onity

The problem is that the incentive here is for Onity to NOT disclose anything and keep on going like nothing happened.

In security research terms, let them keep buying onity locks, because we don't want people to know how to break onity locks and steal/hurt?

He could have disclosed to them anonymously, either technologically or legally, which would have prevented Onity from suing him.

Then there's the matter whether Onity seems like a trustworthy company, that would do the right thing.

This actually helps prevent duplication, although it's only a measure against people without the resources to obtain the Onity equipment.

I just read a bit about the Onity lock vulnerability, and it states that the hack was released to the public before Onity had a chance to fix it.

If Onity didn't fix the lock by then, more time wouldn't have really helped.

You could have informed Onity first and then simply threatened them with full disclosure if they didn't start owning up to the problem themselves.

Career: Discovering and disclosing the Onity hotel lock vulnerability.

Shooting a one-liner email to Onity was a no-brainer.

I fail to see how Onity should be expected to replace circuit boards in 4 million locks that take a deliberate effort to bypass.

Anyone who's dealt with Onity and is familiar with their business practices would immediately confirm that they not only didn't deserve disclosure but they likely would have done nothing with it.

Quote: "The standard 'Responsible Disclosure' approach would be to notify Onity and give them X months to deal with the issue before taking it public."

Think about how that conversation would go: "Dear Onity, I found a security problem in your product that will cost you millions of dollars to fix.

I think you're missing the point - Onity locks don't usually have this "big old manual separate bolt" as they're sold as "deadbolt inclusive".

Long before you disclosed the vulnerability in Onity hotel locks to the public, the startup you had co-founded "licensed" the same flaw to Lockmasters Security Institute, a company that trains law enforcement agencies, special ops, and intelligence agencies in covert entry techniques.

He missed an option: disclose privately to Onity's major customers, and give them some time to assess the situation and deal with Onity.

As for Janet Wolf, an actual victim of the Houston hotel thefts, she blames the Hyatt, not Onity.

However, that (much like Onity's original approach to the problems) leaves the independent hotels in the cold.