Security Issues: Hotel Room Keys

I have been reading The Art of Deception: Controlling the Human Element of Security - it is an excellent book which focuses on the weakest link in electronic security - the humans who run the machines. As a result, it has made me see routine interactions in a different light.

As such, I was quite shocked when I checked into a downtown San Diego hotel (from a pretty major chain) and my keycard did not work the next morning when I returned to the room after breakfast.

I went down to the front desk, to an employee who I had not seen before I presented my (generic hotel brand) key and said my door didn’t work. They asked for my room number and proceeded to re-program the key to the room number I had just told them and hand it back to me. I was not asked for identification or any sort of proof that the room was mine or that I had given the correct room number.

Just how hard would it be to present a room key and gain access to any room in the hotel by going to the front desk and saying the key didn’t work. Hotel keycards are pretty common - with the major chains there are literally thousands of identical looking cards sitting around.

3 easy steps to correct the problem:

1. Ask for identification (you need it to check in anyways)
2. Verify the room number is the one you had registered
3. Re-program the key and re-issue

Actual time involved to verify someone’s identity - 3 minutes at most. Knowing that your room is secure from a basic social hack, priceless.