Hacker News Reader

Comment by valarauca1 | Hacker News Reader

Changes to the keying of the key's shaft has little to do with how bumpable it is. If its still using the same internal mechanism.

What I'm saying is, if you lock the case to your desktop shut. Dumping your unencrypted hard drive is still possible, and easy. And fundamentally completely unchanged. All you did was put a hurdle in front of it, not fundamentally change the attack vector.

View on HN

So tell me how one would have bumped an Ikon SK6 in the past.

EZ Entrie machines[0], first of all, as they've been around for a decade or so and are purpose built to mill one-off high security blanks out of brass, so they're significantly more effective than their plastic counterparts. They are admittedly expensive, but when I briefly had access to one the gentleman running it was cutting me fresh blanks for a Euro a piece. They also have rather jaunty bows with smiley faces inscribed in them.

Additionally, people have been bumping things with just about anything that can fit into a keyway, it doesn't particularly matter if it conforms to the exact shape of the key, so long as it can still interact with the pins directly. So, bent sheet metal with teeth cut into them, flexible grocery loyalty cards, etc. have all been used by folks in the locksport community to bump locks they didn't have proper blanks for. I can't deny the SK6 (and many Ikon locks, they are vicious) didn't have a particularly murderous keyway, but the possibility of carrying out a percussive attack wasn't nil.

[0] http://www.qtactical.com/easy-entrie-key-machine/

I think you might be missing the point. No one is saying it was impossible. The whole point is that access, cost, and effort have gone WAY down with the advent of 3D printing. Your comment just drives this home - before you needed an expensive machine and a skilled operator, or a ton of time and skill to fashion one. Now you can just pick one up off the internet for $5.

A: He implies it was previously impossible in the article with this line:

"As a result, all anyone needs to open many locks previously considered “unbumpable” ..."

B: He asked someone to tell him how it could have been bumped prior to this application.

C: I described, in my scenario, the purchase of a 1 Euro blank from someone who runs the machine, which is actually /less/ than the Shapeways scenario, which is otherwise the same - you don't purchase the equipment, you purchase the product the equipment makes.

How much does that Easy Entrie machine cost? I'm seeing something like $10,000. A 3D-printed bump key ordered from Shapeways costs $5, and surely works better for obscure keyways than the ad hoc stuff you're describing.

You literally asked someone to describe how they would have bumped it previously and I gave you a reasonable answer that included a scenario in which you haven't purchased the machine, but instead purchased a blank cut by the machine for LESS than what Shapeways are charging for your key.

Not to mention that you seem to be ignoring the second paragraph entirely.

And, honestly, this seems like a silly argument to be having. I actually think the boys did great work on this, and I really appreciate that you mention the possibility of forensic evidence (in the practice of which Germany is a leader) left by these keys. I just think that some people commenting on this thread are a bit frustrated by some of the hyperbole, and your insistence that there is no hyperbole is continuing to derail whatever point you are attempting to make.

To address your points: I'm not sure where to find someone with this expensive machine. I know where to find Shapeways.com pretty easily. And as I wrote above regarding your second paragraph, a precisely-printed key surely is more reliable (and easier to make) than the bent sheet metal and grocery loyalty cards.

I agree this argument is silly. Whether an Ikon SK6 lock is considered "umbumpable" and by who is pretty subjective. But this thread began with a commenter saying that none of this is news, and that it's all 50 years old. Hyperbole is indeed pretty annoying.

Hah, that's an absolutely fair point. I agree completely that this is news and certainly don't appreciate it being disregarded out of hand. We are, perhaps, in some sort of heated agreement at the end of the day :)

Reply on news.ycombinator.com