If you watch LPL enough, you get the notion that most locks are for keeping honest people honest rather than stopping a determined attacker. All the comments from people who have managed to lock themselves out further reinforce that.
But you're right at a higher level: 99% of buildings have glass windows. Paying $$$$ for locks that go beyond "keeping honest people honest" is pointless if they can be bypassed with a rock.
Lock picking is basically only found among the locksport community.
If a car alarm goes off my reaction is not "oh no, someone is stealing a car" it's "man I hope they know how to shut that off quickly"
Bump keys are the simplest way to bypass common locks. You can make one in a few hours and it’s pretty much universal.
Most doors aren’t that strong. You can’t pick a lock but you can just knock the door in.
If you can’t knock a door in, try a window.
House has a security system? Get a ladder and go to the second floor. Most security systems are only installed on the first floor.
Or cut the phone line outside the house as that’ll disable the security system entirely (unless it’s wireless).
If the security system has a combined control panel and main board, just run in and smash it. Good systems separate the control panel from the main board to delay the burglar finding it and allowing the system to call for authorities.
Basically locks, security systems, cameras, reinforced door frames, and protective film on windows are just delays, not preventatives. The idea is to delay the burglar enough such that they either get caught or so they decide to hit the next house without as many obstacles.
The LPL is really similar to a lot of us, complaining that "right-click isn't really hacking, view-source isn't really hacking, come on your system is trivially broken" but about the locks practically everyone uses.
We also complain about companies marketing Super Military-Strength Proprietary Encryption but basic key management not making sense ... similar to how LPL likes to get the Pro Max Security big beefy trailer/fence locks and show how they have some of the same trivial design bugs as the cheap locks.
A knocked-out door has the disadvantage of being noisy and visible - random passersby may spot either the act or the result and alert the police, whereas most won't even spot the difference between someone using a legit key and a comb key.
The more time passes between the burglary and the discovery, the better for the burglar - if you're already two counties away when the police establishes local roadblocks these won't catch you, CCTV camera or ALPR records get deleted, phone tower (=which phone was logged in at a certain time in a certain area) records grow bigger and harder to sift through, potential witnesses forget details.
Of course, you can reinforce your door frame and this doesn’t work. But the next locksmith (like I said, regular occurrence) used a bump key to pick it and was in just as fast.
Needless to say, I don’t trust door locks anymore.
There are plenty of custom made tools on the market that do a great job (with built-in pads to protect the door frame, etc).
The only issue they commonly run into is a deadbolt with a throw long enough that you have to destroy the jamb and surrounding frame before it comes free.
In cases where the deadbolt extends significantly into the frame, then yes, it tends to be destructive. But doors with locks that substantial tend to be sturdy enough that brute forcing the door in any fashion (even if you're just attacking the door itself) is likely to damage the frame.
There are options for "through the lock" forcible entry, where you attack the lock directly, using something like a Rex tool[1]. That will definitely destroy the lock, but usually preserves the door (but isn't suitable for every type of lock).
[1] https://www.allhandsfire.com/Rex-Tool-Forcible-Entry-Tool
By the time he got a replacement key, I was literally faster at opening the door with my tool than he was with his key — once you get the knack of it...
(of course the tool was much more clumsy to carry around than a key, and 2 seconds vs 3 isn't enough to care)
You find a strong pint to lean on (a wall, or the ground) and the door is forced open in a matter of seconds (something gives away, hinges or lock).
This is why my lock is a smart one, to make it easier for people to get in (the ones I want to) and I know that a burglar is not going to analyze the emission spectrum but just force my door open.
I would definitely prefer him to use technonoly and not break my door.
I had a locksmith out a couple of years ago, and was very disappointed when he simply got out a drill rather than starting with 'click out of one'.
LPL makes things look easy, I'm sure they aren't.
LPL's career isn't lockpicking is it? I was under the impression that it was just a hobby that turned into a youtube channel. I seem to recall him saying that he just picks locks all the time, and that's why he's good. I think he said that when he watches movies he takes a 30 locks and then he just sits there and picks them while watching.
Anyway, if you watch all / most of his videos the near constant refrain running through them isn't "with finely honed skills and the right hard to find speciality tools it's easy to open this lock" (though he does do that). Instead it's: "it's easy to open this lock with no or few skills, no or little practice, with trivially found, improvised, or purchased tools, using exploits that have been known in the lock manufacturing and locksmithing industries for decades or centuries".
That in turn is his point in this keynote. These exploits have been known in the lock manufacturing and locksmithing industries for decades or centuries and yet many, perhaps most of the locks that people can buy in stores, still have those flaws (which are easy and inexpensive to eliminate in the design and construction process).
Pretty sure it's not. From what I've gathered, watching his videos, he's also doing consulting/training for companies on physical security.
That’s a common occurrence because of the incentives. The locksmith wants to spend as little time as possible (average time), and doesn’t pay a premium for destroying the lock, since most people don’t confront them on that.
LPL is amazing, but any decent locksmith could get at least near enough him in competence. It’s not that it’s so hard that very little people can do it, it’s that is very niche for most people to learn.
After all, if you spent a fortune in some lock and the locksmith can open it in 5 seconds flat, you’ll feel ripped off. It’s possible that a lot locksmiths believe the locks to be safe, and they think they’re saving time by going the drill route.
Not to mention that if the locksmith is selling you the lock, he will want to avoid damaging their reputation.
It took me 30 minutes to make and use a tool that he demonstrated using on a lock similar to one I own and most of that time was spent rummaging around my place trying find stuff.
Lastly, I think you got taken advantage of by a locksmith out to sell more locks and keys.
The only low-skill attack that seems to have any widespread effectiveness (and would therefore be worth trying on every lock) is raking, and that is pretty easily defeated by any lockmaker who cares.
For example I made a shim and opened a lock I own in less than 30 minutes after watching one of his videos that featured a similar lock. I had never opened a lock without a key before that day, don't have much use of two fingers on one hand, and my toolbox fits in a kitchen drawer.
For your list of common low skill attacks which have widespread effectiveness I would also include shimming, hammering, and cutting. Also in the case of locks with electronics associated with them, strong magnets.
On the other hand, if the locksmith clicked my lock out in just 30 seconds, I would probably ask him/her to sell me a better (and sometimes more expensive) lock based on his/her professional opinion.
Now that I thought about it this deep, I think I can be a locksmith too with all the nature advantages that I clearly have here. I don't even need a power drill, a battering ram is well enough for my job. And if somebody call me to open their door, I'll just ask which color they would like for the new door that whey about to own.
A story I was told once by an electrician who worked at a steel works for years.
The story goes something like this:
One day he was called out to a big engineering workshop, all their fancy new equipment is on the blink.
He walks up to one of the machines, has a look, then without saying anything promptly turns around and walks outside, followed by the curious manager.
The electrician circles the building and turns on the first tap he sees, and lets the water flow for a few minutes spilling on the ground. After leaving that go for a while, he turns the tap off again, and walks back in and tells the machine operators to try again. Magically, they all start working again.
The electrician has been there for barely a few minutes and hasn't even touched the machine or anything else electrical.
The manager asks for an explanation, since the electrician didn't even touch anything electrical. By way of response, the electrician says "You had someone fix that tap outside that was leaking, didn't you?" the manager replies in the affirmative. The electrician then explains that the leaking tap was keeping the building grounded - the slow leak was just enough to keep the sandy soils moist enough for a proper earth connection.
The electrician hands over the bill, with the emergency callout fee and minimum hours, etc. The manager protests that surely just turning on a tap didn't warrant a fee that large.
The electrician replies that turning the tap on was free, knowing to turn the tap on was what they were paying for.
Whether that story is true or not, there's plenty of similar ones.
The point is that while you might get annoyed that an expert came in and solved the problem quickly, without that expert you were going to wait a lot longer or spend a lot more trying to fix it some other way.
Personally, I'd rather deal with a locksmith that gave me the option: We can drill the lock, you can pay (say) $300 for new locks and keys and it'll take 30 minutes. Or, you can pay $300, we'll pick it in a minute, you keep your existing keys.
The locksmith I called a few years ago used a long piece of wire with a string attached, slid it under the door to pull down the door handle from the inside.
Spoiler: he leaned on the door to hold the latch in place, then used a plastic shim to trip it open.
“Locksmith says my videos are BS… Loses $75 (Maybe)”
Also if you actually watch this keynote half the problem isn’t locks you can actually pick but stuff you can just open with very basic tools that don’t even require the skill he has. Like combs, rakes, hammers, slithers of metal, etc.
https://www.youtube.com/watch?v=rnmcRTnTNC8
Someone who wants to get in is probably already on his way out while LPL is only halfway through with the lock.
You call out masterlock but they're particularly bad. I lost the key to one and kept using it for a year because unlocking it was as simple as just putting the pick in while turning.
I learned to pick my parents safe and door locks by 8, and have taught dozens of children to pick virtually every lock you can find in a hardware store.
As a security engineer the first thing I teach peers isn't even software, but lock picking.
Peoples minds really open up when you show them how to open every lock in their own office in under an hour of training.
"Is security on almost everything we trust every day really this shit?!"
"Yes"
I.e. force and violence required if letting the property.
If anyone know a better insurance the cover the above cases in the UK. Please tell me.
I guess they’d be hearing from my lawyer…
My lock picking lawyer…
9. Theft
a. This peril includes attempted theft and loss of property from a known place when it is likely that the property has been stolen.
b. This peril does not include loss caused by theft:
(1) Committed by an "insured";
(2) In or to a dwelling under construction, or of materials and supplies for use in the construction until the dwelling is finished and occupied;
(3) From that part of a "residence premises" rented by an "insured" to someone other than another "insured"; or
(4) That occurs off the "residence premises" of:
(a) Trailers, semitrailers and campers; (b) Watercraft of all types, and their furnishings, equipment and outboard engines or motors; or (c) Property while at any other residence owned by, rented to, or occupied by an "insured", except while an "insured" is temporarily living there. Property of an "insured" who is a student is covered while at the residence the student occupies to attend school as long as the student has been there at any time during the 60 days immediately before the loss
It is so common for people to let themselves out of their cells whenever they want that I almost never saw anyone disciplined for the infraction unless you did something dumb like walked up to a sleeping guard and spooked them.
Handcuffs are hilarious. The tiny little bendable pens they sold in the jail were the best way to open the handcuffs - you can just push the nib in and turn it. Tons of people would pop the locks on their cuffs as soon as a guard wasn't looking, but you'd generally need to keep them loose on your wrists so that they would visibly look secure. Again, the guards would just grumble if you took your cuffs off, not write you up for it.
In other words, if there was no lock, I'd enter houses that I can reasonably think are empty / populated by feeble elders myself eventually, however "honest" I appear to be now when I'm surrounded with locks and barriers to crime in general.
Locks are to slow an attacker. A determined attacker can bypass almost any lock, but not stealthy enough. If you drill the lock in my front door, you wake up the entire street. If you can pick it in 30 sec in the middle of the night, you wouldn't wake up anyone, but some kind of camera probably picked you up.
I used to pass this bicycle parking at a train station twice a day. I'd always look at the locks (or lack thereof) while walking, quickly thinking which ones I could certainly open (and the question is always: how quick). But I never gave in to the desire, despite a lack of locks and peers (for practice/fun).
The trouble is very few of these can be found in the US as consumers here favor low prices and a 10/10 promise over any actual security.
The Kwikset smart key v3 can't be picked because you get no feedback until all pins are set. You can decode them one pin at a time with expensive specialized tools such as a micro camera put into the cylinder but they will keep someone out for a while so they do their job. You still need to cut a custom key to get in even when you decode it so it is time consuming.
A Medeco will keep out even an experienced lockpicker for a while since pins must be in the right rotation and the right heights.
Beyond that there are really good Disk Detainer locks like the Protec 2 that have no feedback until all discs are correct. There are 0 public confirmed defeats of them.
Beyond that you get into hybrid digital keys like the Cliq. Then you can combine an cylinder known to not have any defeats with a second set of pins that can only be engaged after an AES challenge/response between a microcontroller in the key and one in the lock.
These also have never been defeated.
There are also solutions like the Bowley lock that don't expose the tumblers to the outside world and can only be defeated with many hours of work making custom tools for that specific lock.
I could go on and on.
The reason you can't buy good locks at US hardware stores is fully because the uneducated masses rejected high security locks once companies like master lock pumped out $5 locks with 10/10 security ratings in spite of any informed child being able to open them.
I would love to see people like LPL put their lawyer hats on and sue these companies for dangerously deceptive advertising.
https://www.youtube.com/watch?v=qV8QKZNFxLw
There are a couple of (old) videos on Medeco locks:
https://www.youtube.com/watch?v=JmyC7KM5Qxk
https://www.youtube.com/watch?v=4fh6IHCr7uo
https://www.youtube.com/watch?v=avwt39uHDOQ
Related to the Disc Detainer (come for the tooling discussion, stay for the picking):
Linked by ryzvonusef: https://news.ycombinator.com/item?id=29367579
Of course if anyone did it, it would be huxley.
It feels like Bowley underestimated strong vibration attacks like that and didn't invest enough in spool/serrated pins.
I suspect this is correctable, but I wonder if it would work as well mounted in a sturdy door since the vibration is not directly connecting with the pins.
Protec2: Very very difficult to pick, however there are videos of a few picking it: https://www.youtube.com/watch?v=6zVSJ_wauwg (https://www.reddit.com/r/lockpicking/comments/edrrjo/hardest...) https://www.youtube.com/watch?v=AsG90UGRTpw (https://www.reddit.com/r/lockpicking/comments/mie59t/abloy_p...) https://www.youtube.com/watch?v=6UZ6tcvgd9U
The Protec2 I would trust far more than the Kwikset SmartKey V3, since it appears only several of the best of the locksport community have been able to pick it.
I couldn't find record of anyone opening a Cliq. I'd be hesitant to say that's because they are unpickable, though. I believe quite a number of the locksport community would not be very interested in attempting to open a Cliq as it isn't purely mechanical.
Still they are all well designed locks.
I recommend the smartkey v3 for people that need a lot of locks they can source quickly on a budget. The sidebar design is a real pain to defeat and if the lock is in a body with tight tolerances you may not be able to shim the sidebar at all. Without some kind of attack to tension the sidebar they can't be directly picked.
For those with more money to burn the Medecos are good security for dollar.
I put a couple Protecs on my luggage as tamper evidence devices so the TSA has to call me when they need to search it.
I would not bother with Protecs on a home as they are very expensive and there are generally better areas you can invest in home security for that kind of money but if you have a small number of ingress doors they are nice.
I don't think anything is unpickable/unbackable but when the time to defeat a particular lock someone has not seen before takes 10 minutes to hours and few if any in the world can do it I classify it as a "good" lock when the status quo can be defeated in seconds.
Does the TSA no longer open those locks with a grinder/bolt cutter?
I have never once had a lock cut. Only one flight ever did they call me for access but normally they don't bother.
YMMV.