High-Security Mechanical Locks (2020)
swiftsilentdeadly.com
swiftsilentdeadly.com
[1] https://www.youtube.com/watch?v=_7vPNcnYWQ4 [2] https://www.youtube.com/watch?v=2A2NY29iQdI [3] https://www.youtube.com/watch?v=Ecy1FBdCRbQ
P.S. I used to work as a retail educator at MakerBot, while you were with FormLabs. SLA always blew my FDM centric mind
But yes, don't use it in production before the LockPickingLawyer took a look at it.
After all how would lock picking lawyer measure the magnetic strength of the pins?
After all, even a physical lock is just a combination lock. The combination is just 'encoded' in a metal strip. Or in the above case, with magnets. And it's still possible to copy the key by reading it.
Better to use a digital key with asymmetric encryption. Using that you can prove you have a private key without actually giving up the information needed to fabricate a copy.
The reality is, of course no security is perfect. In the case I used it the easiest path in was cutting the hinges on the case, but that would have been obviously and permanently destructive. Removing the lock and replacing it would theoretically get me onward traveling prior to noticing, where-as a destroyed case would have gotten me to immediately implicate the likely perpetrators.
In other countries, pre-inspection is typically required as well, but they don't have any concept of "TSA compliant" in the first place, that's a US thing.
TSA compliant locks are a ridiculous concept and nobody should ever use them for anything. Certainly not for anything important you travel with.
3D printable master key plans are readily available on the internet. At one point Chinese marketplaces were selling prefabricated master key sets.
And if that's not bad enough they can be easily raked open.
How did you know someone tried to pick it?
Are there any pics anywhere that show what such marks look like, and could they be caused by anything other than picking?
Visible with the naked eye
> Are there any pics anywhere that show what such marks look like, and could they be caused by anything other than picking?
Sure, it's possible they could have been caused by something else, but it's unlikely given the context.
Yes, there are photos, but I'm not able to share them at the moment. When I travel internationally to "sketchy" places, I always photograph my luggage thoroughly before and after transiting.
I thought I was just being paranoid.
Actually I probably am paranoid. Doesn't mean that aren't after me though! :)
Abloy Protec2 has huge installed base and they are extremely durable and reliable. Failing after 3 years is rare.
This is the far more concerning part.
Lockpicking is more interesting as a sport, or for legitimate purposes. For illegitimate ones it just takes too long, and its positives like being silent aren't of any benefit to robbers. And spies have better tools.
Modern door locks are full of mitigations like mushroom pins anyway. Data centre racks, office drawers, filing cabinets, those are the ones you can open in seconds because they tend to have cheap locks with really poor manufacturing tolerances. This is what makes lockpicking so interesting to pentesters.
Source: lockpicking class at security conferences (most of the defcon-style ones do them). It was really enlightening to see how hard it is to pick a good lock. And how easy to pick a crap one.
But 5 seconds is particularly bad indeed. Usually the cylinders are made of metals with different hardnesses inside to deflect a drill sideways. Brute force will still get them but 5 seconds is quick.
Your goal is not to look like a shitty target, it is just to look like a shittier target then the others.
However.
I find this argument to be a bit silly:
> If you get in without my notice, you may be lying in wait for me inside.
The risk to the average person for this type of threat is so low, that you are more likely to die because you fall in your shower and rescuers can't get through your door than an assassin lying in wait inside your house to get you when you walk in.
Emergency services should probably assume permissions to kick in your front door if necessary to save your life, I'd certainly give that permission if required explicitly.
That said, the real point is that emergency services don't need to be surreptitious, they're also welcome to put a brick, axe or anything they have to hand through my living room window if that serves the same purpose (assuming my front door was too tough to kick in, etc).
You need some serious walls and doors before you get something that can't be opened with the fire truck. It'll make a hella noise, though.
> High-Security Mechanical Locks comprehensively surveys and explains the highly technical area of high security locks in a way that is accessible to a wide audience. Well over 100 different locks are presented, organized into 6 basic types. Each chapter introduces the necessary concepts in a historical perspective and further categorizes the locks. This is followed by detailed 'how it works' descriptions with many pictures, diagrams and references. The descriptions are based on actual dissections of the real locks.
So then it's a game of getting blanks or a subset-blank that will fit in the keyway. I don't see anyone in here that has linked to the relevant Defcon video on Medeco duplication here: https://youtu.be/ij0c-236O0k
Also relevant (KeyMark tends to be the one used on exterior apartment doors): https://www.thingiverse.com/thing:5249568
One lock this article doesn't refer to is EVVA MCS, which uses a magnetic element as well. I hope to add it to the collection one day, but haven't yet found a justification.
On the other hand, my front door is still a standard pin tumbler, I figure nobody is going to pick my front door open when they could just as easily break the adjacent window.
There's a LockPickingLawyer video on YouTube [1] where he shows you a simple modification that seizes the lock upon picking attempts. I would do this, but unlike him I only have one entrance door, so in the event it is seized I'd have to break in.
My reasoning was:
- Lockpickinglawyer basically gets into everything (I guess except the Abloy being discussed in these comments)
- These locks were affordable for ANSI grade 1
- These locks are user re-keyable (I was looking at schlage B60N - affordable and nice, but basically would have had to pay a locksmith to get keyed alike)
- Lockpickinglawyer's video showed me a much more complex mechanism, and picking process, than a standard pin tumbler lock
I think a lot of people take his videos and have the binary thought process "lock was defeated therefore the lock is crap", but if you watch enough of them there is a lot of nuance. He defeats high security locks that are nevertheless robust and tricky enough to trust on your front door.
IIRC, he has since picked the referenced lock (Abloy Protec), but hasn't yet picked the Abloy Protec2. I imagine most of the locks referenced in the original post are in the same category.
Maybe if he was blatantly 'cheating', by using a battery powered sawzall or an oxy-arc torch to just blast off the lock. But he uses more mundane items, like the knife, or two crescent wrenches.
It's like that 'secrets of physical pen-testers' talk where half the time they can bypass security with a combination of simple low-tech tools (eg. under-door tools) and creative thinking (eg. blowing cigarette smoke through a door to trigger the sensor). The most efficient way to get through security is to not have to break it at all.
This goes for software as well as physical security.
While he sometimes he does destructive attacks just to highlight weak security (zinc, plastic) or poorly fitted parts, the vast majority of his videos are picks, often using specialised tools, like the disc detainer he helped design.
You mean, to quote, "the tool that Bosnian Bill and I made"?
Prevents breaking a key off in a lock by a large factor.
And how does one tell a high quality door/frame from one that's not?
Higher security locks may be made out of stronger metals, preventing this.
Of course, many doors are easily defeated themselves by a sawzall.
Wooden doors, presumably? It was interesting to see metal entrance doors when I was visiting apartments in China. USA doors all seem to be simple wood.
They do make metal blades for Sawzall. Without and exposed edge I don't think a Sawzall would be that effective. It would probably work, but would take while to get started until you get the tip through.
Even the metal doors are usually pretty light metal. A true security door is very expensive - and heavy.
*detection in the act of breaking in, not ultimately.
And of course in the event that the owner wasn't home, a break in would leave noticeable damage where picking would not (unless they failed and the anti pick pins got stuck).
I really recommend owning one just for the sheer beauty of the engineering.
https://www.evva.com.au/wp-content/uploads/2018/09/3KS-key-s...
Whether this is outrageous compared to a $28 'builder-grade' deadbolt at a box store depends on the value of the things inside and the probability of an attempt at a theft.
One thing to consider if sticking with "normal" locks is that you can still get the reinforced strike plates, pick a key design that makes bump keys or raking less effective (supposedly), not hiding a key, etc. Nothing is perfect. You can have the best doors and windows and someone can still knock a hole in your wall if they really want to.
It's typically done in thresholds too - start off with a small reduction in premiums, then a big one, then they won't insure you at all unless you fit this stuff.
So, the price isn't out of reach for the average computer programmer, but you pay a substantial premium over bottom-of-the-barrel products.
[1] https://www.barnsleylock.co.uk/abloy-pl34125--pl34150-padloc...
Personally I most of the time choose the Abloy Protec2, since I love the technology and the keys too.
I never understood "security people" who would spend a week hardening their OS but did nothing about their locks.
If you want to "get into" the art of opening locks without violence (most of the time :) ) I would suggest attending a meeting of the fine folks of ToooL
Very different threat models. Computers are available to anyone on the internet or the authors of any software I choose to install; remote attacks require very few resources and are common.
Physical attacks are different. The odds of anyone choosing to attack my particular house are very low; they can't attack thousands of houses at once, so basic techniques such as "being slightly less attractive than my neighbors" work well. As a standard residential house, picking the lock isn't the way anyone's going to get in. They could break the window next to the door. They could kick a door in. They could climb to the second level and open a window. They're not at all likely to pick my lock, though.
I advocate for using a decent consumer lock (i.e. not Kwikset - Schlage is sufficient IMO) with a properly installed deadbolt and strike plate but no further for most people.
I don't understand someone spending an absurd amount of money on a very high security deadbolt for a residential application. Burglars don't pick locks to get into houses. They force the door with crowbars, or break a window / open the latch, or climb to a second floor window that people rarely lock, and so on.
Unless your door frame is sufficiently strong enough and the door secure enough as well, spending hundreds of dollars on very high security deadbolts is stupid.
Secure locks generally do not exist.
https://twitter.com/LockPickingLwyr/status/10701189010973818...
still better to ask him rather than assume
Beyond that most locks that require specialized tooling to pick or are ranked above red belt on the lpu rating chart are more than secure enough for even commercial purposes. The chances of an intruder successfully picking say abloy protec 2, clavis f22, opnus mmxII, assa twin combi, etc are infinitesimally small compared to them trying to brute force entry through another opening like a window