Daring Fireball, quoting the NY Post:

Master keys for every elevator in the city, major construction sites, subways and skyscrapers are being freely sold online, despite a city law that makes it illegal for unauthorized persons to possess them.

A New Jersey-based lock company is peddling an unlimited supply of New York City’s “1620” fire service keys on eBay at $15.50 for two.

Access to the Big Apple keys is sharply restricted. It’s unlawful for anyone other than firefighters, law-enforcement personnel, elevator contractors or inspectors and building owners to have them.

But a Post reporter bought two keys to the city with no questions asked from UltimateSecurityDevices.com, an online arm of Northeast Lock Corp. in Clifton, NJ.

Gruber's response:

This is, effectively, what the Department of Justice wants for the iPhone.

Here's the part that I think is widely underreported/argued/claimed, and it's painful to see Gruber skip over it: Networked devices aren't like physical ones in that there's not absolute geographical protection. If you want to break into my elevator, you at also have to be there. If you want to break into Director Comey's car trunk, you have to be beside his car. And I bet there's at least one camera on you.

I can't break into a NY elevator or Directory Comey's car trunk from overseas. But folks can break into your PC or phone more easily overseas than they can in your driveway.

Your "back door", if you have one, is accessible to anyone on the network, not just the guys who drive to your neighborhood. Joel Spolsky talks about barriers to entry. Actually having to get there is one of the biggest.

This is why I wrote, "A better neighborhood for our personal data". We have one small street, geographically speaking, with a billion-plus people all living there, their personal data exposed to any other unscrupulous schmoe living on our single street. A locksmith once told me that a lock keeps an honest man honest. A billion men aren't all going to be honest, man.

PS Google: Beetee Dub, I didn't write about better neighborhoods for our data in 2002, okay? Why can't Google index blogspot correctly? I've consistently seen search issues (or items that would pop up in blogger's interface when searching, but not on Google) with my blog. I mean, it is at least marginally in Google's own interest to support blogspot well, right? Right? /sheesh

Labels: encryption, gruber, networking, safety