Dan Griffin's Blog
Comments on security, PKI, smart cards, cryptography, and entrepreneurship.
Hotel door lock override
September 21, 2007
Now, in addition to a mag stripe reader for the room key, virtually every hotel door I’ve stayed behind during business trips in the past 10 years has offered both a deadbolt and a chain (or similar manual catch attached to the jamb). And I’ll immediately stipulate that a dedicated/determined attempt to compromise any such door, including by physical force, is bound to succeed.
However, what first caught my attention about the exterior doors at the resort this past weekend was that they didn’t have one of those little security chains. But then I thought, “that’s okay, it’s got a deadbolt.” With that set, I’m at least guaranteed privacy while in the room, right?
No – silly me. My first clue was when I tried to open the door (from the outside) with my mag stripe key after the deadbolt had been set (from the inside). I noticed that the click made by the lock is different in that situation, and thus realized that the key reader and deadbolt are electronically connected. And then the inevitable conclusion that there’s only one good reason for them to be connected – the deadbolt can be electronically overridden from the outside!
I don’t know why that never occurred to me before, and in retrospect I shouldn’t be surprised. And yet – having an exterior facing hotel door on unsecured grounds that is impossible to truly lock from the inside is kind of creepy. I mean, the override card is probably just sitting in the manager’s desk drawer, right?
Anyway, based on some very brief internet research, this feature is called “Emergency Card” support in the industry. Here’s an example of a commercial lock product spec that references this - http://www.tycosafetyproducts-europe.com/English/Products/Access/hotellocking.asp. And here’s another one that mentions it slightly more obliquely - http://www.kaba.co.uk/products/e760-hotel-lock.asp.
No Comments »
No comments yet.
RSS feed for comments on this post. TrackBack URL