Matt Blaze, a computer science professor, writes about security and cryptography, including lock vulnerabilities, radio systems, Faraday bags and random number generators.
HN commenters cite his master-key lock paper as a classic, and link his Faraday bag tests and his Cuban numbers station recording.
While definitely better than the non-encryption of CTCSS etc, P25 encryption has some relatively concerning implementation problems. It's possible none of these actually matter for your usecase as many are related to UX around configuring and using encryption in an institutional setting, but the unauthenticated traffic injection, induced transmission and jamming issues are, well, not great no matter how you look at it.
https://www.mattblaze.org/blog/p25
https://www.mattblaze.org/papers/p25sec.pdf
I will grant that the open-source kfdtool keyloader boxes are neat.
I have been meaning to see if I can repro the induced transmission via retransmission requests thing when the data packet stuff is fully disabled via CPS, but a friend permanently borrowed my hackrf so that project is on hold for now. I'm not optimistic, though, due to the comments in the paper about where in the stack the retransmission request is processed.
The pre-print loophole is exploited by people who publish in IEEE (electrical engineering) and ACM (computer science) which require assigining exclusive rights to the final article but not the final pre-print. After the final article is accepted but before publication a new clone is put up on their personal website with the name “final pre-print”.
It’s understood in these two fields in these two journals that IF the article was published, the “final pre-print” is identicle and is a “pre-print” in name only for licensing circumvention reasons.
Don’t know about other fields. But CS and EE are particularly prickly about this issue. See for instance Matt Blaze’s discussion: http://www.mattblaze.org/blog/copywrongs
Correction: that's the lock on the GTE clone of the Western Electric payphone. The actual Western Electric version used an unusual lever lock. The later variant, the 30C, is claimed to have never been picked.
That's a really good lock design. It's simple, robust, and immune to standard picking techniques.
But there is a vulnerability. The blocking wedge, which is only supposed to move along one axis, has some mechanical slop. See [2]. So it's possible to get some feedback on which levers are blocking bolt movement. It's still a huge pain to pick.
[1] https://www.mattblaze.org/photos/misc/wecolock/
[2] https://www.youtube.com/watch?v=hXLhCvUgDYQ
This reminded me of Matt Blaze's work on physical lock security back in 2003. He found a method of deriving the "master key" for a building (one key that opens all locks) from a single example: https://www.mattblaze.org/masterkey.html
When he published about this he was bombarded with messages from locksmiths complaining that they all knew about this and kept it secret for a reason! https://www.mattblaze.org/papers/kiss.html
It was a fascinating clash between computer security principles - disclose vulnerabilities - and physical locksmith culture, which was all about trade secrets.
Police dispatch might be encrypted but not very well.
https://www.mattblaze.org/blog/p25
It's actually worse than clear text radio in many ways.
All cellphone call meta data and all SMSes are recorded, so while it avoids people listening in scanners and the public record it isn't very confidential. It's police using WhatsApp and Signal that will cause big problems.
I stumbled on this page after reading Matt Blaze's legendary paper about deducing master keys from physically strong, but cryptographically weak, physical systems.
The paper is really good, and worth a read, even though it is from 2003:
https://www.mattblaze.org/papers/mk.pdf
https://news.ycombinator.com/item?id=32306328