Hacker News Reader

Comment by elmerfud | Hacker News Reader

A fairly lame response from Level considering the price tag of this lock. My guess is they simply outsourced making this to cheapest vendor they cut find and never talked to a engineer familiar with actual locks. The inclusion of various security pins would have defeated these simple attacks and not really increased their cost.

Having your lock defeated by the LPL is just normal as he's an expert at doing in. Many skilled locksmiths cannot open locks he able to do. Not guarding against raking and bumping, that's shameful for an exterior door lock. Then doubling down on their failure, that's Baghdad Bob level of PR right there.

View on HN

Yes, I'd take this as Level arrogance.

For another data point, I never managed to pick locks in my twenties, but something aligned for me in an evening lock picking course in my sixties, and I picked everything in the room. One wants a training set of locks to learn on, one pin, two pins, three pins, ... then one learns easily. It also helps that with age one's brain quiets down. To pick a lock, you need to listen to it.

I asked the organizers, surely they had something that would stump me. They handed me an American padlock identical to one I'd been buying for years. It stumped me.

It took LPL more than one pass to pick a basic American. He made it look easy, still reassuring me there was some skill involved:

https://www.youtube.com/watch?v=oaP1nFZ9AXE

Videos by others describe more advanced American locks that took several months to overcome. American takes basic countermeasures, that Level could have easily adopted.

LPL opened it via raking. That alone means there are no security pins. A serrated pin and a couple spool pins isn't expensive and is standard for locks that aren't budget or master locks.

It doesn't necessarily mean there are no security pins. I can easily rake open a Master Lock 140D, despite those having spool pins.

Spool pins actually can make picking easier by providing you with more feedback about the pins vs normal pics. (A lockpicking friend explained this to me once)

I don't know about serrated pins though!

I have found that serrated pins are pretty easy to defeat by manipulating the torque you apply a little bit. I actually have a slightly harder time with spool pins although they do give you nice feedback about when they are set (and false set).

Having taught some lock picking classes...

I think the point is, almost anyone with 5 minutes to watch a video on basic techniques (or who is interested in spending 30 minutes just messing around with no prior knowledge) could probably pick this very expensive lock.

To do what you're describing, some people wouldn't get it, and for those that can do it (most, with some practice), it'll probably take 30 minutes to an hour of practice - or a day or so for the outliers.

It's a huge difference in difficulty between the two for a few cents in parts.

> I can easily rake open a Master Lock

For those who don't know, watch LPLs videos on this brand and you'll see what's level of security they offer (basically none)

The irony is that the best Master Lock in terms of picking resistance is a plastic LOTO lock that offers almost no protection against brute force attacks.

My thoughts exactly. Some minor changes could make it bump and rake resistant and only a tiny (if any) increase in price.

The cost difference is cents, so it's a wonder if the company is cheap or ignorant.

Seems like both.

Originally arrogant or ignorant t, I'd say, and now damage control for their stock already out in the wild.

I would reckon they would change it for a v2 but they need to recoup costs first, but I could be wrong.

Absolutely arrogant. Either they're producing a lock without doing the least bit of research to uncover the easiest, most basic attacks, or they know about them and don't care.

For the price point it's all embarrassing. I purchased Avocet locks after I saw they gave LPL trouble and a set for my entire house didn't cost as much as this horrible, shitty thing would. This is literally a scam product.

Not to defend this product, but what’s the threat model for a pick resistant lock? I assume, but don’t actually know, that my biggest risk is having my rear door window smashed and the door opened from inside while I am not home.

Lock picking (even raking or bumping) seems like the kind of thing that someone smart enough to figure out how to do is also smart enough not to engage in home burglary.

So unless your threat model is the three letter agencies entering and bugging your house, I assume other physical security upgrades should come first.

I think the idea is if the lock makers won't bother protecting from simple attacks, what else have they skimped out on? It's not like the pick-resistant locks are exceptionally more expensive.

Thats what Im thinking too, it shows carelessness and unprofessionalism from the lock makers. And the high pricepoint is justified even less.

House insurance will cover the robbery if they break the back window to get in. It might be more difficult to file a claim if they rake the lock and don’t leave any trace beyond your missing valuables.

There's an interesting DEFCON presentation on lock picking forensics[1]. I don't know if there's any certified agency that can do a forensics report which an insurance company would accept, but if there is such a thing, most (all?) lock picking techniques leave marks.

[1] https://www.youtube.com/watch?v=AVZzBjK1kmI

this is a very important point

If the lock is picked, the burglary may go unnoticed for a long time. With a broken window, you'll find out quickly.

What sort of hokey black hat nonsense is this?

You can pick a lock, steal things a lot of people wouldn’t notice for a very long time and leave like nothing happened. There would be no call to the police, no threat of window alarms etc. easiest way to get away Scott free.

so this lock plus a hidden camera solves the issue?

If you review it everyday it might. I know I would never look at the recording.

There are surveillance products that offer motion detection as a feature.

You get notified if unusual movement within your property is detected rather than you having to do the boring task of reviewing surveillance footage.

If someone cases your house, they'd still pick targets based on ease and value.

If they canvas your house and see a shitty, easily bumped lock, you are now an easier target and they're more likely to break in.

I reckon opportunistic break ins it wouldn't make a big difference whether it's this lock or a better one though.

Lock picking as others have pointed out is not the most common method of entry. But if you see one lock that is really hard to pick due to good engineering, they probably also spent effort to make it resist other kinds of attacks like kicking the door, etc.

Firstly, locks should be immune to raking. If I can enter your property with a piece of metal in 20 seconds and with no training, the lock manufacturer fucked up. That's casual and you want to deter casual opportunists.

So, other than picking, there's a bunch. There's snapping the cylinder, which is common in the UK and only takes pliers, there's using a crowbar against the door to move the frame out of the way around the latch, breaking windows, and more.

My threat model doesn't include pickers, for sure, but I'm particularly angry about this product because it's visually distinctive and famous, so unlike a regular lock which is basically a roll of the dice as to its quality, this quietly screams for attention and that's a problem. Thieves do canvas houses looking for targets.

Think of it in context. A passer-by seeing someone smash a window will 100% call the police. Glass shattering makes quite a bit of noise as well and leaves behind a clearly broken window.

Meanwhile, lockpicking has a chance of looking no different from the rightful owner using a key, especially at a distance, is relatively quiet, and leaves basically no trace.

Threat model: stealing a “something you have” credential from your house and then using it before you can become aware of it to then remotely deactivate / decommission / rotate said credential.

> So unless your threat model is the three letter agencies entering and bugging your house

The three letter agencies will have no problems gaining access to a house via picking a lock.

Their ability to access without detection extends beyond that.

On top of that, let’s be honest, if they want to bug someone, they will just access the mic on their phone, Alexa device, smart tv, etc.

I've been told they've had internal discussions around having LPL test their products, but they never went anywhere. Level was pretty dismissive when I brought it up as a suggestion in one of their many recruiting attempts.

The worst part about their response is they're basically admitting that any $10 lock would be roughly as effective and the $330 price tag is for unlocking via the app.

> any $10 lock would be roughly as effective

No, $10 lock would not be as effective as $330 lock in displaying someone's vanity and Apple cult membership.

Interestingly, one of the big selling points for Level is that it looks virtually identical to a normal lock unless you look closely and know what to look for.

A $10 lock would be better; because at least then it would have a solid locking bolt.

I wonder if Schlag's Encode Plus, which is designed to work with Apple Home Key as well, is also at all vulnerable. Schlage seems to have a fine record[0] but you never know what corners might be cut to get a product like this to market. https://www.schlage.com/en/home/smart-locks/encode-plus.html

0: video https://youtu.be/WpbKOL1cM34

There are issues with the physical lock, nothing to do with the electronics. So it's likely a real lock company like Schlage should be more resilient.

There are multiple videos where LockPickingLawyer opens electronic locks from various companies using a simple magnet.

Even "real lock companies" are not immune from selling shiny gadgetry with misleading marketing

I’m a very low skilled picker, but I did try racking and bumping my Encode Plus before installing it and didn’t get it open.

That said, I do intend to re-core and re-key it someday.

I was curious what 4% of the homes in the US is. 5.6 Million. Pretty wild. I would not trust my front door to these people. It's silly simple to make a presence system for your house. Assuredly cheaper than the price of this lock.

4% of broken into homes use lock picking.

I know they framed the statistic as “only 4%” but that’s higher than I would have guessed, given that modern locks (should) have anti-picking security features. If we could calculate the fraction of break-ins by the picking where the lock was vulnerable to raking or bumping, we should expect it to be higher.

The way I am reading the link, it was 4% of all 3.7 million household burglaries or 148,000 subject to raking.

Regardless, if someone is intent on breaking into a house, I doubt a locked door is going to do anything. Not only are windows abundant, but even exterior doors seem to have gotten cheaper and thinner than days of yore.

Ah, you're right

I love how their response to "your lock is bad" is "you don't really need a good one". I guess that's supposed to convince me that spending over $300 on a lock is what I need.

You can use it with most any lock set. You’re paying for the bolt, not the lock.

for the price it should be perfect.

At that price, I would hope I was paying for both.

Meaning you can change out the mechanism that is easy to pick, but keep the smarts and motor?

That’s correct, they sell (sold?) a model hitch doesn’t even include the lockset.

The bolt itself is hollow and contains the battery. So… a fail there as well.

On the plus side - if someone tries to kick it in hard enough to damage it, free pyrotechnic alarm!

There would have been engineering cost to designing a better lock. Also, that's not their product concept. These are not locks for people who care about security, they are for people who care about iphone ecosystem synergy.

If you look at it a certain way, this isn't really a defect: when this lock gets bricked by a firmware update or recruited into a botnet, you won't be trapped on your porch for too long before your neighbor's kid can let you in.

But also, full agree on "our goal is to be better than an open window." I hope they don't extend a job offer to that marketing intern.

No, better locks are already invented and will fit that standardised barrel just fine. This is either someone minmaxing the BOM or just not knowing much about what they were specifying.

Yes, this is more accurate. They would need to spend fractionally more on the tumbler, which I really think they have no incentive to do because the target customer will not know or care about the physical security upgrade.

The incentive is not being ridiculed and belittled and being taken through the media circuit for a minor loss in profit margin?

But then again, all press is good press

> There would have been engineering cost to designing a better lock.

And a reputation cost for not.

And a marketing benefit from the controversy.

And the opposite. I had seen this and was waiting to buy one when brass is available. Now I’m going to pass. If they can’t take very basic measures then I don’t want it as a product. It tells me a lot about their process.

Level is an existing smart lock manufacturer and has several non-Apple-specific models which are on the market. I would assume they didn't go find a cylinder with zero pick resistance just for their newest and most expensive model.

The presence of an Apple specific model at a higher cost (adding NFC for HomeKey entry, which works even if your phone/watch battery is dead) caused it to get pushed onto the LPL's radar.

> There would have been engineering cost to designing a better lock.

Putting security pins in there wouldn't have involved any engineering at all.

Reply on news.ycombinator.com