4 ms·

No lock keeps out a determined attacker. I bet fewer people could carry out this attack than people who can pick a normal lock.

senectus1 6y ago
Locks are really only there to ward off honest people.
- DangitBobby 6y ago
  This sentiment is expressed in the second sentence of the linked article.
  - falcolas 6y ago
    They’re also used as evidence of wrongdoing; if a lock is defeated without a sign of tampering, sometimes police and insurance companies are not inclined to think there was a crime.
  - closetohome 6y ago
    The article then goes on to completely miss the point of that statement.
    - DangitBobby 6y ago
      Be that as it may, I interpreted the plain statement as an attempted refutation of the contents of the article. The author of the article directly mentions the sentiment, which I take as an indicator that they believe it will be adequately addressed. So I believe that a claim to the contrary must include an explaination of why they believe the author did not address this point, rather than just reiterating it as though it were a new or novel idea in the discussion. As it stands, without acknowledging that the author already expressed this same sentiment, I have to conclude that GP did not read it.
kevin_nisbet 6y ago
That may be true today while the vast majority of locks are normal locks. But it seems reasonable that would change if the vast majority of locks were IOT locks. What's difficult to know, is if there were large market of IOT locks, and much more scrutiny on the companies manufacturing IOT security products, whether that would lead to a reduction in unsophisticated attacks against the products. As of today, it seems many digital locks are just as bad or worse at physical security than traditional locks, and the IOT connectivity opens up new avenues of attack.
mjg59 6y ago
Finding IoT vulnerabilities generally requires some degree of skill. Turning that into a pre-packaged tool that anyone with a computer can use is not much harder.
- macintux 6y ago
  And once packaged, those vulnerabilities are going to be faster to exploit than a physical lock could be picked by anyone not an expert. Or, heck, just unlock all the doors and see what chaos happens. Try that with physical locks.
nullc 6y ago
There is a big difference between attacks usually that leave signs of tampering and attacks that leave no evidence. Picking normal locks leave easily discovered evidence. I once even detected a lock at my office had been picked when I put my key in the next morning and noticed it felt different! (I learned it had, in fact, been picked-- because after that happened I asked on the company chat and one of our security people responded that he'd picked it the night before for reasons)
- RHSeeger 6y ago
  I'm curious about the specifics. From my experience, picking a normal lock works very much the same as using a key; you're just relying on the fact that the inside of the lock is the same "shape" as the key to put the tumblers in the correct location.
  - nullc 6y ago
    Normal lockpicking technique has you put tension on the lock so that (ideally) one pin is under sheer and the rest are free. You use your tool to push the binding one to the position allows the cylinder to turn slightly then move to the next. So this usually leaves marks on the pins than you can see if you take the lock apart. Usually while picking you'll also scratch up the pins and keyway in a way that a key won't. You can also end up with the pins a bit cockeyed. You can also turn it in directions that it can't turn with the key in it, and on some cylinders you can turn it the wrong way and have all the pins fall out! You in many locks you can also end up with it 'locked open' where you have to pick it again to be able to get a key into it. I think in the incident I mentioned the cylinder was left in slightly askew which made it feel odd to insert the key. I'm not sure if someone who hadn't picked a lock before would have recognized something was unusual just from the feel.
    - SAI_Peregrinus 6y ago
      If you know what you're doing when picking you shouldn't be leaving externally visible marks for most locks (though heavy tension with a loose bottom-of-the-keyway or improperly-sized top-of-the-keyway tension tool will mark the lock). And it's pretty easy to re-lock the lock afterwards to be identical to a lock that's never been picked. Of course you can take a lock apart and examine the pins & chambers for signs of picking, but that is a bit extreme if you don't suspect it. So while it is possible to leave external signs of picking, it's not necessary, and often indicates something went wrong with picking.

senectus1 6y ago

Locks are really only there to ward off honest people.

DangitBobby 6y ago
This sentiment is expressed in the second sentence of the linked article.
- falcolas 6y ago
  They’re also used as evidence of wrongdoing; if a lock is defeated without a sign of tampering, sometimes police and insurance companies are not inclined to think there was a crime.
- closetohome 6y ago
  The article then goes on to completely miss the point of that statement.
  - DangitBobby 6y ago
    Be that as it may, I interpreted the plain statement as an attempted refutation of the contents of the article. The author of the article directly mentions the sentiment, which I take as an indicator that they believe it will be adequately addressed. So I believe that a claim to the contrary must include an explaination of why they believe the author did not address this point, rather than just reiterating it as though it were a new or novel idea in the discussion. As it stands, without acknowledging that the author already expressed this same sentiment, I have to conclude that GP did not read it.

kevin_nisbet 6y ago

That may be true today while the vast majority of locks are normal locks. But it seems reasonable that would change if the vast majority of locks were IOT locks. What's difficult to know, is if there were large market of IOT locks, and much more scrutiny on the companies manufacturing IOT security products, whether that would lead to a reduction in unsophisticated attacks against the products. As of today, it seems many digital locks are just as bad or worse at physical security than traditional locks, and the IOT connectivity opens up new avenues of attack.

mjg59 6y ago

Finding IoT vulnerabilities generally requires some degree of skill. Turning that into a pre-packaged tool that anyone with a computer can use is not much harder.

macintux 6y ago
And once packaged, those vulnerabilities are going to be faster to exploit than a physical lock could be picked by anyone not an expert. Or, heck, just unlock all the doors and see what chaos happens. Try that with physical locks.

nullc 6y ago

There is a big difference between attacks usually that leave signs of tampering and attacks that leave no evidence. Picking normal locks leave easily discovered evidence. I once even detected a lock at my office had been picked when I put my key in the next morning and noticed it felt different! (I learned it had, in fact, been picked-- because after that happened I asked on the company chat and one of our security people responded that he'd picked it the night before for reasons)

RHSeeger 6y ago
I'm curious about the specifics. From my experience, picking a normal lock works very much the same as using a key; you're just relying on the fact that the inside of the lock is the same "shape" as the key to put the tumblers in the correct location.
- nullc 6y ago
  Normal lockpicking technique has you put tension on the lock so that (ideally) one pin is under sheer and the rest are free. You use your tool to push the binding one to the position allows the cylinder to turn slightly then move to the next. So this usually leaves marks on the pins than you can see if you take the lock apart. Usually while picking you'll also scratch up the pins and keyway in a way that a key won't. You can also end up with the pins a bit cockeyed. You can also turn it in directions that it can't turn with the key in it, and on some cylinders you can turn it the wrong way and have all the pins fall out! You in many locks you can also end up with it 'locked open' where you have to pick it again to be able to get a key into it. I think in the incident I mentioned the cylinder was left in slightly askew which made it feel odd to insert the key. I'm not sure if someone who hadn't picked a lock before would have recognized something was unusual just from the feel.
  - SAI_Peregrinus 6y ago
    If you know what you're doing when picking you shouldn't be leaving externally visible marks for most locks (though heavy tension with a loose bottom-of-the-keyway or improperly-sized top-of-the-keyway tension tool will mark the lock). And it's pretty easy to re-lock the lock afterwards to be identical to a lock that's never been picked. Of course you can take a lock apart and examine the pins & chambers for signs of picking, but that is a bit extreme if you don't suspect it. So while it is possible to leave external signs of picking, it's not necessary, and often indicates something went wrong with picking.