Level responds to lock picker opening its $330 Apple Store lock in seconds | Hacker News Reader

Level responds to lock picker opening its $330 Apple Store lock in seconds

techradar.com

248 pointsstacktrust201 comments

A fairly lame response from Level considering the price tag of this lock. My guess is they simply outsourced making this to cheapest vendor they cut find and never talked to a engineer familiar with actual locks. The inclusion of various security pins would have defeated these simple attacks and not really increased their cost.

Having your lock defeated by the LPL is just normal as he's an expert at doing in. Many skilled locksmiths cannot open locks he able to do. Not guarding against raking and bumping, that's shameful for an exterior door lock. Then doubling down on their failure, that's Baghdad Bob level of PR right there.

My thoughts exactly. Some minor changes could make it bump and rake resistant and only a tiny (if any) increase in price.

The cost difference is cents, so it's a wonder if the company is cheap or ignorant.

Seems like both.

Originally arrogant or ignorant t, I'd say, and now damage control for their stock already out in the wild.

I would reckon they would change it for a v2 but they need to recoup costs first, but I could be wrong.

Absolutely arrogant. Either they're producing a lock without doing the least bit of research to uncover the easiest, most basic attacks, or they know about them and don't care.

There would have been engineering cost to designing a better lock. Also, that's not their product concept. These are not locks for people who care about security, they are for people who care about iphone ecosystem synergy.

If you look at it a certain way, this isn't really a defect: when this lock gets bricked by a firmware update or recruited into a botnet, you won't be trapped on your porch for too long before your neighbor's kid can let you in.

But also, full agree on "our goal is to be better than an open window." I hope they don't extend a job offer to that marketing intern.

No, better locks are already invented and will fit that standardised barrel just fine. This is either someone minmaxing the BOM or just not knowing much about what they were specifying.

Yes, this is more accurate. They would need to spend fractionally more on the tumbler, which I really think they have no incentive to do because the target customer will not know or care about the physical security upgrade.

The incentive is not being ridiculed and belittled and being taken through the media circuit for a minor loss in profit margin?

But then again, all press is good press

> There would have been engineering cost to designing a better lock.

And a reputation cost for not.

And a marketing benefit from the controversy.

And the opposite. I had seen this and was waiting to buy one when brass is available. Now I’m going to pass. If they can’t take very basic measures then I don’t want it as a product. It tells me a lot about their process.

Level is an existing smart lock manufacturer and has several non-Apple-specific models which are on the market. I would assume they didn't go find a cylinder with zero pick resistance just for their newest and most expensive model.

The presence of an Apple specific model at a higher cost (adding NFC for HomeKey entry, which works even if your phone/watch battery is dead) caused it to get pushed onto the LPL's radar.

> There would have been engineering cost to designing a better lock.

Putting security pins in there wouldn't have involved any engineering at all.

You can use it with most any lock set. You’re paying for the bolt, not the lock.

for the price it should be perfect.

At that price, I would hope I was paying for both.

Meaning you can change out the mechanism that is easy to pick, but keep the smarts and motor?

That’s correct, they sell (sold?) a model hitch doesn’t even include the lockset.

The bolt itself is hollow and contains the battery. So… a fail there as well.

On the plus side - if someone tries to kick it in hard enough to damage it, free pyrotechnic alarm!

For the price point it's all embarrassing. I purchased Avocet locks after I saw they gave LPL trouble and a set for my entire house didn't cost as much as this horrible, shitty thing would. This is literally a scam product.

Not to defend this product, but what’s the threat model for a pick resistant lock? I assume, but don’t actually know, that my biggest risk is having my rear door window smashed and the door opened from inside while I am not home.

Lock picking (even raking or bumping) seems like the kind of thing that someone smart enough to figure out how to do is also smart enough not to engage in home burglary.

So unless your threat model is the three letter agencies entering and bugging your house, I assume other physical security upgrades should come first.

I think the idea is if the lock makers won't bother protecting from simple attacks, what else have they skimped out on? It's not like the pick-resistant locks are exceptionally more expensive.

Thats what Im thinking too, it shows carelessness and unprofessionalism from the lock makers. And the high pricepoint is justified even less.

House insurance will cover the robbery if they break the back window to get in. It might be more difficult to file a claim if they rake the lock and don’t leave any trace beyond your missing valuables.

There's an interesting DEFCON presentation on lock picking forensics[1]. I don't know if there's any certified agency that can do a forensics report which an insurance company would accept, but if there is such a thing, most (all?) lock picking techniques leave marks.

[1] https://www.youtube.com/watch?v=AVZzBjK1kmI

this is a very important point

If the lock is picked, the burglary may go unnoticed for a long time. With a broken window, you'll find out quickly.

What sort of hokey black hat nonsense is this?

You can pick a lock, steal things a lot of people wouldn’t notice for a very long time and leave like nothing happened. There would be no call to the police, no threat of window alarms etc. easiest way to get away Scott free.

so this lock plus a hidden camera solves the issue?

If you review it everyday it might. I know I would never look at the recording.

There are surveillance products that offer motion detection as a feature.

You get notified if unusual movement within your property is detected rather than you having to do the boring task of reviewing surveillance footage.

If someone cases your house, they'd still pick targets based on ease and value.

If they canvas your house and see a shitty, easily bumped lock, you are now an easier target and they're more likely to break in.

I reckon opportunistic break ins it wouldn't make a big difference whether it's this lock or a better one though.

Lock picking as others have pointed out is not the most common method of entry. But if you see one lock that is really hard to pick due to good engineering, they probably also spent effort to make it resist other kinds of attacks like kicking the door, etc.

Firstly, locks should be immune to raking. If I can enter your property with a piece of metal in 20 seconds and with no training, the lock manufacturer fucked up. That's casual and you want to deter casual opportunists.

So, other than picking, there's a bunch. There's snapping the cylinder, which is common in the UK and only takes pliers, there's using a crowbar against the door to move the frame out of the way around the latch, breaking windows, and more.

My threat model doesn't include pickers, for sure, but I'm particularly angry about this product because it's visually distinctive and famous, so unlike a regular lock which is basically a roll of the dice as to its quality, this quietly screams for attention and that's a problem. Thieves do canvas houses looking for targets.

Think of it in context. A passer-by seeing someone smash a window will 100% call the police. Glass shattering makes quite a bit of noise as well and leaves behind a clearly broken window.

Meanwhile, lockpicking has a chance of looking no different from the rightful owner using a key, especially at a distance, is relatively quiet, and leaves basically no trace.

Threat model: stealing a “something you have” credential from your house and then using it before you can become aware of it to then remotely deactivate / decommission / rotate said credential.

> So unless your threat model is the three letter agencies entering and bugging your house

The three letter agencies will have no problems gaining access to a house via picking a lock.

Their ability to access without detection extends beyond that.

On top of that, let’s be honest, if they want to bug someone, they will just access the mic on their phone, Alexa device, smart tv, etc.

Yes, I'd take this as Level arrogance.

For another data point, I never managed to pick locks in my twenties, but something aligned for me in an evening lock picking course in my sixties, and I picked everything in the room. One wants a training set of locks to learn on, one pin, two pins, three pins, ... then one learns easily. It also helps that with age one's brain quiets down. To pick a lock, you need to listen to it.

I asked the organizers, surely they had something that would stump me. They handed me an American padlock identical to one I'd been buying for years. It stumped me.

It took LPL more than one pass to pick a basic American. He made it look easy, still reassuring me there was some skill involved:

https://www.youtube.com/watch?v=oaP1nFZ9AXE

Videos by others describe more advanced American locks that took several months to overcome. American takes basic countermeasures, that Level could have easily adopted.

LPL opened it via raking. That alone means there are no security pins. A serrated pin and a couple spool pins isn't expensive and is standard for locks that aren't budget or master locks.

It doesn't necessarily mean there are no security pins. I can easily rake open a Master Lock 140D, despite those having spool pins.

Spool pins actually can make picking easier by providing you with more feedback about the pins vs normal pics. (A lockpicking friend explained this to me once)

I don't know about serrated pins though!

I have found that serrated pins are pretty easy to defeat by manipulating the torque you apply a little bit. I actually have a slightly harder time with spool pins although they do give you nice feedback about when they are set (and false set).

Having taught some lock picking classes...

I think the point is, almost anyone with 5 minutes to watch a video on basic techniques (or who is interested in spending 30 minutes just messing around with no prior knowledge) could probably pick this very expensive lock.

To do what you're describing, some people wouldn't get it, and for those that can do it (most, with some practice), it'll probably take 30 minutes to an hour of practice - or a day or so for the outliers.

It's a huge difference in difficulty between the two for a few cents in parts.

> I can easily rake open a Master Lock

For those who don't know, watch LPLs videos on this brand and you'll see what's level of security they offer (basically none)

The irony is that the best Master Lock in terms of picking resistance is a plastic LOTO lock that offers almost no protection against brute force attacks.

I wonder if Schlag's Encode Plus, which is designed to work with Apple Home Key as well, is also at all vulnerable. Schlage seems to have a fine record[0] but you never know what corners might be cut to get a product like this to market. https://www.schlage.com/en/home/smart-locks/encode-plus.html

0: video https://youtu.be/WpbKOL1cM34

There are issues with the physical lock, nothing to do with the electronics. So it's likely a real lock company like Schlage should be more resilient.

There are multiple videos where LockPickingLawyer opens electronic locks from various companies using a simple magnet.

Even "real lock companies" are not immune from selling shiny gadgetry with misleading marketing

I’m a very low skilled picker, but I did try racking and bumping my Encode Plus before installing it and didn’t get it open.

That said, I do intend to re-core and re-key it someday.

I was curious what 4% of the homes in the US is. 5.6 Million. Pretty wild. I would not trust my front door to these people. It's silly simple to make a presence system for your house. Assuredly cheaper than the price of this lock.

4% of broken into homes use lock picking.

I know they framed the statistic as “only 4%” but that’s higher than I would have guessed, given that modern locks (should) have anti-picking security features. If we could calculate the fraction of break-ins by the picking where the lock was vulnerable to raking or bumping, we should expect it to be higher.

The way I am reading the link, it was 4% of all 3.7 million household burglaries or 148,000 subject to raking.

Regardless, if someone is intent on breaking into a house, I doubt a locked door is going to do anything. Not only are windows abundant, but even exterior doors seem to have gotten cheaper and thinner than days of yore.

Ah, you're right

The worst part about their response is they're basically admitting that any $10 lock would be roughly as effective and the $330 price tag is for unlocking via the app.

> any $10 lock would be roughly as effective

No, $10 lock would not be as effective as $330 lock in displaying someone's vanity and Apple cult membership.

Interestingly, one of the big selling points for Level is that it looks virtually identical to a normal lock unless you look closely and know what to look for.

A $10 lock would be better; because at least then it would have a solid locking bolt.

I've been told they've had internal discussions around having LPL test their products, but they never went anywhere. Level was pretty dismissive when I brought it up as a suggestion in one of their many recruiting attempts.

I love how their response to "your lock is bad" is "you don't really need a good one". I guess that's supposed to convince me that spending over $300 on a lock is what I need.

I wish someone did a more honest and thorough review of the Level lock.

Sure it can only be picked with a wave rake. But all the advantages of the lock are negated by its actual performance.

- Unlocking by touch only works about 10% of the time.

- Homekit integration is really bad. It's quicker to pull out my key and unlock it manually than connect over BT and unlock it. It's even slower through the Level app.

- Battery life sucks.

- After unlocking manually it will automatically lock instantly. My door has a dent in the frame from this as I close my door after opening and it locks while it closes.

- Support doesn't exist. They do not reply to you.

Don't buy it. It's a piece of shit for the money. It has few benefits over any electronic combination lock or a normal deadbolt.

As an old joke says, "I work in IT, and that's why I only have mechanical locks."

> - Homekit integration is really bad. It's quicker to pull out my key and unlock it manually than connect over BT and unlock it. It's even slower through the Level app.

HomeKey is meant to fix this, ie. it's an NFC key in your watch/phone wallet so whenever you hold your phone next to the lock it'll unlock without any network communication (and 'hold near' does not require double clicking side button, and it should work offline[0] like a transit pass, iirc)

0: https://support.apple.com/guide/iphone/unlock-your-door-with...

That doesn't fix or understand the problem, which is needing to physically take something out of my pocket to open my door.

I don't see an advantage to using my phone's NFC to unlock the door over a key. Either way I need to put down whatever is in my hands to open the door.

that's the fault of whomever mounted the NFC sensor. if the NFC sensor was at pocket height, then you could lean against the sensor and activate it through the thin fabric of your pocket without using your hands

You're misunderstanding the problem and the product. I don't use NFC to open the lock. It uses capacative touch sensing on the enclosure. There's a geofence that detects when my phone is within range (iirc it is not NFC).

You're also assuming a lot about the position of the lock.

I'm not assuming anything about the position of the lock. My point is that the lock can be moved around, as can the rest of the physical devices/infrastructure, to be more convenient for the user. Which helps everybody, especially if the needs of the disabled are considered.

The promo images for the Encode Plus emphasize watch usage - you just put your wrist near the lock. Still not as convenient as eg. face recognition but it's intended for someone who has bought into the whole Apple ecosystem.

That doesn’t work though. I’ve never gotten the touch or the watch unlock or the NFC cards to do anything.

I understand where Level is coming from with this response, but cybersecurity has taught us better.

Yes, less than 10% of attacks use this exploit, but now that it’s public that you’re vulnerable to it, you become a target for 100% of attacks involving this exploit.

So for instance, if the delivery address of Level customers leak (and given the security of their physical locks, I would say them having bad cyber-security practices is not something too far-fetched), a malicious attacker would essentially have a database of home addresses with users that have bought a $300 locker that he can break into with the help of any YouTube tutorial

Spoiler: the majority of typical residence locks are no better, and in reality there are far less malicious attackers than you think.

I don't expect a $5 to try to do much beyond preventing someone from accidentally opening the door. I do expect a $329 lock to not skimp on basic features to cut a dollar off the BOM.

I remember looking at this lock. I really wondered how strong it was because the battery is in the deadbolt. How easy would it be to smash the door open?

I never even considered a bump key might work. And raking? It’s like they’re not even trying.

You’re right with the $5. This now sounds like a $5 lock with automation around it. I’m not saying it needs to be the best lock on the market but come on.

And Level’s response is just sad. It’s very clear they got caught flat footed (shouldn’t happen) and are trying a bad move-the-goalposts to save face.

By their argument you don’t even need a key. Just let someone insert an Allen wrench to turn the bolt directly! No one breaks into houses that way. It’s secure!

Wow.

So long as the battery is on the inside piece, it really isn't much different from a manual deadbolt. There's some extra gears and the motor, but they're going to be behind plates of metal- if you are taking a crowbar or hammer to one, you'll make enough noise that you might as well just break a window.

On the other hand, a super distinctive deadbolt on your front door that is known to be easy to open with a bobby pin is basically anti-security as you are advertising that your home can be entered without leaving a trace.

A locked door is not going to stop someone entering your house if they really want to get in. Doesn't matter what lock.

The key is if they're trying to get into your house or if they're just casing the neighborhood looking for appropriate targets.

It's the "only have to run faster than you" joke.

And since this lock is a joke, having one is a nice little advertisement.

That's a chicken-little argument of false equivocation. There is often to always a level of security sufficient to make forced entry too costly.

If you’re gonna have your house robbed anyway you might as well save on the lock. Even better if you don’t add your name to a database of people with weak locks.

Yup.. only takes one data leak

"designed to be used with them; the Level Lock Plus can be unlocked using one of the best iPhone or best Apple Watch devices even if you’ve forgotten your actual house key."

The way "best" was added to each of those links was the best part of this article.

It's always reassuring when a website prioritises SEO over sounding nonsensical.

I thought that was just a machine translation or something, but nope. Those are links to their own listicles on the best iphones and watches of 2022.

Thanks for pointing that out. I assumed it meant only the latest / top of the line devices would work.

Can’t someone in the Google Search team put some negative weights on this practice?

This is downright hilarious. I couldn’t imagine running a lock company and arguing that it’s actually good and normal that my locks can be defeated by anybody with a $1 bit of kit off Aliexpress and exactly 3 minutes of Youtube knowledge.

yeah man, the response should have been a photo of and personal apology from the exec who got fired over this, along with details of the recall

If they pretend it didn't happen, most people are going to not realize it never happened, unless it blows up bigger.

HN is not exactly the front page of the new york times or something.

So this company really wants people to pay $330 and just simply ignore the fact that it's a super shitty, highly ineffective lock.

They're not even trying to hide their grifts these days, are they?

But but -- the New York Times had said this is just fine for over a year:

https://www.nytimes.com/wirecutter/blog/picking-smart-deadbo...

Notice that they essentially rake (with the godawful demonstration of "picking") on what looks like a Level lock to then make the conclusion that AlL Locks are pickable because even an idiot that doesn't know the difference between picking and raking can do it.

I mean he could have watched 2 videos of the LPL channel as research and he'd know better that not all locks can be just opened by a rake tool..

> only 4% of homes are broken into using this method

I'd spend a few dollars to eliminate that 4%.

I don't like electric locks anyway. Over time, door frames tend to shift and the doors tend to sag, to the point where the bolt jams in the frame. Electric bolts won't work with that, whereas manual bolts will still work fine, because you can jiggle it to get it in/out.

Not to mention: how many % will that go up once some enterprising thieves realize that there's a trivial way to break in to places with obviously too much money (judged by paying $300+ for an insecure lock).

The only saving grace is that the lock isn't easily recognizable from a distance.

This might be far-fetched, but I wonder if more enterprising thieves could wardrive around wealthier neighborhoods and scan for these locks to find easy targets.

4% are known. Who knows how many go without notice?

Electrically moving the bolt is a waste of battery power. The decent locks just engage/disengage the bolt from the latch and let the human do the turning.

That's how my apt door smart lock works. There's no keyway to pick or bump. It's a momentary clutch operated electrically that grabs the bolt mechanism. If you want to force your way in, better bring a big ass drill.

The August is a waste.

Could you share the make/model?

>In response to LockPickingLawyer's findings, a Level spokesperson told us that while the potential threat of a lock picker is eye-catching, only 4% of homes are broken into using this method (according to US Department of Justice (opens in new tab) and FBI statistics).

So basically what Level is saying is that locks are basically security theatre, and they're happily complicit in it: locks don't actually need to be secure, because no one tries to pick them, now please buy our $330 lock.

When I read that statistic, I was wondering something else: perhaps only 4% of homes are broken into using this method because most locks aren’t vulnerable to these?

That’s an interesting hypothesis, but it’s largely not true. If you can buy the lock at a hardware store, it can be picked quite easily. It’s absolutely the case that locks are security theater, or perhaps more charitably they are there to keep honest people honest.

The Schlage B60N deadbolt is widely recommended, widely available, has an ANSI Grade 1 residential rating (resistant to common attacks) and costs less then $50 on Amazon.

For another $20, the door strike plate can be reinforced against being kicked in, https://news.ycombinator.com/item?id=32481302

I feel bad, because I was waiting on this response. It’s an ok lock which I have picked a lot of. Don’t rely on it to stop anyone with access to YouTube.

Edit: the Schlage connect is in this same category; widely recommended, highly certified, easy to pick. Locks are theater.

Schlage B60N is still better than the $330 Level lock, a budget that could be better spent on Assa Abloy, Bilock, Evva, Medeco, Mul-T-Lock, etc.

It’s certainly better at providing the psychological safety that you have “a really good lock”, and since that’s what locks are for that’s important. With that said, nobody being stopped by the Schlage but not by the Level. Especially since as you point out the default configuration of the Schlage is trivially bypassable with a boot.

Nah. Locks mostly suck.

Most burglaries are drug addicts busting a door in to grab whatever. The 4% number is a conceit… who are these lock pickers and who are they targeting? My guess, people dropping $300 on a lock.

Not really. Good locks are not vulnerable to a kid that followed a YouTube tutorial. Better locks come with a rating that’s supposed to estimate how much time will a properly equipped professional need to open them. It’s typically single digit minutes.

It’s just that every other break-in method is easier.

LockPickingLawyer is very skilled, but the tools he used in this video were basic, a wave rake only - definitely a low skill attack. He did it 4 times in a span of 3 mins, while still reviewing the lock..

AIUI bump key method (the other one it is vulnerable to) requires about no skill.

I'm fairly sure you can get just about any random person "skilled" enough for raking by handing them a tension tool, saying "Use this to turn the lock", then handing them a rake and saying "simultaneously roughhouse the lock some with this."

Yes, but it's a step or two above bumping.

Depends on if you're allowed to use a bump gun[0]. I consider a lock bump gun a proper zero knowledge method, using a bump key still requires nonzero skill.

[0]https://cdn.shopify.com/s/files/1/0502/7857/products/Dimple_...

Good point, although it would conversely increase the cost.

Watching LPL videos only reinforces the notion that the vast majority of locks are only used for keeping honest people honest.

The $330 price is for being "smart", not for any additional security.

Not putting security pins in the core of a $330 dollar lock is dumb though. So it's a dumb lock.

The phrase "keeps honest people honest" is oft said but I think it isn't quite true to the real mechanism at play, which is a system of societal incentive structures. How about this: "locks only keep people out long enough to notice them trying to get in." The relevant factor then is the ratio of picking difficulty to situational difficulty.

You could have the worst lock in existence, but if you're using it to chain your bike to the rack next to the police station in the worlds busiest street corner, no one will ever attempt to pick it because even though they could, there's a near 100% chance of getting caught. Conversely, you can put the best lock ever constructed on a door in some secluded alleyway no one ever checks up on and it won't matter because there's no upper limit on what a thief can do without arousing suspicion, so they will simply use a blow torch.

There are neither honest people nor dishonest people, just rational incentives. The real locking mechanism is the societal system of property rights which will take you to jail if caught trying to subvert the mechanical system of property rights.

That is completely wrong. Society is able to function (or not) based on agreed upon behavior. The police is mostly useless if someone broke into your home and stole your keyboard. Most people, who needs keyboards, will not break into their neighbor's home but instead will buy one from a store.

Most suburban homes are actually unlocked. If the front door is locked, there is a high chance you can get in from the backyard or from a window. It's easier than you think to break into a home. Most of your neighbors are working in the day, or even if they are not, they are not actively checking your home. It takes less than 2 minutes to break in.

You can also bring a van and two uniformed men and take all the possessions there is. People will think you are moving out; and not being actually robbed. When you have a higher criminal population, life become hell and no amount of policing or security will help. (ie: Some countries in South America and Africa).

> keeps honest people honest

More like keep curious people out. Most people will not enter your house even if the door is left open.

You say I'm completely wrong but then go on to make exactly my same point. Sure theft is possible and yes, a lot of the time the lock is merely a signifier that "taking this breaks the rules" rather than a substantial physical obstacle to breaking the rules. Most of the time people do follow the rules.

But, if the value is simply as a signifier and the rules of society are just agreement, can I replace all the locks with signs that say "please don't take this" and replace the police with just expecting people to be kind all the time? Of course not. The agreement of society is meaningless if nothing actually enforces any of rules. Enforcement may not be perfect, you indeed often can get away with crime, but for most people the expected payoff from stealing their neighbors keyboard is worse than the expected payoff of just getting a keyboard the "right" way from the store.

The cost to stealing the keyboard depends on the time spent in jail if caught, times the probability of being caught. The probability of being caught goes up the longer I have to fiddle with a lock. The lock doesn't protect the keyboard per se, it merely makes the expected payoff of stealing not worth it to most people.

Even if the door is left open, most people aren't entering your house for the same reason. If you're gainfully employed, the price of going to jail is high enough that you aren't going to start breaking into places even if you know for a fact the door is left open 90% or more of the time. The expected payoff of stealing from your neighbors isn't worth it.

I am an honest person. I would not steal an unlocked bike with zero chance of getting caught. Does that make me irrational in your world?

Haha. That's a low bar. I want "frustrating and tormenting crooks to no end."

> the vast majority of locks are only used for keeping honest people honest.

No the point is that if your house is locked, that it will make the burglar try your neighbor's house which is unlocked. Or they'll just throw a rock through your window.

For $330 I would expect rake and bump resistance at least, though, that isn't rocket science.

$10 for 1 L of Smart Water. Is it wise?

It appears that, far from additional security, they don’t even provide regular security.

I knew from the title that this had to be LockPickingawyer. The guy is an absolute genius.

His YT channel made me realize how mild of a deterrent most locks are.

If you haven’t watched his channel yet, I recommend giving it a spin.

It's not magic. Most reputable locksmiths possess roughly these skills to nondestructively open locks for customers. Heck, with the $15k programmer setup, I can make you an infinite number of Mercedes key fob copies too.

Lately in my area Lock Smiths have been replaced by random dudes with a van and a drill. They won't even try to pick or do anything for even trivially pickable locks, just drill out the old one and sell you a new one at a high price.

Having left my picks at home once, and locked myself out, it was not entertaining to watch - but still necessary.

I can't believe apple allowed their name to be attached to something so shoddy.

The Apple Store selling something is not the same as Apple "attaching their name" to it.

Actually, while it's not the same, it's basically very similar. It means Apple did no real vetting, which by itself says something about them.

No, but the point remains: Apple is implicitly vouching for the quality of everything in its store, and with their ultra-limited selection, one would expect the best of the best.

Yes, Apple should be willing to give everyone a refund who purchased this if they stand by their vetting.

Especially because all the things sold via Apple are priced higher than similar products elsewhere, so if the products are not higher quality, then Apple’s reputation is getting dinged.

As it's apple, one would expect the most expensive of the expensive. And that's it, quality could be anything, most likely mediocre to bad.

The purpose of retailers is to signal to consumers that the products they sell were curated and have the approval of that retailer.

If B&H started selling cheap equipment off of AliExpress, they'd rightfully take the reputation hit for attaching their name to those products and choosing to sell them to consumers.

Apple should apply the same scrutiny to products they sell in their physical stores as the scrutiny they apply to apps in the App Store.

It appears that they are, given how many scams make it to the App Store[1][2].

[1] https://www.washingtonpost.com/technology/2021/06/06/apple-a...

[2] https://www.laptopmag.com/news/84-scam-apps-still-active-on-...

Yeah randomly blocking high quality apps for no reason, while letting pure scams through does not qualify as scrutiny.

lol! good joke!

Level's response: "No, no: our bar is lower than that."

" the Level Lock Plus can be unlocked using one of the best iPhone or best Apple Watch devices even if you’ve forgotten your actual house key. "

What? Is that a typo, or can you only open it with the "best" iphone and apple watch? whatever they are.

Those are links to their 'guides' on the best iPhone and the best Apple Watch for 2022, respectively.

I'll save you the trouble--they rank the most expensive models the best. Surprising!

Aside from the easy lock picking, the bolt of the lock looks incredibly flimsy. It’s a thin hollow tube rather than a solid metal bolt. It looks like a big push or kick would rupture the bolt and open the door.

But the Lock Picking Lawyer didn't pick the locks! He opened it two ways that require little skill: bumping and raking. At least they could have made the lock bump and rake resistant at that price.

He didn't single pin pick the lock, as that wasn't the point of the video. Raking is a picking technique, though, and common as a starting move in locksport competitions.

This seems like an effective way to lose Apple as a client!

That was my first thought - if this blows up any further Apple will drop them like flies.

Those two methods seemed very simple and not a high skill attack at all. Aren't there a lot of commercially available lock cylinders/cores that prevent these attacks from multiple manufacturers that Level could swap their sourcing for?

Yes, and these cores don’t cost much more.

The LPL is really fair and clear about this stuff in his videos, saying that single pin picking is hard and rare, not something the average homeowner needs to worry about. But raking and bumping are just inexcusable.

I agree it should use a better core for that price, but the chances a burglar is going to rake your lock open instead of kicking in the door is pretty low.

Even in physical pentesting, lock picking is rarely used. There are usually much quicker and easier ways that exploit the various ways that doors and hardware can be installed incorrectly. A simple travelers hook is a much more useful tool than a lock pick set.

The unusual choice of Level to make the bolt hollow so they can put a battery in it probably makes kicking it in easier.

LPL also points out in the video that the hollow core design used in the dead bolt likely makes the deadbolt far more vulnerable to kicking it in.

Not to mention that this is a dead bolt lock and completely impervious to a travelers hook…

According to the very statistics cited by the lock company in their own defense, the odds are better than 1 in 8 (I only saw min/max) that they will rake your lock instead of kick it in. So that's 12.5%+ of the time it will get raked open instead of your door being smashed in.

> Even in physical pentesting, lock picking is rarely used.

As I recall, that's because it's known that locks can be picked. Unless the client thinks they have uber locks or thinks their guards should catch it, it's not the vulnerability they are looking for.

This is a stupid product for stupid people, offering as much security than a lock 1/10 of the price.

Worse, it sends a message. It says "I am a rich idiot who doesn't understand security and has too much money, and who subscribes to the apple ecosystem so hard that I buy their unrelated merchandise, so you know there'll be stuff to steal here".

I cannot think of a better advertisement to criminals.

I was just wondering why apple market share is so relatively high in USA. I think it may be cus apple stuff is aimed at people with 2 qualities.. 1. Has money to burn. 2. Doesn't know anything about computers or technology. USA has a really bad gini index and education system so I suppose there is a high proportion of people there who fit both criteria.

I think you've nailed it.

In the early iPhone era, US phones were usually subsidized/financed by mobile phone carriers, e.g. an expensive iPhone could be heavily discounted or "included" in a 2-year contract, with the carrier looking at the lifetime value of the customer's data subscription. This was less common in Europe and elsewhere, where customers were more likely to purchase their phone separately. If anyone was burning money, it was US carriers, rather than US mobile phone users.

It looks like every other brushed metal lock on the outside.

A MacBook looks to me like every other brushed metal laptop on the outside.

Therefore I shall assume nobody else can tell the difference.

I’d wager your chances of a break in via lock picking are higher than 8% if the lock on your house is vulnerable to raking.

Anyone know if the cylinder in this lock can be upgraded? It's a nice piece of hardware aside from this vulnerability.

LPL said yes. This, too, should have been Level's response.

Wow. Even being cynical, they could have just announced an upgrade cylinder at a huge markup and that would have been fine probably. What a bungled response.

That should not have been Level's response. "You can buy part of a lock for $330, and maybe know you need to replace part of it to work" is very different from "here's a smartlock"

The bolt is hollow too, that's where the battery is.

I guess use an Energizer e2 titanium battery? /s

Oh this again. The idiots at the WireCutter already covered this and they think it's just fine.

Mass market smart locks are a dumpster fire and they have the full support of the mass media. The #1 Wirecutter smart lock pick has this exact same flaw - a shitty cylinder that is prone to trivial bumping and that could easily be improved - the cheapest big box deadbolts have better cylinders. Someone had commented on that article (since removed) about this flaw - and the moron behind the Wirecutter smart section has just gone on and on about how this isn't a real problem, bla, bla - even had the audacity to post of a video of I'm guessing him demonstrating a poor raking attempt on one of these crappy locks to "prove" how "easy" locks are to pick - yes you dumbass, if you only use shitty locks with no protection.

He followed up with the gem that "the point of the lock picking lawyer is to show that any lock can be picked" - Again, no, idiot - the LPL does a tremendous amount of education to expose trivial weaknesses in particular products that can and should be addressed - he often points out when products provide a reasonable level of security for the price. The Level lock and the Ultraloq (the NYT top pick), do not. Fuck Wirecutter and the New York Times, enjoy your referral money you dishonest pricks. (U-Tecs customer service is also shit tier, something they even admit in their own review)

https://www.nytimes.com/wirecutter/blog/picking-smart-deadbo... The premise of this article seems to be - there are some high priced smart locks (that we promote) that are easy to bump open, therefore all locks are easy to bump, and you shouldn't factor pick resistance into buying decision at all. And also: raking and bumping is in the same class of difficulty as pin picking (this difference has been explained to them - this is not for lack of information).

https://www.nytimes.com/wirecutter/reviews/the-best-smart-lo...

Actually is that the Level lock they demonstrate on back in October? Notice that isn't a Schlage - I'd like to see him try that.

Another thing they keep bringing up this ANSI Grade 1 nonsense - I have looked - I cannot find any evidence of 3rd party certification for their top pick. It's all bullshit.

https://buildershardware.com/Certification-Program/Certified...

You have to keep in mind that any of these "review" websites are in it to maximize their revenue with referrals. They will spout whatever it takes to get you to click on the links that get them the largest kickbacks. They certainly aren't going to come out and say, "All smart locks are terrible, don't buy one."

Wirecutter definitely has written articles saying they don't recommend anything in a category in the past. That's the reason people trust them!

Clearly their product team never watched a Deviant Ollam talk.

This site should be blacklisted from HN.

What I noticed in the 10 seconds of opening the article is that it jacked the back button and is peppered with SEO manipulation links.

Back button worked normally on iOS Safari.

Is there a list of sites banned by HN, along with their selection criteria?

Maybe the reason most attackers don't use lockpicking to enter a home is because usually they lock is difficult enough to make other methods of entry easier.

They’re lately begging for their customers to get broken in.

Lame excuse and doesn’t even mention the flimsy bolt.

Apple should remove them and sell bolt instead or something

There is only one other HomeKey-compatible lock on the market in the US, the Schlage Encode Plus.

It is the same price, not nearly as attractive, and is regularly sold out for months at a time.

But Schlage locks require at least some skill to pick.

As the cliche goes: locks only keep the honest people out

Aren't there only one or two locks that picker has never easily opened? Bowley?

LPL is good no doubt about that, but as mentioned multiple times in here this particular lock needed no skill to defeat, and the fix for this is wildly simple and cheap on the manufacturing side.

It opened with bumping and also with raking. Those require zero skill, and open the lock in seconds.

It really wasn’t picked at all.

This is like step #2 in making a good lock after “require a key”.

Erm, a battery inside can be blown up? Heat it, pin it, strike it, there are too many ways to literally blow-up this lock

I would not be surprised if they simply used some off the shelf example cad model of a lock when starting this business

Where might I find out what locks are good?

Check the videos from the LockPickingLawyer. That will take a long (if entertaining) time, though. It would be great if someone compiled a list of locks that LPL & friends recommend; I'm not aware of one.

I remember watching a few videos where He's done comparisons as well.

Assa Abloy and Bowley stand up if that's all you care about. But he also shows that you can replace the lock cylinder, or take apart the lock and put your own pins in it, so in a way it's not important.

LPL hasn't recommended this lock, but the Kaba Mas X-10 [1] has no known successful pick, but they're not normally available to anyone outside US Federal Government agencies and their specifically-authorized contractors. Only a little over a million units out there, so it is difficult to assess just how secure it is as it isn't open to any and everyone who wants to attempt a pick. But there aren't any even credible rumors of a pick. It's not even a mechanical lock, and it isn't anywhere in the same universe as the crappy electronic locks that are out there in the retail market.

At a less esoteric more commercially accessible scale, while picked the pick is not published yet, and deploying in the wild currently takes an infeasibly long time (about an hour by the inventor of the pick): the Assa Abloy Protec 2 [2]. Unless you're trying to lock away national security secrets, it is quite sufficient to deter the common lockpicking burglars out there around the world.

[1] https://www.kabamas.com/x-10-high-security-lock/

[2] https://www.reddit.com/r/lockpicking/comments/amjumx/abloy_p...

Haha it's not a bug, it's a _feature_

They need to hire the lock-picking lawyer as a consultant.

Why when they can use denial, cognitive dissonance, and red herrings?

It can even be opened with the newest apple product: the iRake

(sold separately for only $29.99)

99% of locks used for $600 bikes or to store your wallet in the gym locker room can be picked by the LPL in seconds. Hell your apartment door lock, securing everything you own, can probably be picked by him. This doesn't make it extraordinarily vulnerable, only that the LPL is very good at what he does.

It's not his ability to pick, it's the cost of the lock vs the security you get.

I would expect this kind of security from a $20 lock, and that's totally normal. For $330 you should get something better.

I would expect better security against raking from a $20 lock.

Raking does not require being an expert to perform.

No - this was not picked, it was raked. Watch the video. The difference is that raking the pins takes almost no skill. LPL also demonstrates an easy bump attack which also takes almost no skill.

Bump/rake resistance is different than pick resistance and it is inexcusable to not have at this price point.

I think everyone is missing point on this. This is actually a feature! Loose your key? Loose your iphone? Loose your Apple Watch? No worries just ask your friendly neighborhood door to door sales person to open your door for you!

You will literally never be locked out again! /s

Jokes aside it is pretty shameful to sell a poorly made product, and then justify it by saying that it’s still safer then leaving your door unlocked. $330.

Would you drop $3k on a macbook pro, take it out and use it in the dirt and rain, and then be shocked that it didn't hold up as well as some generic $500 laptop?

Would you drop $80k on a new sedan and then be shocked that its boot capacity is the same as a $20k sedan?

$200 at a fine dining restaurant and it fills you up as well as a $10 one?

No. These things are luxuries sure but it's understood that it extends in a certain way. You buy the expensive macbook if you want to use it like normal in a home or office but have a nicer screen, touchpad, etc. You buy the expensive ruggedised laptop if you need to use it out in the field. You buy a van, trailer, ute, whatever if you need a lot of hauling capability. You buy groceries if you want to feed yourself for a month not one expensive meal.

Probably you think I'm being a jackass by comparing thinking this lock should be more secure than a generic lock but I genuinely cant see a difference. It's as obvious to me that you're paying a premium for the convenience aspects of this lock rather than security as it is that you're paying for a nice screen on a macbook not ability to withstand harsh conditions. It being on the Apple store gives me no indication that it's more secure than the average lock, nor does their marketing.

So I'm genuinely curious. What is it about this situation that makes you people who think this is a lame response, hilarious, a grift, etc see it differently from the above? Why would you not just expect it to be better in an entirely different dimension than it's marketing itself, but expect it so much so that this is being viewed as some sort of embarrassing scam?

Customers can easily measure the convenience aspect. Your comparisons (let’s say, a high res monitor or powerful engine) have specs consumers can objectively if not easily qualify. With a lock design, security is its raison d’etre. You assume by the time they’re marking the price up hundreds or thousands of percent for secondary features, that they’ve covered the primary one. And unlike say, a 1080p vs 4k display, you kind of have to trust that they did because we don’t have consumer friendly scales for lock design integrity.

You could compare this lock to a good one with a car analogy if it would have taken 2% more cost to turn a Civic into a Mercedes but Honda chose not to. The cost to make this lock reasonably secure isn’t really an issue.

You may have forgotten that the purpose of a lock is not to be opened in many useful ways, but actually to remain closed when you want it.

It doesn't include even the most basic of security features. It even lacks security pins which have become standard in all but the cheapest locks. The security this thing provides may make it adequate for securing a wardrobe, but it is in no way appropriate for securing a front door or even a room.

This thing can be opened in 10 minutes by a 10 year old with no experience in lock picking. Level should be sued. This product is not fit for the purpose it is being sold.

The problem is your comparisons are off.

It's like the $3k MacBook pro has worse performance than the $500 generic, the $20k car is a better drive, or the $10 meal is better food than the fine dining.

Sure, the aesthetic and convenience qualities of the expensive versions are better, but basic functionality of a high-end product has to be at least comparable to the mid-range, and definitely has to be better then the low-end.

Reply on news.ycombinator.com