The World of Competitive Lockpicking | Hacker News Reader

The World of Competitive Lockpicking

cnet.com

112 pointspseudolus101 comments

My best friend has been a professional locksmith since he was 16. One interesting thing he told me is that he gets worse tips for picking locks too quickly. It creates a perception of lower value if he picks a lock in a few seconds instead of a few minutes.

This makes so much sense and is similar to how software like TurboTax inserts unnecessary progress bars to make you think they're working hard to compute your taxes. Like your example, the user perception was that what it was doing must've been easy if it was able to perform it so quickly.

Reminds me of the classic:

https://thedailywtf.com/articles/It_Must_Be_Broken

They could have just wrote horribly inefficient software like the rest of us.

They do, and their inefficiency is rendering that highly complex progress bar. How about drawing it pixel by pixel in Java without acceleration APIs and then embedding that via JNI. I'd wager you could get 10 seconds of CPU time and 500 MB of RAM use out of every progress bar ...

Sounds like an example of real-world Speed-Up Loops[1]

[1] https://thedailywtf.com/articles/The-Speedup-Loop

And as an exception to that rule: I was forced to hire a locksmith because I couldn't pick the spool pins in my apartment door lock. I asked him if he would be able to do it quickly and he did it in like 30 seconds. I gave him a good tip.

I didn't know tipping was a thing with locksmiths. I hope I haven't been inadvertently rude by only paying what they were asking. Haven't heard of this before.

Some locksmiths really don't like locksport folks. I think there are multiple reasons but the most basic might be that they think it will result in fewer calls.

I have some very basic picking skills and for me, anyway, it's actually given me tremendous respect for the locksmith trade and made me more likely to call them when warranted, because I understand the wider range of things they can do and the skill it takes to do them successfully.

For someone with no clue about that world, may you give some examples?

Like all those old furniture or door locks that I just assumed were lost causes, many locksmiths can actually make keys for them. Not usually a serious need for it but if you were selling an old piece of furniture you might do it. In my case we have a bedroom closet we'd like to lock some stuff away in when we go away and have someone come in to feed the animals.

The ability to make a key for locks which have no key is another, even if those locks don't have removable cores (I'm thinking of mostly padlocks here). That's a really cool thing called impressioning, where the mechanics of the lock (pins pressed down into the keyway by springs) are actually used against it to progressively turn a key blank into a working key.

Master keying is another great example (when multiple, different keys work in a lock and you can have one key that works in multiple locks, such as a small apartment building).

Also a lot of ancillary things around the lock but not the lock itself, for example installing deep screws or replacement anti-kick hinges (door devil or door armor). In theory those are DIY things but in practice you can spend a lot of time trying to get alignment right (especially with a deadbolt going smoothing in/out), but it's something a locksmith does all the time.

Those are great examples, thank you! I had no idea they offered most of those services.

Yup, said friend cut me a key for an old motorcycle over a couple beers one night just from impressioning the fork lock.

Sometimes they can even make a key by sight reading, peering down the keyway; this is especially common (for good locksmiths) with wafer locks (often seen on cabinets, and autos but those are usually too complex to sight read).

I argued with a locksmith recently who said my front door lock was "unpickable" and the only solution would be drilling it and replacing the lock. I told him I'd pay him 70 dollars cash to pick it or he could leave and I'd pay nothing. He picked it in a minute or less and that was that.

I think you handled it well.

Since he acted like a reasonable (rational) person he probably wasn't a scammer, but it's worth mentioning that there are locksmith scammers who take advantage of people in high-need situations to charge them exorbitant amounts for "unpickable" locks that always need to be drilled.

The Reply All podcast covered this a few years ago with "Very Quickly to the Drill" [1]

[1] https://gimletmedia.com/shows/reply-all/o2ho87

What would a scammer do in that situation?

Probably charge a lot more and be belligerent/pushy about it.

I once hired a locksmith to come let me in a front door. To my amazement, he walked up to my locked door, took out a regular credit card, and wedged it between the strike and the frame, immediately opening the door. [1] I wasn’t even mad it cost $150 or so, I learned a cool new trick that day and also learned how insecure my door was. Needless to say I modified the trim and door jamb to make the door much more resistant to that type of attack.

[1]: https://www.art-of-lockpicking.com/how-to-pick-a-lock-with-a...

Even if you make sure that a credit card can't be wedged in, it is usually possible to put something flexible like an X-Ray film between the door and the frame. It takes longer, but the strike can be pushed eventually if you are persistent! The real solution is to not have a latch like that where security matters, like the front door.

You can try as hard as you want, but there's no stopping a prepared burglar. If someone wants to get into your home, they will absolutely be able to find a way in, not matter how good your lock is.

Which is why the trick is to have your house be a bigger hassle to break into than your neighbors house.

Showmanship is underrated.

I can recommend the lock picking lawyer on YouTube.

He has tons of videos where he dissect different locks and pick them normally but also finds novel ways of opening the locks.

Quite possibly the most dispiriting youtube channel I've seen. His chipper and near instantaneous lock picking expertise has basically caused me to fear imminent loss every time I lock my bicycle or a door. I suspect that not at all of his 1.8M subscribers are viewing for their entertainment pleasure. Still, something to behold. [0].

[0] https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

Then I would suggest you're missing a large part of the point. When's the last time you heard about a theft that actually involved a picked lock?

It's super rare in practice, because lockpicking is a high-skill sport, and most criminals are not doing crime for the skill or the sport of it.

Theft almost always relies on doors that weren't locked in the first place, chains that were locked but easily cut, or simply going Kool-Aid-man through a wall or a fence or whatever. The fact that locks CAN be picked for sport has nothing to do with how often they ARE picked in the real world.

Knowing about locks, though, gives you the advantage of a bunch more knowledge. Like how common the CH751 key is, or how stupid the "TSA lock" idea is. Or understanding why you shouldn't post proud photos of the key to your new house on social media. (If I ever do this, I plan to troll the audience by dangling a 1284X in front of the camera.)

It's a good point; once you start thinking about it you realize that the locks are only a (small) part of overall security. For example, can someone break a nearby window pane and unlock the door? Can they bust open the door with a strong kick? Are the windows on the second floor (for a house) always locked? A good book on this topic, about how differently thieves think about space and common security features, is "A Burglar's Guide to the City".

You’re generally trying to make a burglar rob somebody else’s house instead of your own, which is why things like visible cameras, nighttime lighting, and dogs are more important than locks.

You can’t really defend against a determined adversary. I lived down the road from somebody who had a significant collection of rare coins. He had good locks, hardened doors, and a state of the art security system which was bypassed by using a chainsaw to cut a hole in the wall of his house.

Also, some security mechanisms can make your home less safe by making it difficult to escape in the event of a fire. A fireman once told me he’s seen people die in fires because there were security bars over the windows and they couldn’t get out.

I've thought about that a lot recently as I have a double cylinder deadbolt I want to replace our single cylinder one with, since the door has 3 panes of glass that can be easily smashed allowing the single deadbolt to then be easily opened.

Sounds great until you think about a fire situation. I think we're just going to keep an extra key very close by but that solution only works because we don't have kids; I'm not sure I would go with the double cylinder deadbolt if we did.

(And yes I know it's against the building code but I also know people regularly do double cylinders on their own personal homes. You'd never do it in a rental, AirBnB or commercial building of course.)

At least in my region in France they would usually use a small haydraulic the-opposite-of-press to push the door. A few seconds, your lock does not matter, ghe weakest point will give up first.

That's kind of the point of his channel (and Bosnian Bill's too).

You pick a lock based on your risk tolerance and security needs. Not all locks will stop a determined attacker - and not all assets need "nuclear code" type security either.

For the casual passer-by, a locked bicycle is usually enough to deter theft.

> Not all locks will stop a determined attacker

I feel comfortable in saying that no consumer locks can stop a determined attacker.

Right, same as when talking about computer security and threat models.

> Quite possibly the most dispiriting youtube channel I've seen. His chipper and near instantaneous lock picking expertise has basically caused me to fear imminent loss every time I lock my bicycle or a door.

While that's fair, it also means that when he gives a bike lock recommendation[1], it carries a lot of weight.

___

1. https://www.youtube.com/watch?v=2_9x9iiJ_Z0

It's worth remembering that he's probably in the top 0.1 percentile of all lockpickers in the world. And he has a massive pile of tools, some custom-made, and experience with a huge variety of lock types. And usually picks or opens the lock the first time before shooting, so you're only seeing his well-practiced openings. And he doesn't produce video at all of any locks he hasn't been able to pick.

Though he is pretty up-front about which locks take elite skill and tools to pick, and which ones can be opened by a first-timer with a bent-up paperclip.

And yes, he really is up there in lock picking skills He literally won a lock picking competition last year [1] . Not to mention that you're seeing the end result of some amount of effort in each little video, he's talked a bit about it in the past [2], but like all of these sort of videos, you're only seeing the "good bits".

My big take away from his channel is two fold: Avoid locks that are well know to have big security flaws, like the paperclip attacks. Otherwise, the point of entry will probably be a broken window or busted door.

It's really a fun hobby, I've got a few locks I rotate from a larger collection on my desk that I try to pick anytime I'm waiting for a compile to finish.

[1] https://www.youtube.com/watch?v=Avn7ABVHPYk [2] https://www.youtube.com/watch?v=lkfBKQuLkRc

He does have some videos about locks that neither he nor Bosnian Bill have been able to pick. It's usually a combination of circular core plus a very eccentric key that needs to be inserted a cerftain way to be able to access the pins.

>And usually picks or opens the lock the first time before shooting, so you're only seeing his well-practiced openings.

Probably true, but he does have some videos where he picks a fresh new lock sent to him, e.g. this one is uncut and includes the unboxing of the package:

https://youtu.be/UcEnYRa74zM

on the other hand, it's sort of alarming how many gun locks can be defeated with a strong magnet. no skill required.

I don't find it dispiriting so much as eye-opening and a good laugh. I can't help but laugh out loud when I see a pretentious-looking padlock defeated by a sliver of metal from a Red Bull can. Or, even better, a "smart" lock defeated with a magnet. Conversely, it's scary how many products intended to secure guns are really not up to the task - something to think about when you're looking for one.

But, as with all things, use the best tool for the job. In some places, a cheap Master padlock is all the security you need, though it wouldn't hurt to get something a bit better. It's definitely worth checking out his channel if you're thinking about buying a lock.

Don't fret, people who want to steal your bike are just going to use bolt cutters anyway. Most people who are too lazy to get a real job and resort to burglary are also too lazy to learn how to pick locks.

I'm bummed I live in a lame state that makes it illegal to own lockpicks.

I've heard portable/cordless angle grinders are used pretty commonly [1].

I didn't know there was any U.S. state (if that's what you mean by state) that makes it illegal merely to own lockpicks.

You might want to check out the TOOOL state laws page [2], it might be more nuanced than you think. For example you might be OK to own them but not travel with them. Or the burden might be on you to prove lack of intent - but if you only keep them in your own home, that would be easy.

[1] https://www.youtube.com/watch?v=ppZW-PppbtI [2] https://toool.us/laws.html

Virginia makes it a crime to have lockpicks on your person in the process of committing a burglary. The next line states that having lockpicks on your person is considered proof that you are committing burglary.

https://law.lis.virginia.gov/vacode/title18.2/chapter5/secti...

Good point. But a counterpoint is, it's impossible to commit a burglary if you're in your own home or vehicle. You have a legal right to be there (by full ownership or a lease granting possession), so burglary isn't possible there.

He doesn't just pick locks - he also looks at difficulty of using bolt cutters, hydraulic cutters, angle grinders, etc. to break locks where relevant.

With bikes, they just cut the chain. The people who are stealing bikes and such are not exactly sophisticated smart crime masterminds.

If you think about it, the little money you get from stealing bikes are not really worth the risk and effort.

If you are concerned about locks being picked, look at Abloy Protec2 locks. Not cheap (also not the most expensive by far). But they come in whatever shape and size you need and they are more or less considered 'impossible' to pick. The more serious concerns will end up being what type of padlock and chain will you be using.

A little less pricey but still good are Schlage Primus locks. Deviant Ollam mentioned them in a recent video [1]. Like Lock Picking Lawyer ("LPL" in the locksport community), Deviant has a good mix of security talk and entertaining banter.

[1] https://www.youtube.com/watch?v=pwkeSzbsLsU

Not cheap, but probably much cheaper than living someplace where things don't grow legs.

He also makes funny like these:

https://www.youtube.com/watch?v=k9VewWKfH_0

https://www.youtube.com/watch?v=TRozAbaKs9M

https://www.youtube.com/watch?v=Joed0P3hhbc

If you have never heard about Gallium destroying Aluminium, you should watch his video where he breaks a lock by simply applying Gallium to a lock:

https://www.youtube.com/watch?v=jeghGhVdt9s

See: The Open Organisation of Lockpickers (Toool) for gatherings/events.

https://toool.nl/Toool

They also keep a pretty good page with U.S. state laws on lockpicking: https://toool.us/laws.html

Its funny but the article doesn't actually mention that the international competitions for lockpicking that occur every year.

TOOOL.NL run one at LockCon in the Netherlands TOOOL.US runs one at LockFest in the USA OzSecCon.com/TOOOL.COM.AU runs one at OzSecCon in Australia.

In addition to lockpicking competitions, there are actually a wide variety of ways, tools and techniques to open locks such as impressioning which is also a competitive sport in these communities.

I highly encourage people to give it a shot, it's good fun. And once things are back to normal, check out a local meetup or start one yourself, it's a good way to relax and have fun with some new friends!

"The Moderators of /r/lockpicking" would be a more apt title.

Yeah, kinda disappointed to see an article on locksport but no mention of LPL or BosnianBill.

Or Deviant Ollam

I'd love it if someone held a lockpicking competition (once it's safe to do things like this again) and if you book your hotel room through the event when you arrive the front desk tells you the room number but doesn't give you the key.

You might like the "Gringo Warrior" [1] events that have been held at DefCon and (I suspect) other infosec cons as well.

[1] https://deviating.net/lockpicking/gringo/about.html

That would be against the rules of the organization as described in the article.

It wouldn't necessarily have to be arranged that way though.

I could see this being something at DefCon or similar for example.

It could be. But any member of the lockpicking organization would not be allowed by their rules to attend.

Interesting. Seems overly restrictive to me, but I can understand the reasoning behind it.

Out of curiosity, do you happen to know if members of the organization are allowed to do things like participate in pentesting?

From the article, the rule is, Nobody can pick an active lock, or help anyone attempting to. The community is united on that front, with mods receiving reports of any violations almost immediately.

They then clarify, We are extremely strict about not assisting anyone with picking a lock in use, regardless of whether they own the lock, or whether they have permission to do so.

That would rule out pentesting as well.

Indeed, thanks for patching my bad reading comprehension.

The history of lock picking started to get interesting in the industrial revolution. See https://gizmodo.com/in-1851-a-man-picked-two-unpickable-lock...

You might want to check out some of Schyler Towne's talks on the history of locks [1] [2]. His enthusiasm is infectious; he's obviously an expert, and obviously loves what he's talking about.

[1] https://www.youtube.com/watch?v=vGjkQ7qAyY4 [2] https://www.youtube.com/watch?v=C5CrR8-42x4

I always wanted to get a cheap set and practise on some locks - where's the best place to find old locks to practise on? I don't want to destroy my front door!

Go to your local home improvement store and load up on cheap locks.

Masterlock #3 is the defacto starting lock to learn how to pick - it's easy, and only has 3 pins, no security pins, etc. They're also very cheap and everywhere, you might even have one already you forgot about.

It's important to get an easy lock to learn on. It'll allow you to learn the principles without a ton of frustration.

For tools, it's difficult to beat Peterson on quality and price.

Picking locks is honestly a great brain exercise. I have a collection of locks, all locked together in a giant ball of locks, and no keys. They sit on my desk, and I pick them when trying to take a break once in a while. It requires a lot of focus, and a mental map of what is going on inside the lock. Pretty soothing actually.

Ebay is decent. Not as cheap as it used to be, probably due to influx of new locksport folks, but still decent especially if you're looking for basic locks like a Master 3 or Kwikset.

Lots of people swear by Facebook Marketplace but I just hate giving over even more info to FB.

OfferUp can be good, very hit or miss, and Craigslist can be good too - even more hit or miss. I had a CL search running for over 6 months and finally got a worthwhile hit on some local locks yesterday, which was nice.

If you know some property managers, handymen, or property owners, lots of times you can get old locks very cheap or free just by asking.

Getting a cheap bumpkey and learning how to use it on your own door can save you lots of trouble the next time you lock yourself out of your place. I hide one in the bushes.

Using a bumpkey repeatedly will actually result in you permanently locking yourself out of your place. Repeated use wears down the internals to the point where it will eventually no longer work. This depends on the key materials being used etc, but generally speaking, you'd be better off stashing a key in a well hidden place instead.

I have a key behind a combination lock. Not 100% secure, but I live in a safe enough area that I never worry.

I'm more worried about my smart garage door openers getting hacked then someone getting my key.

If it's a combination padlock, many of them are shimmable or easily bypassable [1]. If you care, it's worth searching for your lock brand and model # on YouTube.

[1] https://www.youtube.com/watch?v=hpkf1Zldf0s

You can break into my house by breaking a window near (or on) the door and then unlocking it. It's not even worth trying to hack the keybox.

Even easier than hacking the door opener, just use a coat hanger to pull the emergency release.

In a previous job, we had a server room with double doors protected by a keypad on the outside and a capacitive touch plate to open from the inside. There was at least a good quarter inch gap between the doors. I opened it with a coat hanger just to verify that it would work.

In a previous job, management was very unhappy on Monday morning after discovering I'd gone through the drop ceiling to reset a box in the "secure" server room.

You could also just hide a real key somewhere close to your place but not close enough to make it easy for someone to try it on doors until they find yours.

You could also put it in a lockbox in a somewhat hidden location on the property, such as underneath a deck (on a house). Though a lot of lockboxes aren't that secure; after doing a little research earlier this year, I found that the Kidde wheel ones aren't bad [1].

[1] https://www.youtube.com/watch?v=ZLg86_C7rrs (Deviant Ollam)

Or just give it to your neighbor. This is what we all do here.

The idea being that if a miscreant discovers your bump key they won't have the skill to use it unlike a discovered spare key?

Yes, that's the idea. Maybe it's a bad idea.... but I used to hide a real key but that seemed like an even worse idea.

A better and safer idea is to leave a spare key with a trusted friend or relative.

The idea might be weird to approach at first, but you'd be surprised how many people run out and make a copy of their key for you to hold onto too.

Yeah, this. If you're lucky enough to have family or a good friend nearby (someone who you could call at 11pm to get it, and who would understand). Just give them a copy of your key. Like insurance, you hope you never need it, but if you do, you'll be glad you did.

It can be done reasonably safely. Put it in an envelope, sign across the flap. Now you both know if they use it. You can still call them and ask them to open it, run over and turn off the stove or whatever, and sign another envelope when you get home.

I think this would make a lot of people uncomfortable. I'm relatively pragmatic and untrusting, but I would be offended if someone I knew did this to me. And if it were a neighbour I didn't really know, I would be a bit worried: now I have the responsibility of keeping their key secure, and if I lose it they will suspect me of stealing it, and all for the privilege of being asked to do a favour for a borderline stranger who doesn't even consider me trustworthy.

Its for both your peace of mind. You come home from vacation, something you misplaced makes you concerned its gone, but the key from next door is still in the envelope. So no suspicion there.

Maybe works better for business. I did this with the insurance agent next door when I was running an Engineering office.

I agree with GP (retsibsi). The envelope thing says, "I trust you enough to give you a key... but I don't really trust you, so I'm also giving it to you in this weird signed envelope thing." You either trust them or you don't, and you're asking them to do you a favor.

Plus, if they have a sealed envelope with the key, they can get enough information about the key (the key bitting) to make a copy. They don't need to open the envelope, they just need to press the envelope down enough to see the shape of the key.

Hm. The neighbor was reluctant to take the key, until we came up with a way they would not add risk to themselves. It was a compromise.

I should add to my other replies: I don't mean to criticise you personally, or your actions in your own particular case. In the general case I think the envelope proposal would often cause offence, but as a compromise with someone initially reluctant, it sounds like it was a clever solution.

It does make sense, but I still don't think I could avoid that emotional reaction. It's the combination of asking for a favour while simultaneously signalling that you don't trust me. If we're in zero-trust stranger-to-stranger mode, why should I do this favour at all? It only has downsides for me, including the possibility that something goes wrong (envelope lost or damaged) and I come under suspicion.

That's a good idea.

Although, I'm inclined to say if you're giving your house key to someone you don't completely trust, you should maybe seek an alternate candidate.

Then again, "trust, but verify" is indeed a real thing. Your system provides the verification part.

Anyone thinking of going to this much effort: signatures are easily forged. Use glitter lipstick to seal the envelope and take a photo of the pattern - nobody will ever lay the same glitter pattern again.

This is the normal and traditional way to do it where I live (west of Paris)

Not sure it’s legally advisable but i had a bumpkey on my keychain for 5-6 years and it came in handy every now and then.

Depends where you live and stuff, but in some areas possession of lock picking tools while committing a crime is an extra offense. You might be found to be committing a crime for a number of various reasons (legit or not), and have this charge tacked on for good luck.

A bump key is easily hidden among other keys on a keyring; it's just a key cut to the lowest depths in all positions, otherwise it looks just like any other key. It's a lot less obvious than a set of lock picks.

Bump keys, as others have posted, are very crude and rough on the internals of a lock so I'd say use them sparingly, and never without the lock owner's explicit permission of course. But they do have a place. (And require practice too!)

for which keyway?

Schlage.

> The World of Competitive Lockpicking

I initially read this title as ‘The World of Competitive Bootlicking’

Reply on news.ycombinator.com