Things that happen at a lock-picking convention (2013)
slate.com
slate.com
Demo animation: https://m.youtube.com/watch?v=jgekjfwphGc
Here's great analysis of the lock with an attempt to pick it and an breakdown of the design after taking it apart: https://m.youtube.com/watch?v=b96pmWSArr4
----
EDIT: In case you want buy a Bowley Lock, they're now available for sale to the public here:
http://www.bowleylockcompany.com/store/c1/Featured_Products....
IIRC, also wondered how this particular design prevents against bumping; none of its protections really seem aimed at that usecase. Not to mention the relative frailty of the key, and the general problem of an easily visible (and thus reproducible) secret.
As for bumping and the key strength, given those topics are covered in the second video, you're comment to me at best feels naive.
Lastly, no system is prefect. Even if the metal the lock is made of was unbreakable and as a result you could 't destroy the lock to bypass it, you could still build a robot that inserts a metal key to turn the lock and dynamically assembles and inserts every possible bidding for each pin.
Feel free to post a lock you like, locks to me are more about simplicity vs security - not some overly complex system will never be used in mass production.
It's also not astroturfing if the company itself is advertising the product. The video's linked from Bowley's youtube channel.
I submit that your statement relies on an unfounded premise (at least from my scan of this thread) that wonderous works for the company.
Also, by your standard, if wonderous doesn't work for said company, he's still complying with your "standard." Yet, you're still making an implicit accusation.
The purpose of my initial comment was to address the potshot accusation of astroturfing after, IMHO, wonderous had responded in good faith.
What if he thinks that someone will be able to pick it? Someone who picks locks for a living, perhaps?
The main issue with this system is the stainless steel keys I think (required to have enough strength so they don't bend up). High security keys always cost more, but cutting SS keys has to be murder on the key duplicator (and $20 per key is quite a price and reflects the challenge of working with SS). And it's more expensive for Bowley, so lower profit margin compared to their competitors even at scale.
However I'm sure the quality is good for that price. I am curious though, are their any anti-drill pins in the cylinder? Or, if the entire cylinder is Stainless then that is practically the same thing.
>> "The entire lock is made out of hardened stainless steel the same as the key. Unlike most locks which have a single hardened anti drill pin in a brass plug. That being said its not made of diamond and can be drilled like any other lock with the right bit and enough time. The purpose of a high security lock is to block manipulation attacks forcing a destructive attack. Its very hard to stop a destructive attack because then your whole house becomes the weak point. The door, the windows, etc."
SOURCE: https://www.kickstarter.com/projects/2136537678/bowley-lock-...
http://www.evva.co.uk/products/mechanical-locking-systems/mc...
Here's a video showing how to pick it: https://m.youtube.com/watch?v=0aNvEL5p1fw
Their main security feature is that keys were "impossible" to duplicate. However the SSDev'ers were able to decode and build make-up keys on-the-fly several years ago now. But that still leaves picking the lock a challenge which has not yet been a public development.
Yep, I remember in high school, in fact it was in Pasadena not far from Cal Tech, I don't remember who, but somehow I learned from somebody how to open the high-school lockers by 'feel', in a fairly short-time I could open any locker quicker than my own knowing the combo.
Locks are fairly amazing when you think about it the locksmiths and the criminals all know how to crack any lock, yet the people in the middle think they're secure.
Years later as a landlord I got to know my locksmith fairly well, one day by offhand he told me that the master-key ( So I could have one key to rule them all ) I was using could open 1/2 the units in the city.
I think it's a testament to human progress. We've never been as safe as we are today.
Maybe time to just leave the lock away then. It's pretty common in Scandinavia, and, at least for me as a tourist, had quite an impact on the societies' mood.
(I know lots of people in Germany who don't bother to lock their doors.)
Instead, I would read the material that Deviant Ollam has published (http://deviating.net/lockpicking/resources.html) or look for an upcoming TOOOL meetup (http://toool.us/).
(2) I don't intend to be pedantic – and perhaps I'm mistaking hyperbole for fact – but how could you are opening a combination lock with an secret unbeknownst to you more quickly than your a combination lock with a secret known to you? Unless, you're shimming the new lock and avoiding dialing the correct combination altogether, in which case you would solve them all locks in the same span of time, this is unlikely. However, you said you're opening the lock by 'feel,' so I assume that's not the case.
Given that, I could easily see how "feeling" that you'd hit the right digit (give or take) might be faster than focussing on visually actually hitting the right digits.
and yes, it actually was quicker to open them by feel than by looking at the numbers on the dial.
This was handy for getting around the Institute after hours (steam tunnels).
Any knife? You can't carry a pocket knife in the UK? That's ridiculous. Knives were nearly the first tool proto-man ever made, and they're still the most useful general purpose tool you can have.
> Section 139 of the Criminal Justice Act 1988 prohibits having with you, in a public place of any article which has a blade or is sharply pointed, (including a folding pocket knife if the cutting edge of its blade exceeds 7.62cm/3 inches) (Archbold 24-125).
http://www.cps.gov.uk/legal/l_to_o/offensive_weapons_knives_...
Does that still mean you can carry a short pocket knife (one that fits in your pocket is unlikely to be long, in any case)?
The guidelines go on to say that butter knives with no cutting edge and no points are considered prohibited blades under the law, which is ridiculous, and that folding pocket knives with blades less than 3" are not considered folding if they lock open (because they are not "immediately foldable"), and are therefore prohibited. Which is, again, ridiculous, and also undoubtedly leads to many unnecessary injuries as unlocking blades close on the fingers of their users.
Not impressed with this policy's risk assessment.
Some limits are more reasonable than others. Saying "you can have knives but the blade must be no more than 5mm long" would be stupid; so would saying "you can drive a car but no faster than 1mph". (Because in either case you might as well, and should in preference, just say "you may not"). Likewise for a limit of 10m or 500mph (because then you might as well, and should in preference, just not bother with the limits).
If you're going to have a limit on the length of a knife blade, presumably for the sake of a small reduction in knife crime, you want a limit long enough that some (non-criminally) useful knives are shorter and short enough that the restriction, if it reduces the number of long knives in circulation, would actually do something to impede crime.
It seems plausible that a 3-inch limit would do that. Maybe a 4-inch limit too. The exact choice of limit isn't completely arbitrary: some choices are better than others. But really, the only answer to "why 3 inches rather than 4?" is "that's where we happened to make the tradeoff".
I'm guessing (not least because the above all seems kinda obvious) that your actual objection is to having any limit at all. (Perhaps on the grounds of some more general libertarian principle?) That's a reasonable objection, but I don't think "why 3 inches rather than 4?" is a good way to make it.
As for the "criminally useful" argument, I struggle to imagine what crimes could be committed with a 4" knife that couldn't be committed with a 3" knife.
You say it's plausible to you that a 3" or 4" limit would reduce knife crime. What makes you think that?
1. If possession (in public places) of knives above (say) 3" is illegal, fewer people will go about carrying knives above (say) 3". It probably won't make any difference to someone planning to get into a knife fight, of course.
2. If fewer people are casually carrying big knives, then there will be fewer opportunities for conflicts to escalate to fights involving big knives. For instance, a bar fight is less likely to end up fatal if fewer people in it are carrying serious knives. A burglary is less likely to end up fatal if the burglar isn't. Some muggers may choose to make do with musclepower rather than knives (so they're less likely to get into serious trouble if a policeman thinks they look suspicious). Etc.
3. Fights involving big knives are less dangerous than fights involving smaller knives, e.g. because a bigger knife is more likely to end up doing serious damage to internal organs. (If an expert fighter is specifically trying to do you serious harm, I'm sure they can do it with a small knife. Or a toothpick. But in cases where the goal is "establish dominance" or "get away safely from the house I just burgled" or "make my victim sorry he didn't just hand over his wallet" and there isn't serious intent to kill, I expect smaller knives to do less harm on average.)
Astute readers will notice that I'm now talking about knife fights rather than knife crime. My guess is that premeditated crime-with-knives probably wouldn't be much affected by this sort of ban. So, though I'm sure all the things I'm hoping would be reduced would technically be knife crimes (i.e., crimes committed using a knife), I think my use of that term was unhelpful. Sorry about that.
I suspect someone measured their boyhood swiss army knife blade, determined that it was about 2.5 inches, and rounded up to the next whole number.
For instance, Spyderco makes the popular UK Penknife (2.93' blade and no lock) and the Spy-DK that's designed around the Danish knife laws.
https://www.withoutakey.co.uk/blog/is-it-legal-to-use-lock-p...
It concludes with:
> if you're out and about with your trusty lock picks you're being a little risky, so best to keep them at home!
which seems to imply to me that it's probably illegal to carry them in public?
Nevermind the nanny state about porn, both viewing and creation, or drugs. Makes Washington State or Colorado look like lawless states in comparison, and yet they still have a ton of nanny state rules that help no one.
However, no police officer would ever identify a few bump keys on your keychain....
Depending on how saavy the local police are, you may get more attention then yoi want if the cops look close enough at your keys.
Also... cars don't use pins, so they wouldn't have been using a bump key for a car, but possibly a jiggler or a blank for impressioning.
Please see:
"Illinois infers from the possession of a key designed for lock bumping an intent to commit a felony." Mississippi says a concealed pick set is prima facie evidence of intent. Similar for Ohio, Nevada, and Virginia. Tennessee code might actually make them illegal outright.
They gave it back to me and told me it's best if I keep it inside my pocket instead of clipped to it.
Even though that ended OK for me, there are a bunch of ways it could have gone worse. If either cop was an asshole, or having a bad day, or if I had darker skin, or was wearing a hoodie, etc. I once read about someone getting locked up overnight despite his knife being legal because he had it clipped to his pocket - the visible clip was deemed by the police in that instance to constitute "brandishing a weapon". Not sure if that's true, but probably best not to take chances.
The word "gravity knife" has slowly become any knife you are carrying seen by the NYPD. I am being slightly flippant but not really.
The law is completely ridiculous, there are tons of cases of brown people receiving prison terms because they were carrying a knife for work.
There are actually a lot of stabbings in NYC daily, so politicians are not motivated to repeal or clean up the language in the gravity knife law.
In 2016 the ny state assembly and the ny state senate passed a bill to repeal the NYC gravity knife law, but Governor Cuomo vetoed it.
http://www.villagevoice.com/news/how-a-50s-era-new-york-knif...
https://www.nytimes.com/2016/05/31/opinion/new-yorks-outdate...
It is highly amusing how many keycard readers amount to "close this circuit between two wires hidden behind drywall". Or when they expose USB ports, or screw heads, or are protecting a glass door.
One of my favorites in a NY office design was the keycard passes through a door in a wall that was only a foot higher than the door, with plenty of open space above that (about 5-6'). Security theater isn't just the provenance of the TSA.
From what I've read, possession of lockpicking tools are legal virtually everywhere in the USA, as long as one is not intending to commit a crime with them.
If I am mistaken on this point, I would love to be corrected. IANAL.
Also, it's very possible that he didn't if he was training. I had two colleagues who once decided not to use keys for a month to enhance their picking skills.
Similar to the white/grey/blackhat hackers I suppose. You can use the skill to educate, reduce harm, and do good. Or you can use it solely for profit or ruining lives.
[0] https://www.youtube.com/watch?v=oFdzijpUdNM
I once misplaced my key, and managed to pick the lock with a small strip of plastic used to bind boxes of printer paper. The longest part of the endeavor was finding a pair of scissors to cut the plastic to the right size.
The lock/cable in question retails for about $40. Assuming we paid half that, we still dumped thousands of dollars on presenting only an image of security.
That was the state for 2015, things might have changed.
However, a good lock that's difficult to pick for anyone, with or without bump keys or comprehensive experience, is pretty easy to come by. That said, the hard thing is often knowing the difference: expensive and heavy are not necessarily good hints.
From around the 35 minute mark in the "What The Bump" talk, security researcher, TOOOL founder and President Barry Wels said:
"It [bumping] also works on these high security locks: multiple rows with dimples, keys that look really dangerous thinking if I have these on my door I'm really safe. The thing is, they open just as easy as the other locks, as far as we've seen. The only problem is getting bump keys. We really had some help from some of the state of the art Dutch locksmiths, with very advanced tools to make these keys. But once you have these keys, they're just as easy to open as the other locks. One of the statements which is my favorite is: I think you can teach this to a monkey to open locks like this. I'm still looking for somebody with a monkey to actually shoot some video. If you know somebody with a monkey that we could train to do this, that would be fun.
"It also works with locks with moving parts in it. The ball offers no protection because you take the original key, it has all the information already in it. The ball is always in the same position or there are two different spacings of the ball. It all works the same, because there are a lot of locks with protective measurements that are standard for all the locks. So once you have a key that is cut to the deepest, these mechanisms are still in place. The ball is still there, for instance, and it will still open.
"We opened some some pin-in-pin locks. The brand name is Mul-T-Lock. They were not happy that we opened them, and they were not happy that they were being mentioned in a white paper, and they more or less demanded a public test to show that it wouldn't work. So when the guy was at our place I explained to him how the technique actually worked, because he had no clue. So then he demanded a closed test where the results were kept secret. I said I'm willing to do that. He also put a time limit of four days or something ridiculous like that. So I said I'm willing to do that but it will be on a commercial basis because I can not use the information for my website, you want to keep it private. When I told him my price just to keep it friendly -- I wasn't asking a lot of money -- he ran away and never seen again. I do hear he's still very angry. But if Mul-T-Lock wants a serious test, they can always contact me directly, but not through this Dutch sub-dealer of them.
"We opened some impossible locks. By impossible, I mean I opened some locks, and you can see it on the other video, it's available online if you go to the toool.nl website. I opened some locks that I would never open without damaging it ever, because the mechanism is so well designed. There's only one flaw, which is that the part that makes it secure stays the same in all the keys, and only the variation pins change. I'm talking now about the Assa Twin lock. It's a lock with two rows of pins, and the secure row of pins is always the same in a certain region, which makes it very vulnerable for this attack. Talking about the Assa Twin, another reason that I thought I would never be able to open a lock like that is that it was so well engineered, the tolerances are so small, if the pin is half of a millimeter or a tenth of a millimeter too high or two low, the whole lock does not work any more.
"This is also something that we found, that the tighter the lock is made, the more engineering is put in to the lock, the better this technique works. If the key that slides in to the lock wiggles too much because the key has got a lot of space in between, the energy transferred is a little bit lost. If the pins in the chamber have a lot of tolerance and are not straight in the house, but a little angled or a little bit left-right, the energy is not transferred ideally. So the more expensive and the more engineering is put in to a lock, we found most of our favorite locks opened within a few blows because they are so well designed that they are perfect impact energy transmitters that allow smooth transmission of this energy."[1]
That said, since the technique of bumping made a big splash in the mainstream media, lock manufacturers have experimented with and released locks with "anti-bump" features. Those locks might not be as susceptible as the locks that were the subject of Wels' talk. On the other hand, there are and will continue to be plenty of locks in use that don't have any anti-bump features at all.
He does then go on to describe bumping more challenging locks, but I'm not convinced these would be as easy. Especially for a monkey...
If you are skeptical of their results, I urge you to try the technique yourself on some locks you consider to be worthy of the challenge and publish your results.
> that look really dangerous thinking if I have these on my door I'm really safe. The thing is, they open just as easy as the other locks
which makes it sound like he's describing locks that seem secure, rather than locks that are secure (e.g. because of their look, advertising, weight, size, colour, whatever).
I could be misreading him. I'm not contradicting the text, just interpreting it. If he genuinely means that very secure locks can be opened by a monkey/beginner with a bump key then I'd take his word for it. I'm just not sure that that is what he's saying.
So to claim that locks that are difficult to pick are necessarily difficult to bump runs counter to the findings expressed in this talk. In fact, the findings are quite the opposite, as many locks that are difficult to pick because of the tight tolerances and high quality engineering are actually easier to bump than locks which are easy to pick.
I think if it's the amount of metal that is inaccessible to the outside. Something like the Haven lock that is bolted to the floor, makes a lot of sense.
That of course requires a way of opening that is digital.
I'll think of the pros of digital locks:
+ The proliferation of protocols makes master keys almost impossible.
+ Faster update cycles when encryption gets cracked.
+ Keys that are handed out to household members or visitors with potential losses can be easily retracted.
+ The above separation of concerns. The way to keep someone out should be separate from the way to ask for permission to enter.
+ The easier integration with other security layers such as face recognition, voice recognition, etc.
Sorry, if the above was off-topic. Downvotes humbly accepted.
Against forced entry, standard cylinder locks are inherently weak, because they're just not big enough. It's often possible to force the cylinder to turn, shearing off the pins. Especially if the pins are brass. Locks need to be much larger than usual to resist forced entry. Here's a classic mechanical prison door lock.[1] It's a straightforward lever lock, but it's far larger.
There used to be a thing for "detector" lever locks; if you push a lever too far, it trips the detector, and you have to put in a key and turn it the wrong way to reset before you can try again. Those were once claimed to be unpickable. They're not, but it slows things down a lot.
Then again, windows are also ridiculously weak when you think of it like this.
Not claiming any responsibility for it, naturally, simply observing that it had happened.
Maybe randomizing the contents of a selection of not so random lockers... (purely for educational purposes, of course)
Looked like a perfectly normal lock-picking convention to me.
He picks a ton of locks and has a few recommendation videos if you're looking to buy.
If you're that concerned though, likely best not even to attend conferences that would be selling picks, since it's easy to track where people go and use network analysis to ID the likely intent of that cluster of people, use public info, info leaked by someone else there, etc.
Bump keys are a simple "automated" way to pick a lock: https://en.m.wikipedia.org/wiki/Lock_bumping
If you feel like tapping a bump key with a hammer is to much effort, you could attach the bump key to a vibrating toothbrush; aka a "SonicBump": https://m.youtube.com/watch?v=rDlZbQ20aLI
;)