12 ms·
Threat modelling case study: bicycles
- brudgers 6y agorecent comments, https://news.ycombinator.com/item?id=24340190 https://news.ycombinator.com/item?id=24340190
- Gys 6y agoI am very impressed by this electric bike that optionally comes with a theft insurance that will simply return your bike or otherwise replaces it: https://www.vanmoof.com/en-US/peace-of-mind https://www.vanmoof.com/en-US/peace-of-mind (not affiliated)
- closeparen 6y agoI would expect the justice system in SF to come down hard on those bike hunters. Wonder how they get away with it.
- Drdrdrq 6y agoCurious - is there something illegal in the way the system works?
- Rebelgecko 6y agoI would imagine there would be similar pitfalls to what you see in places with legalized bounty hunting
- floren 6y agoThat would be about appropriate for SF: ignore the bike thieves, go after the guys going after the bike thieves.
- ornornor 6y agoWhy? They’re doing the work the police won’t bother to do.
- ggm 6y agoI don't usually support the death penalty, but for persisting bicycle thieves, I do wonder if, like street-mimes, the pit of snakes is the best option?
- LargoLasskhyfv 6y agoI seem to recall that in former times caught horse thieves in the plains and the "wild west" were quickly hanged. Understandable, as the owners usually depended on them for their livelihood.
- twic 6y agoI built my bike (as in assembled it - i didn't build the frame or the wheels). It cost something like £2000, or would have cost about that if i'd bought it ready-made. I chose all the parts to fit my needs as closely as possible - nice frame, nice but off-brand wheels, cheap bottom bracket because that's all you need, handlebar and stem reused from an old bike, decent headset, wide gear ratio, etc. Because it's built from a random assortment of parts, all of which are now filthy and scratched, it looks horrific. I do lock it carefully, but i don't worry about it. Nigel the junkie won't get through the lock. Nor will Rupert, and he won't see anything he can sell on (except maybe the saddle). Percy knows perfectly well it's not worth his time. Having said that, of course, it will get nicked next week.
- strogonoff 6y agoAny resources good for learning bicycle assembly and maintenance that you could recommend by chance? There’re so many available, but if you have started doing this more or less recently perhaps you remember which would help a beginner the most?
- brudgers 6y agoSheldon Brown for theory stuff. Youtube for hands on. But of course practice to gain experience is really all there is for learning mechanical sympathy.
- bigiain 6y agoI'd also recommend trying top make friends with someone who is already doing it (at a level high enough beyond you that you'll learn useful stuff from them). Car/motorcycle/bike maintenance - it's always better to have someone who has a fair bit more experience than you sitting in your shed drinking your beer and eating your pizza while you do your own work.
- brudgers 6y agoI learned how to adjust caliper brakes watching a bike mechanic swap out my front cable in about 90 seconds. I saw it was entirely a matter of feel and visualization.
- pmontra 6y ago> No thief is going to bother cutting my locks when there is a Campagnolo on the next rack. Exactly, lock your bike close to a better one with a similar lock. The thieve will start from that one and could have no time left for yours.
- bambax 6y agoThis reminds one of this old joke about two people running away from a bear. One of the guys says to the other: why are you running? You'll never outrun a bear! And the other says: I don't need to be faster than the bear. I only need to be faster than you.
- dtparr 6y agoAlthough the National Park Service officially recommends not pushing down friends when running from a bear, or otherwise using friends as bait or sacrifices. https://m.facebook.com/nationalparkservice/photos/a.74409236388/10157206218381389/?type=3 https://m.facebook.com/nationalparkservice/photos/a.74409236...
- alkonaut 6y agoThe battery powered angle grinder gave thieves the advantage, but you'd think bike owners would have the advantage now that a battery powered transmitter can be tiny and easily hidden on a bike. People could (if police isn't interested in provoking crime which is illegal in some jurisdictions) plant nice looking bikes with transmitters, wait for them to be stolen, and follow the bike to what's presumably some kind of stash of stolen bikes. Repeat for a few years until thieves feel it's too dangerous.
- jeffbee 6y agoThis sort of presumes that the cops would care even if they knew exactly where all the stolen bikes were. My experience in San Francisco is they couldn't possibly care less. There was for decades an open-air bicycle chop shop under the highway overpass at what is now the corner of Market and Octavia, which was directly across an alley from a coffee shop and diner popular with SFPD patrols, and no cop ever cared about the bicycles.
- discreteevent 6y agoPolice indifference seems to be a problem everywhere. Bike theft really discourages people from cycling. If governments want more people to cycle they need to make bike theft prevention a priority. Even a fraction of what is spent on cycling infrastructure would make a difference.
- foobarian 6y agoPolice are probably paid low enough that they have to schlepp hours into town for their job and as a result they probably enjoy not being required (by some property loss threshold) to help the tech elite. If the constituents (not the governments) want to fix bike prevention they need to pay for a local police force.
- 14u2c 6y agoI'm not sure how owning a bike qualifies you as "the tech elite"
- brudgers 6y agoThe Lock Picking Lawyer discusses why he uses a thick chain lock for his cheaper bike. https://www.youtube.com/watch?v=SpVOTEOMRuE https://www.youtube.com/watch?v=SpVOTEOMRuE
- analog31 6y agoThis is kind of my approach. I figure, nothing will defeat an angle grinder, but a piece of chain will defeat a wire cutters if there's a nicer bike parked nearby. Riding a sub-$100 jalopy completes the picture.
- agumonkey 6y agodudes did try social response toward bike theft in plain NYC, the heavier the grinder the less people assume it's theft. 'nobody would try something that obvious' reasoning.
- oh_sigh 6y agoI wonder if you're thinking of an old Casey Neistat video. And another explanation for people's behavior is that they don't want to get stabbed defending some strangers bike.
- agumonkey 6y agoHmm no I don't think it was him, also there was a few other dudes that did the same. The point you noted is valid though. It's tough to intervene, and in one case, a black guy pretending to operate a bike in a park, people did come to tell him to stop, although it was probably .. not morally motivated :)
- Fricken 6y agoOver the 30 years I've been commuting by bicycle, I get a bike stolen once every 3 years or so. My bikes cost in the neighbourhood of $1k each. It costs me about a buck a day to travel by bike, which is really cheap relative to other transportation options. The cost of replacing a stolen bike seems to be less of a concern for people than the feeling of having been violated and taken advantage of.
- deleted 6y ago[deleted]
- zerni 6y ago“What about bicycle insurance? It's fairly expensive here in the UK, usually 10-15% of the bicycle's value annually and insurers typically only pay out when the whole bicycle is taken (so if if your front wheel is nicked, you're on your own) and when you can demonstrate that it was locked to their standards. Often these standards require that it is locked up indoors which means you're chancing it whenever you park away from your home or office.” None of that is true. I founded a UK bicycle insurer (not your usual one though). Our price is locked in max at 10% per year but it’s less if people claim less in our collective. On average people have been paying 6.5%. We settle partial and full theft claims. Stolen handlebars are more common than stolen wheels. It makes no sense to have customer prove to you as an insurer that the bike was properly locked beyond asking “was it locked to an immovable object?” and “did you own a lock of a certain standard at the time of theft?”. It’s almost impossible to prove and by that you could always reject a claim. I haven’t heard of a specialist bicycle insurer which requires you to lock a bike inside all the time. Why would you buy theft insurance? A lock of certain rating is enough, depending on insurer between 24h-48h - after that you abandoned your bike in the eyes of many insurance contracts. Last note.. of course this article focuses on theft but you’d also be covered for damage which can be the bigger risk depending on your use case (e.g road cycling or mountain biking).
- narwally 6y agoFor damage, how do you handle things likely caused by poor maintenance? I used to work as a bike mechanic, and there were plenty of times where a customer's bike got completely trash if they had just learned how to do some very basic routine maintenance and had brought it in to the shop once a year. Thinks like riding the bike when the the headset or bottom bracket are obviously loose, or riding on wheels that are very noticeable out of true.
- zerni 6y agoMaintenance is indeed tricky. Our way out is probably that the minimum bike value has to be £500 but the average customer has a multiple of that value and bikes at home. Passionate cyclists buy into our concept. We are looking into how we can institutionalise maintenance a bit more because there is a strong case to drive down cost further for everyone if a decent mechanic sees your bike at least once a year. My personal top tip are chain catchers. It’s a matter of time until the chain drops and if the front mech is not well adjusted. And if you get unlucky and have a carbon frame you might rip a hole into the frame.
- wintermutestwin 6y agoMy insurance policy (renters or homeowners) covers bike theft. Yes, there is a $1k deductible, but my bikes range from $3-5k each. Is this not a thing in the UK/EU?
- dmurray 6y agoThis is definitely a thing in Ireland and generally seems to be better value than specialist bike insurance. From my limited research, the latter is not worth getting for most people, but if you already have home insurance it's almost certainly worthwhile making sure it covers your bike, sometimes at a small extra cost to include bikes stolen not from your home.
- DenisM 6y agoCould you change the deductible? Mine is $500, and it's just not worth losing any sleep over it. I still lock the bike because it's a hassle to not have your bike when you need it, but life is too short to be lived in obsessive anxiety over locks.
- crote 6y agoThe Netherlands here. Homeowners insurance usually only covers bike theft when the bike is actually stolen from inside the home or garage, and there must be entry damage to prove this. If you want to to insure against bike theft, you need a separate form of bike insurance. They generally have no deductible, though. But it's usually not worth the effort. Daily-use bikes are too cheap to worry about, and expensive racing bikes / mountain bikes never leave your line of sight while outside your home.
- complexworld 6y agoMy ebike was stolen. It had a good lock, and was on street with significant passersby. It seemed like there was nothing I could do to prevent that from happening again. My solution was to buy a foldable bike that was half the price, and half the weight of my ebike. I didn't even buy a bike lock because I never leave the foldable bike parked on the street. Wherever I go I bring it inside.
- deleted 6y ago[deleted]
- TheMagicHorsey 6y agoWhy not create a bicycle whose frame is itself the lock, such that if you cut the lock, you are destroying the bicycle itself.
- jeffbee 6y agoThieves often cut the frames anyway, because it takes only seconds to cut tubular frames with a pipe cutter and the rest of the bike is still valuable as parts.
- narwally 6y agoYep, the most expensive components on an ebike are the battery and motor, you can cut the top tube and pull those components out and sell them for 500+ a piece on the used market. The batteries usually have a lock that is supposed to keep them from being stolen, but even on the high end brands they can just be shimmed open with a credit card in a second. I used to work as a bike mechanic, so learned all the tricks of the bike theft trade just from the stories from customers coming in after they had their bike stolen or stripped. If I was a bike thief I wouldn't even be bothering stealing full bikes, you can just walk around with a set of allen wrenches and a chain tool and make off with a nice derailleurs, carbon wheelsets, full stem and handlebars mounted with expensive shifters. You will look less like a thief and more like a guy working on his bike, and if you're afraid of someone questioning you, just stuff a card with your name and information on it in the seat-tube while your stripping it, and if anyone ask you can just pull that out as 'proof' that the bike is actually yours.
- analog31 6y agoIndeed, you can often get more for parting the bike out. People selling old bikes have found this to be true.
- crote 6y agoVanMoof used to sell that! https://cpsc.gov/Recalls/2017/VanMoof-Recalls-Bicycles https://cpsc.gov/Recalls/2017/VanMoof-Recalls-Bicycles
- 6y ago
- widforss 6y agoI live at a uni campus, and use a pretty good bicycle. But it's in a sufficiently bad shape to pass as worthless. I almost never lock it, but use a fixed rear wheel lock that I put in an almost-locked position sp that it looks locked. The only time I lost it was when it was confiscated by the school due to bad parking during clearing of snow. I found it in a nearby locked yard a couple of months later. I won't describe in detail how I got it back.
- II2II 6y agoI have had two bikes stolen, both of which fit into the "bike shaped object" category. Your bike can still be a target even if it is cheap, the main difference is that you have less to lose. > Backing up your important data ... If only I could run an inexpensive piece of software to restore my bike to the condition it was in before I put several thousand kilometres on it!
- sevencolors 6y agoI think this is a good list of things to consider for the first two personas. As for the last persona "Powertool Percy", there are a few tactics you can deploy. Especially for folks in dense urban areas. * If have an expensive bike don't ride it for errands, get a junker that rides well but looks worthless. * Remove the branding or make it camouflaged with stickers. * Ride dirty. Obviously keep the components lubed, but let your frame and wheel stay dirty
- crote 6y agoThe overall idea is to make it not worth the effort. Making your bike look shit will decrease the perceived value. Other nearby bikes will look comparatively more valuable, and are thus a more attractive target. Using overkill locking will make it too much effort to steal. When choosing between bikes of similar value, the one which is easiest to steal will be choosen. Make it hard to offload. Giving it a shitload of stickers or a weird paintjob will make it too recognizable. It will be too obviously stolen to sell, again making other bikes more attractive.
- narwally 6y ago"This prevents opportunistic theft but if this space is shared with others (apartment blocks and offices) it in fact serves to increase the economies of scale for prepared thieves who break into your storage area late at night with a van. It's not uncommon for office bicycle stores (with many fancy, expensive bikes inside) to be emptied out completely overnight by professional thieves." At the shop I used to work at, we had some guys back a pickup truck through the front window of the store, load the pickup with five or so $8-10K bikes, and then drive off. We got it all on security camera and it took less than a minute. They made off with more value than most small banks keep in cash.
- crote 6y agoThat's a bike shop, right? I assume that means the bikes weren't locked to anything, or even locked at all. Where I live, to get to my bike you'd need to: 1. Pass a keyed electric door. 2. Enter locked floor-specific cage (think datacenter cage, but more heavy-duty) 3. Cut lock attaching bike to bike rack. All while being watched by about 5 cameras. The best part? It's student housing! I'd expect any appartment block or office building to have similar or better security. I have literally never heard of that kind of smash-n-grab happening. It's just too much risk for way too little reward.
- joshocar 6y agoThe bike room at my friend's apartment building has two entrances. One is to the lobby, the other is out the back... No one keeps expensive bikes in there, they are all junkers. Risk/reward is relative though. For a lot of people 5 years in jail isn't worth $30k in bikes. For others it's worth the risk or they don't even realize the risk. I mean, people still rob banks for what, <$20k?
- ornornor 6y agoMy previous apartment building was secured by electronic badges, several camera, and security sitting 50m away (they didn’t have a direct line or sight though). No one stored their bikes longer that 4–6 months there before getting theirs stolen. Thieves would go behind people when the door was being operated and in the case of the parking garage used a van and just fit the rack off, or for the upstairs bike room cut the locks and loaded the bikes in their van just outside the back. It took very little time, it was all on camera, the police never did anything. I’m actually pretty sure it was the same thief hitting the building every time because the MO was the same. It was actually safer to lock your bike anywhere else than these purpose built bike rooms. Cameras don’t do anything at all, and neither does the police. Thieves know it. But a stolen car? The police will be very interested and keep looking.
- ohazi 6y agoMostly for the hilarity... How much would it cost to make a bicycle lock out of Inconel?
- GuB-42 6y agoIf want to have it machined for you, several thousands. If you just want a chain, maybe $100. I don't think it is a good material for a bike lock anyways. It has excellent heat and corrosion resistance but for strength, I think you are better off with regular hardened steel. If you are looking for an unconventional lock, the one I found the most interesting has a sheaf made of loose Kevlar fibers that fouls angle grinders. To defeat grinders, some locks contain ball bearings and ceramic inserts. Ball bearings spin with the cutting disc preventing abrasion and hard ceramic insert quickly wear off tools. I've never seen these on bike locks though.
- crote 6y agoThe kevlar fibers don't really work in practice. Turns out you can just use a pair of shears or a boltcutter. Examples: https://www.youtube.com/watch?v=j7ah3RA0Alo https://www.youtube.com/watch?v=j7ah3RA0Alo https://www.youtube.com/watch?v=D-On0DGcDlc https://www.youtube.com/watch?v=D-On0DGcDlc
- GuB-42 6y agoIt is not this. I don't remember where I found it but only the sheif has Kevlar fibers, there is what I think is a hardened steel chain in the middle. The loose Kevlar fibers don't offer any strength, instead, they make a mess if you try to cut through the sheif. You can probably cut through the sheif and Kevlar with shears to reveal the chain and then use your angle grinder but it will slow you down, especially if everything is entangled.
- plorkyeran 6y agohttps://altorlocks.com/products/saf-lock https://altorlocks.com/products/saf-lock sounds more like what the parent was referring to. It's a good example of clearly addressing a specific threat model: it doesn't try to be impossible to cut (although the marketing material says otherwise...). Instead it's just so thick that a 5" angle grinder can't reach all the way through it in a single cut, and the coating material is specifically designed to be slow to cut through so that it takes a long time and requires multiple batteries. Of course, it still has the obvious problem that the thing you're locking it onto is probably a lot easier to cut.
- kop316 6y agoI recently bought an expensive ebike to commute, and I decided to get a kryptonite lock. The primary reason was because of their anti-theft offer: https://shop.kryptonitelock.com/atpo_landing_pages/register-for-anti-theft-en.html https://shop.kryptonitelock.com/atpo_landing_pages/register-... I bought a lock that would fully insure the bike, so if it does get stolen I would at least get the value of it back.
- analog31 6y agoNote that you need to recover the broken lock in order to make a claim. Now I can't think of why the thief would take your lock after defeating it, but I don't understand the criminal mind.
- kop316 6y agoYep I noted that. My thought is really if someone has to go through the trouble of taking an angle grinder to the lock, there is a bunch of noise (and sparks) that have to happen first. I admittedly know mine is a juicier target than most bikes, but there is some serious dedication needed for it.
- hokkos 6y agoHaving bikes stolen 3 times, I have never found the broken lock at the bike place. Thief take all because the owner will lose time trying to remember if it was the correct place, it leaves no clue if a police car happens to pass a few seconds later after the bike is stolen.
- mleonhard 6y agoTakeaways: 1. Make attacker user personas part of your threat model. 2. Create the threat model openly inside your organization. Get input from knowledgeable people. Help people to get familiar with it.
- hokkos 6y agoEven cheap bikes are being stolen by crackheads, it is not a deterrent. I recently brought a 4500€ e-mountain bike, and my solutions are : - a 20/20 motorcycle U-lock from Abus - a 15/15 bike folding lock with a vibration alarm from Abus - a LoRaWan GPS and movement/vibration tracker hidden in the bike - only keeping it in my secure parking at work, inside my house or a few minutes at the grocery market.
- agumonkey 6y agoI sadly lost my old bike due to this thinking: - cheapo 90s brand - ugly design / color - no seat - missing one pedal - low end shimano shifter (manual lever above handlebar) - rust, broken brake handles ps: how is the vibration alarm working ?
- wasdfff 6y agoI think the best solution is to assume theft. Even with the GPS position, not much you or law enforcement will do once its in a homeless encampment with 20 other bikes. Buy a cheap lock to deter walking off with the bike, and buy insurance. I pay $8 a month and if my $1k of bike is stolen, I pay nothing more to get a brand new one.
- avivo 6y agoI think this in point. "[Treat] the attacker user personas with the same primacy as those of the customer user personas — [put] them on a wall in the office and [have] everyone conversant in their "needs". Another solid piece that goes into more of the details of threat modeling: https://increment.com/security/approachable-threat-modeling/ https://increment.com/security/approachable-threat-modeling/
- deleted 6y ago[deleted]
- foobar1962 6y agoWorth reading to the very end: >When threat modelling, a good starting point might be take your attackers "needs" and then instead of striving to 'surprise and delight' you instead strive to "bore and frustrate".
- gorgoiler 6y agoMy summary from the article: take down the fence — the middleman criminal who provides a market where thieves can sell their stolen bicycles — and be especially ruthless about it. This is an option only really available to the police. Perhaps there’s a reason for law enforcement to tolerate fencing though? Maybe there are nuances downsides to society if we eliminate the black markets? Do fences act as some kind of lubricant to the underclasses? Do we allow fences to exist because, if we didn’t, the desperate / evil thieves would resort to violently extorting cash instead of non-violently stealing bicycles? Imagine a future, for example, where the black market for stolen goods is quashed. It is much safer to lock bicycles up outside, but ATM knife extortions go up tenfold.
- LargoLasskhyfv 6y agoGet a larger knife (up to machete), a can of bear spray, a tazer or gun. Don't go alone, pay cashless, etc.
- 082349872349872 6y agoMy wife finds it hard to believe my tales of how things in the US would grow legs if left unattended, and how sidewalk cafés there would lock the tables to the pavement and bring the chairs inside at night. (caveat: the "big city" where I lived when I met her is 30k, hers was 80k) So I do believe rampant petty crime is a deliberate societal choice, but as to whether it serves a purpose or why it would be tolerated, I have no clue. All I can say is that in at least some jurisdictions, lack of bike theft does not translate into increase in mugging. Tangentially related (education instead of petty crime) but I still find it darkly amusing that people who call Brave New World's five colour-coded castes a dystopia voluntarily sort themselves by five-digit ZIP code: https://news.ycombinator.com/item?id=24269640 https://news.ycombinator.com/item?id=24269640 "I'm really awfully glad I'm a 94301"
- wasdfff 6y agoIn the U.S. bike theft is not pursued since it isn’t a felony usually. People don’t spend a lot of time in jail for bike theft even when they do get caught, so not much downside for a very high possibility of an upside.
- joshlemer 6y ago>"Powertool Percy" will be kept at bay by: > Nothing, save ensuring that your bicycle doesn't look valuable enough to be worth his time this probably means keeping its value down below a few hundred pounds There actually are a handful of products that will successfully defend against power tools, such as the SAF lock: https://altorlocks.com/products/saf-lock https://altorlocks.com/products/saf-lock
- LargoLasskhyfv 6y agoMy favourite solution would be something like this: [1] https://duckduckgo.com/q=japanese+underground+bicycle+parkingbicycle+parking https://duckduckgo.com/q=japanese+underground+bicycle+parkin...