Let's Code About Bike Locks

https://www.google.com/patents/US6621405

The patent goes into detail - and is actually super easy/enjoyable to read - but the goal was to have a letter lock that maximized the number of real words that could be spelled from the available letters provided on the dial rings. So, a wordlist is generated under some parameters (such as word length) and then the rings are generated from that word list.

It's basically exactly what the author is doing, but in reverse.

The goal of the word lock was to increase the available keyspace of real words in a letter lock, thus increasing the security of those users who will buy a letter lock regardless. They do a number of other things right mechanically as well. Whether or not a bike lock is the best medium, I wouldn't say, but wordlock silently improved the security of a specific user base that greatly prefer convenience to security. That's awesome.

What? It's exactly as secure; there are four dials with ten symbols. Wait, of course, Norving means dictionary words. Well, don't constrain yourself to dictionary words! You wouldn't use a dictionary word for your gmail account, right? Configure the lock for some arbitrary four-letter combination.

(There is still value in that over a lock with digits embossed on its dials, because some people can memorize a four letter combination which isn't a word more easily than four random digits.)

Here is another thing: you can configure a WordLock such that your chosen key word is something meaningful, but must be assembled in a row other than the "home row" to open the lock. That improves the security somewhat in the situation when you stick to code which is a word (as defined by Norvig). You have one more secret: the offset of your word.

If your offset keyword is such that gibberish occurs in the home row, then a naive search of meaningful words on the home row will not open the lock, so there is a "security through obscurity" element at play here too against (non-wirecutting) brute force attackers who don't know about this trick.

You might as well then memorize that home row gibberish, and use the original offset word as only a mnemonic to recover the gibberish if you forget: you can assemble the original word, and then rotate the dials in parallel until the lock opens.

My first thought was "impossible!" and I tried to disprove it. I set it to a long password and tried to unlock it by, say, doing all but the last stroke assuming it was just dropping the strokes after a point. No luck. Same for dropping the first stroke. Etc. But sure this mechanical system has a small finite number of possible sufficiently distinct states and so would only be able to use small password lengths?

Of course! But it's apparently being much smarter about it than I had anticipated: sure, my long password can (presumably) be opened by a shorter password. But that shorter password is apparently unrelated to the long one. They must be taking a mechanical hash of the password!

Here's the lock: http://www.masterlock.com/personal-use/product/1500iD But I wouldn't recommend buying one. They were too bulky and got stuck in the locker at my gym and had to be cut off.

With the last part about "FRED BUNS", doesn't feel a bit like he's committing a variant of the Texas Sharpshooter fallacy[1]? (That's the old saw about the Texan who takes a bunch of shots at a barn, then walks up and paints a target to encircle them.)

While the chances of "FRED BUNS" may be slim, the chances of /some/ pair of words being present in adjacent lines is much better. How much better? Uh, I'll let you know once I'm not on my phone and not lazy...

[1] https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy

And yet, I spot such a word in many of the high-scoring combinations (hint: it appears near the word 'CUTE')

It would not surprise me if the makers of these locks had a list of forbidden words.