The Key Flashing Epidemic

Walk into almost any school, hospital, plant, or office building in Michigan and count the lanyards. Badge on the front, keys clipped to the same ring, hanging at chest height, facing out, under good lighting, for eight hours a day.

I see it all the time, and no one doing it sees it as an issue. The whole problem boils down to one sentence.

A key is a password printed in plain text.

The cuts along your key, the bumps and grooves, aren't just there for looks. They all follow a specific set of rules dictated by the manufacturer, they are not random. Most commonly you'll see 5-6 cuts in any given "pin tumbler" key. Pin tumblers being the most common type of lock you use day to day, think your front door. Each of those spaces are a fixed depth and the sequence of those numbers is the bitting code. In plentty of cases those are stamped into the key bow/head itself. That code SHOULD be secret. Anyone with a the right blank, something to measure, and a file can fabricate YOUR key.

Your own key doesn't leave evidence. A pick leaves something. A pry bar leaves a lot. A key leaves nothing at all. No failed login, no alert, no log entry, no scratched plug, no splintered jamb. Somebody walks in with a legitimate-feeling key and the only sign anything happened is that they're standing somewhere they shouldn't be.

The Locks didn't get weaker, the room got more lenses.

Locks have gotten better. Tolerances are tighter than they were forty years ago, the machining is cleaner, and security pins are standard on hardware that used to ship with plain solid pins. That's progress, and it's all aimed at one thing: making the lock harder to pick. Criminals already don't generally pick, but give them a key? That's a golden oportunity, practically handed to them by the very people whose goal it is to protect the property.

Good locksmiths have been able to sight-read a key's cuts for as long as there have been keys. That part isn't new. What's new is that it stopped taking a locksmith.

This Has been tested and proven

In 2008, researchers at UC San Diego published a project called Sneakey that pulled a key's full bitting code out of ordinary photographs. They decoded a key photographed from a rooftop 195 feet away, sitting on a café table, and they also did it with a plain cell phone camera. Their point wasn't that this was some exotic new attack — it was that cheap image sensors and standard computer vision had turned a specialist skill into something anyone could automate. That was almost twenty years ago, on 2008 hardware. Phone cameras have gotten considerably better since.

If you want a real-world version instead of an academic one: in 2014 the Washington Post ran a story about airport baggage handling and included a photo of the TSA's set of master luggage keys. The photo came down, but not before it spread. Someone worked the exact cuts back out of the image, published printable files, and another person printed a working key on a hobby 3D printer in about five minutes. A photograph of a master key set turned into functioning master keys — for a system covering hundreds of millions of locks.

Now stack 2026 on top. Meta put a camera on people's faces and made it ordinary. There's an indicator light on them, and Meta keeps patching around the ways people beat it, but there is a whole cottage industry of modders killing that LED for anyone who wants to record quietly. One reporter found ads for the service running in around thirty states and a modder fielding eight or nine requests in a single day. Meta continues to fight against this but they arent exactly winning. And that's just the wearable everybody argues about. Doorbell cameras on every porch. Dash cams. Body cams. Twenty-five dollars gets you a pen camera, on your doorstep in two days. The point is that "is anything recording right now" stopped being a question you can answer by looking around the room.

The fix can be as easy as free

A key in your pocket is a hard target. It's covered in there, and nobody's photographing it.

What if you "don't want to fish for them" every time you need them, it is the complaint I hear the most when bringing this issue up. Sometimes the answer to a complaint like that is "too bad". Not in this case, in this case we can accommodate the folks who want to hang their keys off their lanyard or belt loop.

My number one recommendation and the solution I use everyday (not sponsored) is "KeySmart", in the simplest form it is a key cover. Your keys fold under the cover when not in use similar to a jackknife. There are also individual covers made of leather or rubber. Both ways of keeping you bitting hidden while still using your lanyard or retractable keychain.

Second, is to always know where your key is. Keep them on you as much as possible. There is no need to leave your keys on your desk while you leave for the bathroom or go to chat with the boss. They shouldn't be left in the door or under the alarm panel they deactivate. If you don't need to carry them then lock them up in your companies key cabinet. Simple as.

Thirdly, Check your photos before they go out. Team pictures, ribbon cuttings, facility tours, news coverage, the new hire smiling at their desk on day one. People blur license plates and credit cards without being told to. Nobody thinks about keys. Whoever approves your images should be looking for them, whether that is you or another person at the company.

The part that's on management

Know who's holding what. A change key is a manageable exposure. Still an issue, just less of a problem than a master or a grand master, Those could be the whole building. And the people most likely to wear their keys out in the open are custodians, maintenance, facilities, office staff and volunteers, which is to say exactly the people carrying the deepest keys in the system. If you can't tell me today who holds a key and what level level it is, that's the real problem.

Stop counting on "DO NOT DUPLICATE." I'll be blunt about this one. That stamp is decoration. There's no law behind it, plenty of shops and self-serve kiosks will cut it anyway, and it does nothing whatsoever against somebody working off a photograph. If your key control program is a stamp, you don't have a key control program.

Put them away

None of the free stuff needs a budget line. It's one conversation with your people and a handful of key covers. And the folks who need to hear it usually aren't in the security department. They're the ones with the biggest ring on their belt and the least reason to think anybody's watching them.

Your keys aren't jewelry. Put them away.