethics.
    I am responsible for my writing, not your understanding of it.

  7. #7
    Regular Member solus's Avatar
    Join Date
    Aug 2013
    Location
    here nc
    Posts
    6,875
    Quote Originally Posted by Freedom1Man View Post
    The construction balls though normally replace only one pin. I go for as many as I can.

    And the master pins that are installed to allow the construction key to work, stay there.
    So, normally only one pin changes when the user key is used leaving 4 out of 5 pins with 2 numbers that will clear that position. So the construction key, with one number smaller, will open most of the locks.

    I demonstrated that today. Boss is being an Ahole told me that we cannot tell our customers that this could be an issue to be aware of.

    Instead, home owners are getting houses that an odd ball key could be used to open their front door. The same key could be used to open up 90+% of all the homes in many developments.

    Sent from my SM-G386T using Tapatalk
    construction key'd locksets are pinned, normally number 2 cylinder with 1 - 3 'balls', which as indicated previously the balls are cleared when the formal key is used and in application renders the construction key inoperable.




    as mentioned, these type of builder's locksets are not physically pinned in each cylinder to allow 'master keys' to function after the 'ball' has been cleared.

    that said...perhaps there is some shady deal transpiring which you might not wish to be privy to...but your comment, quote: Instead, home owners are getting houses that an odd ball key could be used to open their front door. The same key could be used to open up 90+% of all the homes in many developments. unquote tells me someone might have inadvertently (read as given the benefit of the doubt on mistake) mis-ordered the locksets as mastered and since they are installed would cost too much to correct the cylinders...(read first underlined sentence in this paragraph and act accordingly).

    that darn rock & a hard spot coupled w/putting food on the table is a tough spot to be in...

    ipse
    Last edited by solus; 04-12-2016 at 05:58 PM. Reason: other jpg failed to load twice...sry
    I'm only human; I do what I can; I'm just a man; I do what I can; Don't put the blame on me; Don't put your blame on me ~ Rag'n'Bone Man.

    Please do not get confused between my personality & my attitude. My personality is who I am ~ my attitude depends on who you are and how you act.

    Remember always, do not judge someone because they sin differently than you do!

    Get your facts first, and then you can distort them as much as you please. Mark Twain

  8. #8
    Regular Member Freedom1Man's Avatar
    Join Date
    Jan 2012
    Location
    Greater Eastside Washington
    Posts
    4,690
    You have to use master pins when keying the two major residential key brands. They are only used on the front doors and we construction ball the which even pin the manufacturer tells us to. I do an extra spot when I can to eliminate one more pin combo.


    In Kwikset the balls =2 and then in Schlage the balls equal 3.

    To clear all of the pins the user key would have to be only one off from the construction key and the 2 or 3 shallower in the cut.

    Construction key (in Kwikset)#66666 could have an end user key of 12343 in that key schedule you would have 11141 11143 11241 ......
    The construction ball would be in the 4th spot. So a key of 66646 would open all of the locks in that schedule.

    Sent from my SM-G386T using Tapatalk
    Last edited by Freedom1Man; 04-14-2016 at 09:07 PM.
    Provision for free medical attendance and nursing, for clothing, for food, for housing, for the education of children, and a hundred other matters, might with equal propriety be proposed as tending to relieve the employee of mental strain and worry. --- These matters obviously lie outside the orbit of congressional power. (Railroad Retirement Board v Alton Railroad)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •