From the 'obvious wear' or 'tracking substance added' risks mentioned, it also seems you should, after entering the proper code, touch every other number redundantly as well.
I suppose with 10 transparent markers that are distinguishable under detailed inspection (such as fluorescing to different colors under UV light), you could even work out the right order on the first try: "traces of orange have transferred to 3 other keys, so the orange key was pressed first; traces of green to 2 other... (etc.)"
I wonder whether any of the FLIR imagers that are currently commercially available and reasonably portable are sensitive enough to make this work. Any links?
The keypad at an office I worked at about 10 years ago had an electronic display that randomized the key positions. The display's viewing angle was artificially narrowed as well. I thought that all of this was to prevent shoulder-surfing -- the wear and buildup issue never crossed my mind.
I've never come across a keypad lock that would be vulnerable to this. You either have to press # at the end of the code, or the codes are significantly longer than 4 digits. Of course, even in the first category, entering 24 codes (50% chance of entering 12 or fewer) isn't a huge barrier once you know the four digits.
If you knew that everyone used four different digits for keypad locks, that would dramatically reduce the number of possible combinations you had to try...
How about "use something random, change the keys before they wear down, and wipe them before and after use if you're paranoid."
Wow, I just finished implementing a couple algorithms for binary De Brujin sequences in haskell and was working on a blog post when I read this. You can check out mine here if you want:
14 comments
[ 5.1 ms ] story [ 43.0 ms ] threadI suppose with 10 transparent markers that are distinguishable under detailed inspection (such as fluorescing to different colors under UV light), you could even work out the right order on the first try: "traces of orange have transferred to 3 other keys, so the orange key was pressed first; traces of green to 2 other... (etc.)"
Neither of them require a special digit after the code, or an enter key, and both of them have entry codes with repeating digits.
How about "use something random, change the keys before they wear down, and wipe them before and after use if you're paranoid."
4 presses out of 10 options, not allowing duplicates, and order is significant: 5,040 options.
It's less certainly, but not dramatically.
4 presses out of 10 options, not allowing duplicates, and order is not significant: 210. That, I would call a dramatic reduction.
In a typical 10 button number lock order is not important, and you can choose from 1 to 10 presses: 1024 options.
Trying to find a real reason to buy an infrared meter..
So why would anyone make keypads without them? Ease of use over security?
http://coder.bsimmons.name/blog/2009/09/cracking-a-lock-in-h...
We must have been reading the same articles on reddit which lead us to the same tengentially-related wikipedia page or something.