4 ms·

Utterly horrifying, but ultimately irrelevant. No lock of this size is meant to be anything other than inconvenient to open. Angle grinders are cheap, and more

Utterly horrifying, but ultimately irrelevant. No lock of this size is meant to be anything other than inconvenient to open. Angle grinders are cheap, and more easily wielded than HTTP request crafting.

raesene9 8y ago
however there are cases where an attacker doesn't want to arouse suspicion, and Angle grinders are kind of noticable. This would allow for an attack where the lock appears to be operating successfully, but someone has unauthorised access.
- thomasfedb 8y ago
  For this reason the scariest bit is the ability to access account information via their online systems - sounds like a map of locks that aren't locks.
  - imtringued 8y ago
    Why the hell do they store the location data of the locks. Are they secretly selling the location and unlock access to governments?
dirktheman 8y ago
Also, with a simple padlock you know that it can be cut open pretty easily. So you're aware of the risks and the basic level of security it offers. This "smart" padlock offers nowhere near the basic level of security you expect so you can't make a proper risk assessment. We had a similar thing a couple of years ago with bicycle locks (I'm Dutch). AXA, a well known manufacturer of locks offered a range of very sturdy bicycle locks. Hardened steel, almost impossible to crack open unless you spend some time with a big, noisy angle grinder. A lot of these locks were mandated by insurance companies, so they must be good, right? Wrong. A lot of these locks could be opened in seconds with just a blank (uncut) key. Which you could buy in bulk and not very hard to get hold of...
user5454 8y ago
The issue isn't that you could break most any padlock using heavy duty tools, the issue is that you can break any Tapplock without arousing suspicion. Consider using it for your gym-locker. The changing room is typically occupied by at least some people whenever the gym is open so if someone is pulling out a bolt-cutter or an angle grinder it would probably lead to someone notifying the gym-employees/police. Meanwhile someone who just walks up to the lock and seemingly opens it must be legit and goes unnoticed.
function_seven 8y ago
Compare this to a decent padlock (with key). If someone wants to get past my low-tech padlock, it will be inconvenient. They will have to spend some amount of time with either an angle grinder, bolt cutters, or lock picking tools. What they’re doing will be suspicious and will likely draw attention. If they’re caught during the trip to or away from my lock, the possession of any of these tools will be suspicious. With this lock, all those weaknesses are the same. Expect now the lock-pick tools are replaced with an app, and there's nothing wonky at all about someone walking up to the lock, tapping on their phone, and removing it. If they're caught en route to or away from the location, they have nothing on them to incriminate. This lock is strictly worse than a standard padlock, when it comes to security. All the flaws plus new ones.

raesene9 8y ago

however there are cases where an attacker doesn't want to arouse suspicion, and Angle grinders are kind of noticable. This would allow for an attack where the lock appears to be operating successfully, but someone has unauthorised access.

thomasfedb 8y ago
For this reason the scariest bit is the ability to access account information via their online systems - sounds like a map of locks that aren't locks.
- imtringued 8y ago
  Why the hell do they store the location data of the locks. Are they secretly selling the location and unlock access to governments?

dirktheman 8y ago

Also, with a simple padlock you know that it can be cut open pretty easily. So you're aware of the risks and the basic level of security it offers. This "smart" padlock offers nowhere near the basic level of security you expect so you can't make a proper risk assessment. We had a similar thing a couple of years ago with bicycle locks (I'm Dutch). AXA, a well known manufacturer of locks offered a range of very sturdy bicycle locks. Hardened steel, almost impossible to crack open unless you spend some time with a big, noisy angle grinder. A lot of these locks were mandated by insurance companies, so they must be good, right? Wrong. A lot of these locks could be opened in seconds with just a blank (uncut) key. Which you could buy in bulk and not very hard to get hold of...

user5454 8y ago

The issue isn't that you could break most any padlock using heavy duty tools, the issue is that you can break any Tapplock without arousing suspicion. Consider using it for your gym-locker. The changing room is typically occupied by at least some people whenever the gym is open so if someone is pulling out a bolt-cutter or an angle grinder it would probably lead to someone notifying the gym-employees/police. Meanwhile someone who just walks up to the lock and seemingly opens it must be legit and goes unnoticed.

function_seven 8y ago

Compare this to a decent padlock (with key). If someone wants to get past my low-tech padlock, it will be inconvenient. They will have to spend some amount of time with either an angle grinder, bolt cutters, or lock picking tools. What they’re doing will be suspicious and will likely draw attention. If they’re caught during the trip to or away from my lock, the possession of any of these tools will be suspicious. With this lock, all those weaknesses are the same. Expect now the lock-pick tools are replaced with an app, and there's nothing wonky at all about someone walking up to the lock, tapping on their phone, and removing it. If they're caught en route to or away from the location, they have nothing on them to incriminate. This lock is strictly worse than a standard padlock, when it comes to security. All the flaws plus new ones.