3D Printing – High Security Key | Hacker News Reader

3D Printing – High Security Key

github.com

132 pointsfeels0ng63 comments

LPL needs to get a 3d printer. Then again, by the time you've printed a single key he'd have picked dozens of locks, lol.

Thanks for this link! Having a parametric reference could be useful, I have family that collects and resells stuff that needs to be opened or picked (estate and bankruptcy and business closeout, all legal. )

I was going to say, he has proven time and time again that anything with a keyway can be picked quickly and discretely by anyone with a little knowledge (and the sometimes the right tools). Really amazing watching him work but it freaks out my wife when she watches his videos.

I have one of the crap locks from Amazon he featured on my storage locker. One night someone tried to break in but spent so much time trying to take the door off the hinges that they had to run away empty handed. Bet they would be kicking themselves if they knew the lock could be jiggled open in under two seconds!

You should see his unpickable lock video [1] where he goes over all the approaches he tried to pick said unpickable lock. Super interesting stuff.

[1]: https://www.youtube.com/watch?v=qV8QKZNFxLw

https://www.youtube.com/watch?v=Ecy1FBdCRbQ This too.

he has proven time and time again that anything with a keyway can be picked quickly and discretely by anyone with a little knowledge (and the sometimes the right tools)

While it is fascinating to watch LPL make short work of almost every lock, I think it is safe to say that his lock picking ability is on a whole other level compared to even a competent burglar. If LPL spends more than 30 seconds with a lock, it's probably going to be fine.

If you only watch these videos you might walk away with the impression that it is that simple for him - just walk up to the lock, pick it in 30 seconds and bingo - but in one of his earlier videos he pointed out that before recording a video he practices opening that particular lock until he can do it reliably.

Depends on the lock. He has several videos that go from unboxing to picked in a few minutes without break.

True, but only for lock designs he's already familiar with.

Sure, but 90% of the locks people use are the same few locks. Any padlock or door lock you can get at a hardware store is one that a good lock picker has experience with.

Your point is valid for certain high-security situations, though.

I’d say even beyond that. Bosnianbill, another incredibly talented lock pick said that LPL is by far the most talented lock pick he has ever met. Given that less than 2% of all burglaries utilize lock picking or shimming a door or window, it is a virtually nonexistent risk as soon as you step up your lock above the basics. Unless you are directly targeted, no one is going to pick their way in to your things.

Everybody who has watched one of the many interesting Bosnianbill videos (with the cool intros ;)) might be surprised to learn that Bosnianbills video channel retires.

If you have watched one of his videos and learned something give him a nice comment and a thumb up on a video you liked, as LPL suggests [1]

[1] https://www.youtube.com/watch?v=7ASQQboFg98

> Unless you are directly targeted, no one is going to pick their way in to your things.

Beyond that, unless the adversary has something significant to gain by picking (e.g. no visible evidence entry was made, stealth, etc.). Otherwise it's time to pull out the FDNY forcible entry guide and go to work.

http://www.vententersearch.com/supplemental/fdny_fe.pdf

I’m far from being a skilled locksmith, but every friend that’s offered to have me try their lock so far, I’ve had opened in under 60 seconds with nothing more than a tension bar and a rake.

It's worth pointing out that this is specifically the Medeco "M3". The newer generation, "M4", advertises itself as resistant to 3D printing, which it accomplishes by adding a tiny moving shuttle pin inside the key itself.

Thre's no reason a 3D printed key can't have a hole for adding a little spring and a pin, but it does mean that a 3D-printed key probably won't work right off the printer, which helps defend Medeco's main selling point: making it hard for the average person to easily acquire a copy of a key.

Is that really the extent of their claim? "Hard for the average person to obtain a copy"?

Seems like a regular key stamped with "do not copy" could meet that threshold.

Walk into any store with a key-copying vending machine and, hey, new key. But none of those machines are equipped to cut Medeco keys, partly because it's a little more expensive to make a machine the measures and cuts them, and partly because of IP.

The idea with Medeco is that you give one of these to your AirBNB guests or a building maintenance worker or something, and if you get your keys back, you can be reasonably confident that they didn't make any copies. You can't be 100% sure, of course, but the average mall machine or even locksmith probably can't help them.

An authorized Medeco agent will want documentation that you have the right to have a key made (you're the owner and not a renter), and they will of course happily charge you rather more than the mall kiosk to make a copy.

> you give one of these to your AirBNB guests or a building maintenance worker or something, and if you get your keys back, you can be reasonably confident that they didn't make any copies.

This seems to be a fairly useless reassurance. If you trust your AirBnB guest so little that you think they might reasonably make copies and distribute your key to unsavory people, then just the single key floating around out there is enough to compromise your security.

The risk is that someone will rent the place and spot an easy opportunity to copy the key and come back when other guests are staying at your Airbnb. Having a known number of official keys out there with a guest means you can keep tabs on those key and retrieve them for "full security". But having an unauthorized copy puts the owner's and every future guest's security at risk until the lock is changed because you cannot retrieve it or even know if it exists.

My mistake, I misread the previous post. I stupidly read it as "if you DON'T get your keys back..."

Locksmiths can and do just ignore the "do not copy". And even if they didn't you could just use a machine, tape over it, grind it off etc.

The point is that a key is only hard to copy for the average person if it is hard to copy for the average locksmith.

Every mechanical key is possible to clone, because every mechanical key is possible to manufacture.

No lock manufacturer claims you can't clone their keys if you've got the same machines as they've got in their factory. Or for that matter manual tools and the patience and dexterity of a watchmaker.

The aim is merely that when an employee needs an extra key for a newly hired colleague, going through the building services bureaucracy is easier than going to the key cutting guy in the mall.

This is one of the reasons 99% of large buildings use RFID keycards for the vast majority of doors.

> This is one of the reasons 99% of large buildings use RFID keycards for the vast majority of doors.

Most of these can be cloned, skimmed or even emulated with a common smartphone these days.

HID Prox was broken completely back in 2005. You can read and clone any 125khz prox card from six feet or more away.

https://proxmark.com/

No because standard house keys with "do not copy" on them, you can make them yourself with a key cutter and a few blanks you bought on ebay or alibaba. Medeco blanks are much harder to find, and the cutting requires specific equipment (nothing a custom CNC can't do though)

You can actually print the moving part in place using dissolvable supports (sometimes possible without a second extruder, using strategically placed removable supports but the tolerances won't be as good).

Oh, that's a really interesting idea. I had thought the slider used a spring of some sort, but apparently it's just freely sliding and the keyway pushes it. You might be able to do that! I haven't worked with dissolvable support material before; that sounds neat. I wonder if it'd be hard to clean out of such a small space?

Either way, they still upped the requirements from "anybody with a Prusa" to "multi-material printer, one of which is dissolvable," which is probably good enough for Medeco to believably claim to buyers that their system is "resistant" to 3D printing.

This is still in "anyone with a prusa" range, I think. Firstly you can do multi-material on a single extruder head by either changing filament as it prints (which is annoying, but for a high enough target not a problem), or pre-printing a two-material filament; second, Prusa themselves do a multi-filament mod for the Mk3 which can do soluble filaments; third, you might not need a second filament at all: I reckon you could print-in-place a two-part key with a captive pin. You could design in a leaf spring if it needs it. The resolution looks challenging, but you've got to bear in mind that 0.4mm is only the standard nozzle diameter, not the smallest available: 0.1mm nozzles are around and capable of some really fine detail.

It's only a matter of time, and probably less than you'd think.

Oh yeah, and we're also safely in "anyone with a resin printer" territory if that wasn't enough.

Their new side bitting and shuttle pin stuff in M4 are actually pretty cool. Props for Medeco! Love their rendering here too. https://www.youtube.com/watch?v=wLz7UWjy1mc

Much better explanation of how it works here: https://www.youtube.com/watch?v=DNpAIZl4krc

So like the Mul-T interactive, no different for picking

Interactive elements are common in high security keys, like protec 2 and Mul-T interactive. They provide good security against low skill casting (though protec 2 has its element at the front which makes it easy to modify a mold to permit a pick to operate the element). It's easy to modify a 3d printed key to allow sliding in a shallow pick to operate the interactive

At a certain fairly early point this stuff has to become impractical compared to electronic keys (contactless smart card, or even a mag swipe like in hotels, where the door code gets changed after the guest checks out). I wonder why this high end mechanical stuff even exists in this day and age.

Because anything electronic has a higher maintenance upkeep on the lock side. A good quality mechanical lock can work for decades even in bad conditions, and power outages have no effect at all.

Because an electrical lock has a wider attack surface. Instead of attacking the key itself, you can try to disrupt the electronics to cause the lock to open itself, which is sometimes easier, even a lot easier.

Or worse, they do a very good job on the electronics, but forget about basic mechanics. The LPL has lots of examples of that as well.

In general, bypassing electronic keys is in no way harder than picking locks, it's just a different skill set.

Here are some common bypass methods that work on many real world electronic locks deployed in the wild.

https://www.youtube.com/watch?v=gbn3JtoFdPg

https://www.youtube.com/watch?v=KHvfwpnPwwU

https://www.youtube.com/watch?v=hQTz1OmmHYo

> I wonder why this high end mechanical stuff even exists in this day and age.

* Mechanical bypass for electronic locks, to deal with battery failures, damaged readers etc

* Anything that needs a padlock - for some reason, most electronic padlocks are trash.

* Things that need cheap moderate security - vending machines, confidential-waste-for-shredding bins.

* Things that need the simplicity of classic keys, or that need to be controlled by someone different to the door access system. Safety lock-out systems, lift shaft / roof access.

* Things that are already behind electronic locks, but need an extra layer of security - e.g. the safe in the ambassador's office.

Because you are thinking about a single door. Cost of implementing and maintaining non-copiable RFID is much higher. My workplace uses Medeco M3, I have 7+ keys for the various areas I have access to, I can be given a key for a specific area for the time I need to do something over there, etc. Some areas behind electronic access as well but it is rudimentary and it did cost us an insane amount of money to just install that an a few doors because we have to use union shops that abuse us (took them weeks to do, four people showing up to find out they were missing a plate so they came back a week after and found out another part was missing etc for 3 months, no kidding...)

That's not plastic, is it?

Not many people have access to a metal powder 3D printer.

Just an estimate but I think this key in steel would be less than $50 on shapeways.

EDIT: I just uploaded the model to shapeways to get a quote and this key is:

    $26 for steel
    $44 for aluminum
    $75 for brass

The brass would probably have the most dimensional accuracy.

I have a small company that sells custom jewelry, and some of my customers want steel rings. They usually cost me around $15.

On possible downside is that due to cooling shrinkage steel only has about 5% tolerance. This can be accounted for in the 3D model. What I usually do for jewelry is order the ring in 2 or 3 different sizes and then choose the one that fits best. In terms of this key, I am not sure how much 5% error would affect its functioning.

I wonder if they'll call the police on you if you actually order it.

For patent infringement? I'm not sure Shapeways is super eager to start carefully examining their customers for potential IP violations.

Or perhaps for the reason that a key being copied outside the sacred grounds of a mall kiosk is suspicious?

Not for patent infringement, but because they think you're planning a robbery, because you're 3-D printing a key that is marketed as something a mall kiosk can't copy.

They might cancel your order, but I think you vastly over-estimate how interested the police are.

I really doubt it - even if someone noticed and thought 'huh, a key eh, that's different', who's to say you're not ordering it for your own lock, curious about Shapeways' tolerances and if you could design it to work. Not like it's illegal to own a key without a corresponding lock anyway, I doubt the police would (have time to) care even if they were informed.

It's illegal to blow something up (that isn't yours or on your land?) - not to possess the 'ingredients' with which to hypothetically make one (rather than do the cleaning or gardening or whatever they were intended for).

Shapeways can’t tell what a key is marketed as, when you provide just a model without any marking that it shouldn’t be copied

Just sent my model to a popular 3d printing service for around $80. I've used this key daily for almost 3 years and never had any issues.

ABS and PLA probably would be too soft but some locksmiths use soft material with a skill call impressioning.

Most modern home FDM printers can reach temperatures high enough to print with poly carbonate which would work fine as a key. PolyC is prone to warping but on such a thin print I doubt warping would be an issue.

PC with fiber should warp less and might be stronger. But I'm not sure if it has the same accuracy or any other downside.

Depends on your need. For a key you'll only need/want to use one or two times, plastic will be able to hold up just fine. If you need something more durable, there are a number of 3d printing services that'll print whatever you want in metal without any questions asked. Desktop sintering printers are also getting cheaper and cheaper. They're still several thousand dollars, but that price will only come down now that patents are expiring and people are starting to be able to work on the processes to get them more resonable in cost.

I’ve used plastic for 3D printed pin tumbler and disc detainer keys. It works well enough as a proof of concept, though not something you’d want to rely on for daily use.

The key doesn't need to be strong, not even strong enough to turn the lock. The key only needs to get the pins to align. After that you can use a metal turning tool to actually rotate everything. A bent wire would do.

You can probably find a desktop CNC that can cut a key based on output from OpenSCAD. Maybe a little tweaking required, like plotting difference() of a cube that encases the key model.

Naomi Wu did that last week.[1]

[1] https://www.youtube.com/watch?v=cexGEYxoMe0

Wow. It's pretty interesting to see how the key is getting milled. I would've done this way if I had all those equipments.

You can encase it in a plaster mould and use lost wax casting to get a metal key. A bit more involved in terms of time and money, but not prohibitively so.

PETG might work.

Wouldn't a CNC mill (or even a manually controlled milling machine) be a better tool for fabricating keys? Brass is pretty easy to machine.

you don't need to make it that complicated. if you are determined enough and have a little practice you can make alot of shapes with just a piece of metal and a file.

> Unlike most free software for creating 3D models (such as Blender) it (OpenSCAD) does not focus on the artistic aspects of 3D modelling but instead on the CAD aspects.[0]

The worst OpenSCAD description... Blender already has a lot of things which allows users create CAD models.

[0] https://github.com/feelsong/3d-printing-high-security-key#op...

Hey! I got them from OpenSCAD official website

> I got them from OpenSCAD official website

May you provide link to page on OpenSCAD site where Blender mentioned?

UPD: Just found it.[0]

[0] https://openscad.org/about.html

Reply on news.ycombinator.com