6 ms·

I'm curious: do people expect mechanical locks such as these to continue being used in the future? 20 years? 50 years? I'm kind of imagining that at some point

by snet0 5y ago

I'm curious: do people expect mechanical locks such as these to continue being used in the future? 20 years? 50 years? I'm kind of imagining that at some point, someone will "solve" locks, and create a physical equivalent of RSA. I expect that mechanical solutions will be too cost-prohibitive, so is the only route for progress through electronic lock systems? From a few videos on this channel, it looks pretty dire for those, but perhaps the incentive isn't there yet.

foobarian 5y ago
It's fun to point out to laypeople how insecure the mechanical locks are, and how easy they are to pick. But it's less often mentioned that this is a desirable feature; imagine bulletproof locks - what would the recommendation be to people who get locked out? What would the economic damage be across the board?
- NikolaeVarius 5y ago
  You cut it
  - snet0 5y ago
    I think this is kind of central to what a perfect lock would be. The only non-authorised access should be destructive.
    - kube-system 5y ago
      While there are some locks that attempt to do stuff like this (Bowley locks?), the trade off for perfection is cost and recoverability. This might be useful for niche use-cases or academic reasons, but for a commercial product, the value proposition doesn't make as much sense. After a certain point of pick/bypass resistance, adding cost to a lock isn't actually protecting most users from any plausible attacker. And is more likely to prevent the authorized user from gaining access in a lockout scenario than it is to prevent a real-world attack. In most cases where someone faces a sophisticated attacker that could bypass a security lock, you'd be better served by layering other security techniques, instead of putting your eggs all in one basket with the physical lock.
- johannes1234321 5y ago
  And in addition: the weak spot often isn't the lock but the window next to it, the door frame or similar. The lock prevents somebody from getting in by accident (I had my drunk neighbor once trying to get into my place at night ...) but the typical door and lock don't protect against somebody who wants to to get in. For that protection you have to pay a lot more
matteotom 5y ago
I think, fundamentally, physical locks _can't_ be solved. At the end of the day, given enough time, there will always be a physical workaround to a physical lock. Even with a "perfect" electronic lock, somebody could always just cut through the door. IMO the purpose of a lock is to either 1) slow down an attacker long enough for (eg) police to show up, or 2) discourage an attacker from breaking into _your_ house in favor of your neighbor's house.
- snet0 5y ago
  I think mentioning "well if the lock's too hard they'll just break the window" is missing a point: locks right now are just too easy. Destructive bypasses to locks, or even just cutting the lock into pieces, are probably a good thing, since it prevents the equivalent of losing your Bitcoin wallet. But you want the attacker to be forced to either make a loud mess or go elsewhere. If you didn't encrypt HTTP, you could sniff packets on the network, walk through the front door. If it was weakly encrypted, someone with some level of expertise could basically do the same, pick the cheap lock and walk through the front door. With RSA-like encryption, this avenue of attack is basically closed, and now the options are more like "try and steal this guy's laptop" or "launch MITM attacks".
- Animats 5y ago
  I think, fundamentally, physical locks _can't_ be solved. Sure they can. Lock-picking is a search for a minima. You just need a design where there's no way to tell if you're getting closer to the right combination. That is, something senses the combination on the key, saves it, and then tests the saved info while protected from manipulation. Doing this cheaply and in a small package is difficult. Someone recently built such a lock and sent it to the Lock Picking Lawyer.[1] No results yet. One classic lock close to that was the Chubb Detector Lock. If any lever was pushed too high, the relocking device tripped and the lock would no longer open. Use the wrong key and you were locked out.[1] This was usually fitted with a second mechanism so that turning the correct key in the wrong direction would reset the detector. If built without the reset feature, pick attempts or using the wrong key would disable the lock permanently. This was highly secure but inconvenient. This is probably a solveable problem if you're willing to have a sizable box on the the door, like 19th century door locks or jail locks today. You'd want that anyway, for mechanical strength. [1] https://hackaday.com/2020/11/29/making-a-unpickable-lock/ https://hackaday.com/2020/11/29/making-a-unpickable-lock/ [2] https://youtu.be/7Q6rsbeJZMs https://youtu.be/7Q6rsbeJZMs
kube-system 5y ago
Yes. Locks in meat-space have always been and will always be deterrents. While you can't always brute-force your way through a math problem, you can brute-force basically any physical material.
ufmace 5y ago
I don't think it can be "solved" in that way. If you're going to have a physical lock, it needs to have a physical locking mechanism somewhere. If you watch lock picking youtube, you'll see that virtually all electronic locks sold today have horrendous physical security. Given the state of their physical security and the even more terrible state of IoT digital security, I doubt that the controllers of these locks are really secure either, though I haven't seen any reports of them being attacked in that way.
SavantIdiot 5y ago
My dad's $2500 in-wall gun safe battery died and he couldn't find the key. I made a bet with him I could pick it and he laughed and laughed. I ordered a 7-pin tube pick of amazon, had it fedexed, and had the safe open in under a minute (shocked myself, I'm not bragging, honest). I got a fancy dinner out of it. Point is: there is no digital solution for this problem. It will always have an analog solution.
- mNovak 5y ago
  Security and convenience are always a trade off. If you don't want the hilariously low security analog bypass, then you have to provide means for backup power. For an in-wall safe, mains power would seem reasonable.
gnopgnip 5y ago
The Bowley lock is pretty close to a purely physical lock that cannot be opened non destructively without the key. Basically it is a warded pin tumbler lock, the pins are 180 degrees offset from where you put the key in, surrounded by a steel cylinder that needs another 180 degree bend. This combination of the 180 degree offset and the narrow bend really limits what kind of tools a lockpick can use. With the offset they can't insert and remove individual tools without rotating and retracting all of them, losing any tension or set pins. Because of the bend they won't be able to manipulate all the pins with one tool either. So a lockpick would need a tool to tension, and 3 or more picks to manipulate the pins. The physical tolerances of the lock really limits bumping, there is limited front to back play, so full depth cuts won't work. There are also the usual security measures to limit bumping and electric lock guns, zero lift pin, security pins.

by snet0 5y ago

foobarian 5y ago

It's fun to point out to laypeople how insecure the mechanical locks are, and how easy they are to pick. But it's less often mentioned that this is a desirable feature; imagine bulletproof locks - what would the recommendation be to people who get locked out? What would the economic damage be across the board?

NikolaeVarius 5y ago
You cut it
- snet0 5y ago
  I think this is kind of central to what a perfect lock would be. The only non-authorised access should be destructive.
  - kube-system 5y ago
    While there are some locks that attempt to do stuff like this (Bowley locks?), the trade off for perfection is cost and recoverability. This might be useful for niche use-cases or academic reasons, but for a commercial product, the value proposition doesn't make as much sense. After a certain point of pick/bypass resistance, adding cost to a lock isn't actually protecting most users from any plausible attacker. And is more likely to prevent the authorized user from gaining access in a lockout scenario than it is to prevent a real-world attack. In most cases where someone faces a sophisticated attacker that could bypass a security lock, you'd be better served by layering other security techniques, instead of putting your eggs all in one basket with the physical lock.
johannes1234321 5y ago
And in addition: the weak spot often isn't the lock but the window next to it, the door frame or similar. The lock prevents somebody from getting in by accident (I had my drunk neighbor once trying to get into my place at night ...) but the typical door and lock don't protect against somebody who wants to to get in. For that protection you have to pay a lot more

matteotom 5y ago

I think, fundamentally, physical locks _can't_ be solved. At the end of the day, given enough time, there will always be a physical workaround to a physical lock. Even with a "perfect" electronic lock, somebody could always just cut through the door. IMO the purpose of a lock is to either 1) slow down an attacker long enough for (eg) police to show up, or 2) discourage an attacker from breaking into _your_ house in favor of your neighbor's house.

snet0 5y ago
I think mentioning "well if the lock's too hard they'll just break the window" is missing a point: locks right now are just too easy. Destructive bypasses to locks, or even just cutting the lock into pieces, are probably a good thing, since it prevents the equivalent of losing your Bitcoin wallet. But you want the attacker to be forced to either make a loud mess or go elsewhere. If you didn't encrypt HTTP, you could sniff packets on the network, walk through the front door. If it was weakly encrypted, someone with some level of expertise could basically do the same, pick the cheap lock and walk through the front door. With RSA-like encryption, this avenue of attack is basically closed, and now the options are more like "try and steal this guy's laptop" or "launch MITM attacks".
Animats 5y ago
I think, fundamentally, physical locks _can't_ be solved. Sure they can. Lock-picking is a search for a minima. You just need a design where there's no way to tell if you're getting closer to the right combination. That is, something senses the combination on the key, saves it, and then tests the saved info while protected from manipulation. Doing this cheaply and in a small package is difficult. Someone recently built such a lock and sent it to the Lock Picking Lawyer.[1] No results yet. One classic lock close to that was the Chubb Detector Lock. If any lever was pushed too high, the relocking device tripped and the lock would no longer open. Use the wrong key and you were locked out.[1] This was usually fitted with a second mechanism so that turning the correct key in the wrong direction would reset the detector. If built without the reset feature, pick attempts or using the wrong key would disable the lock permanently. This was highly secure but inconvenient. This is probably a solveable problem if you're willing to have a sizable box on the the door, like 19th century door locks or jail locks today. You'd want that anyway, for mechanical strength. [1] https://hackaday.com/2020/11/29/making-a-unpickable-lock/ https://hackaday.com/2020/11/29/making-a-unpickable-lock/ [2] https://youtu.be/7Q6rsbeJZMs https://youtu.be/7Q6rsbeJZMs

kube-system 5y ago

Yes. Locks in meat-space have always been and will always be deterrents. While you can't always brute-force your way through a math problem, you can brute-force basically any physical material.

ufmace 5y ago

I don't think it can be "solved" in that way. If you're going to have a physical lock, it needs to have a physical locking mechanism somewhere. If you watch lock picking youtube, you'll see that virtually all electronic locks sold today have horrendous physical security. Given the state of their physical security and the even more terrible state of IoT digital security, I doubt that the controllers of these locks are really secure either, though I haven't seen any reports of them being attacked in that way.

SavantIdiot 5y ago

My dad's $2500 in-wall gun safe battery died and he couldn't find the key. I made a bet with him I could pick it and he laughed and laughed. I ordered a 7-pin tube pick of amazon, had it fedexed, and had the safe open in under a minute (shocked myself, I'm not bragging, honest). I got a fancy dinner out of it. Point is: there is no digital solution for this problem. It will always have an analog solution.

mNovak 5y ago
Security and convenience are always a trade off. If you don't want the hilariously low security analog bypass, then you have to provide means for backup power. For an in-wall safe, mains power would seem reasonable.

gnopgnip 5y ago

The Bowley lock is pretty close to a purely physical lock that cannot be opened non destructively without the key. Basically it is a warded pin tumbler lock, the pins are 180 degrees offset from where you put the key in, surrounded by a steel cylinder that needs another 180 degree bend. This combination of the 180 degree offset and the narrow bend really limits what kind of tools a lockpick can use. With the offset they can't insert and remove individual tools without rotating and retracting all of them, losing any tension or set pins. Because of the bend they won't be able to manipulate all the pins with one tool either. So a lockpick would need a tool to tension, and 3 or more picks to manipulate the pins. The physical tolerances of the lock really limits bumping, there is limited front to back play, so full depth cuts won't work. There are also the usual security measures to limit bumping and electric lock guns, zero lift pin, security pins.