Hacker News Reader

Comment by cortesoft | Hacker News Reader

No lock keeps out a determined attacker. I bet fewer people could carry out this attack than people who can pick a normal lock.

View on HN

There is a big difference between attacks usually that leave signs of tampering and attacks that leave no evidence.

Picking normal locks leave easily discovered evidence. I once even detected a lock at my office had been picked when I put my key in the next morning and noticed it felt different!

(I learned it had, in fact, been picked-- because after that happened I asked on the company chat and one of our security people responded that he'd picked it the night before for reasons)

I'm curious about the specifics. From my experience, picking a normal lock works very much the same as using a key; you're just relying on the fact that the inside of the lock is the same "shape" as the key to put the tumblers in the correct location.

Normal lockpicking technique has you put tension on the lock so that (ideally) one pin is under sheer and the rest are free. You use your tool to push the binding one to the position allows the cylinder to turn slightly then move to the next. So this usually leaves marks on the pins than you can see if you take the lock apart.

Usually while picking you'll also scratch up the pins and keyway in a way that a key won't. You can also end up with the pins a bit cockeyed.

You can also turn it in directions that it can't turn with the key in it, and on some cylinders you can turn it the wrong way and have all the pins fall out!

You in many locks you can also end up with it 'locked open' where you have to pick it again to be able to get a key into it.

I think in the incident I mentioned the cylinder was left in slightly askew which made it feel odd to insert the key. I'm not sure if someone who hadn't picked a lock before would have recognized something was unusual just from the feel.

If you know what you're doing when picking you shouldn't be leaving externally visible marks for most locks (though heavy tension with a loose bottom-of-the-keyway or improperly-sized top-of-the-keyway tension tool will mark the lock). And it's pretty easy to re-lock the lock afterwards to be identical to a lock that's never been picked.

Of course you can take a lock apart and examine the pins & chambers for signs of picking, but that is a bit extreme if you don't suspect it.

So while it is possible to leave external signs of picking, it's not necessary, and often indicates something went wrong with picking.

Right. But when stuff goes missing there is a big and insurance relevant question if the stuff was taken by someone with authorized access or someone who broke in... having a locksmith disassemble and inspect the lock is useful.

Maybe extremely careful picking would pass, but at least my efforts always mark up the pins. :)

Compromises in electronic locks tend to be a lot cleaner.

That may be true today while the vast majority of locks are normal locks. But it seems reasonable that would change if the vast majority of locks were IOT locks.

What's difficult to know, is if there were large market of IOT locks, and much more scrutiny on the companies manufacturing IOT security products, whether that would lead to a reduction in unsophisticated attacks against the products.

As of today, it seems many digital locks are just as bad or worse at physical security than traditional locks, and the IOT connectivity opens up new avenues of attack.

Finding IoT vulnerabilities generally requires some degree of skill. Turning that into a pre-packaged tool that anyone with a computer can use is not much harder.

And once packaged, those vulnerabilities are going to be faster to exploit than a physical lock could be picked by anyone not an expert.

Or, heck, just unlock all the doors and see what chaos happens. Try that with physical locks.

Locks are really only there to ward off honest people.

This sentiment is expressed in the second sentence of the linked article.

They’re also used as evidence of wrongdoing; if a lock is defeated without a sign of tampering, sometimes police and insurance companies are not inclined to think there was a crime.

The article then goes on to completely miss the point of that statement.

Be that as it may, I interpreted the plain statement as an attempted refutation of the contents of the article. The author of the article directly mentions the sentiment, which I take as an indicator that they believe it will be adequately addressed. So I believe that a claim to the contrary must include an explaination of why they believe the author did not address this point, rather than just reiterating it as though it were a new or novel idea in the discussion. As it stands, without acknowledging that the author already expressed this same sentiment, I have to conclude that GP did not read it.

Reply on news.ycombinator.com