6 ms·

I don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system.

by lrvick 5y ago

Ajedi32 5y ago
Unfortunately, there aren't really all that many "good locks" on the market. The Lock Picking Lawyer on YouTube[1] has pretty much destroyed my faith in the modern lockmaking industry. [1]: https://www.youtube.com/c/lockpickinglawyer/videos https://www.youtube.com/c/lockpickinglawyer/videos
- hirundo 5y ago
  https://www.youtube.com/watch?v=qV8QKZNFxLw https://www.youtube.com/watch?v=qV8QKZNFxLw
  - akavel 5y ago
    Apparently, picked here: https://youtu.be/ai5Hf-wPXFE https://youtu.be/ai5Hf-wPXFE but check out this one instead: https://youtu.be/sES_Hbj92BQ https://youtu.be/sES_Hbj92BQ - ~2h to open fully (though the author of the video claims impressioning could speed up the thing; anyway, reportedly attacking the door is just easier in this case)
    - lrvick 5y ago
      I have Bowley locks in my collection. Amazing quality. Not only does it take a couple hours to pick for an expert but you have to make a custom set of tools that only work on that one particular lock. If a lock keeps someone out for several hours it is a great lock.
    - Norlin 5y ago
      Guy who made the video here. The lock mechanism itself isn't one of the easiest, but also not one of the hardest to pick skill-wise. However, it does take a very long time to pick through which means that the lock is doing its job very well. Also, I have read that this lock is very resistant to destructive attack as well. So combining pick resistance with physical resistance, you have a very good lock as long as it's installed on a good door and the building has all other security measures in place (no ground level unprotected windows, etc) Also worth noting, Bosnian Bill (a more recognized name) also attempted this lock here https://www.youtube.com/watch?v=tLeiPmfm-2s https://www.youtube.com/watch?v=tLeiPmfm-2s
- lrvick 5y ago
  I have hundreds of locks and lock bypass tools. I make sure to pay for ones that are not quickly defeated when it counts. LPL covers most locks in the wild which are bad, but locks like the Protec2 are quite strong and while it is implied one person in the world can beat it with custom tools (huxleypig)... even then not quickly.
  - Godel_unicode 5y ago
    And the best features are (proudly) locked behind patents, so if you need a great lock in a form factor they don't make, oh well.
    - lrvick 5y ago
      Some of the best locks are very very hard to buy as well and still protected with weird export controls held over from the encryption export days. I frequently use FF-L-2740 spec locks, which is the spec locks need to hit for use in classified government work, military contractors etc. They are very good locks I can't begin to defeat in any practical amount of time and don't know anyone who can. Particularly since they have timed brute force lockouts. Problem is not a single vendor is allowed to sell locks of that spec to civilians by contract so you have to jump through lots of hoops to get them.
- worik 5y ago
  For most uses of a lock its job is to keep honest people out. I have had doors kicked in, so these days I want the lock to be the weakest, not strongest, part of the door. So when it is kicked in it is a cheap lock that is destroyed not an expensive hardwood door (I like hardwood doors...)
  - lrvick 5y ago
    Most locks can be picked by a child with a hair pin. I would know. I grew up as that child opening every door and safe I could to amuse myself. If a door is broken then a lock did its job. It let you know you were broken into.
    - worik 5y ago
      Cheaper if the lock is broken. Locks (that are broken easily) are cheaper than doors, which are not hard to break and expensive to fix Who is going to pick a lock that is cheap and easy to break?
      - caf 5y ago
        Even cheaper just to leave the door unlocked, I suppose.
        worik 5y ago
        The purpose of a lock is to keep honest people out. Mēh. I have dogs.
        caf 5y ago
        If that were literally true then a sign saying "This door is on the honour system, please don't enter" would work just as well.
      - IncRnd 5y ago
        > Who is going to pick a lock that is cheap and easy to break? Probably a criminal who is trying to be quiet, so they can enter your house.
- JTbane 5y ago
  Watching his channel, a beefy disc tumbler locks seem to be your best bet for keeping a bike secure. For your home, a high security pin tumbler with security pins are fine too. It takes very high skill to defeat these.
- traceroute66 5y ago
  > there aren't really all that many "good locks" on the market. You can say that again. I was once proud of myself for having thoroughly researched the market and I thought EVVA MCS was a safe bet[1]. Then someone showed me a YouTube video (published a year after I bought the locks) of someone picking it (not LPL, another YouTuber). Given the cost of EVVA MCS I was not a happy bunny. [1] https://www.evva.com/int-en/products/mechanical-locking-systems/mcs-locking-system/ https://www.evva.com/int-en/products/mechanical-locking-syst...
- repiret 5y ago
  He can defeat just about anything, but he’s also exceptionally skilled. As a consumer of locks, I expect them to be defeatable by a skilled lockpicker. But I don’t expect them to be defeatable by a bic pen or by reaching in the keyhole with an oddly shaped wire to move the locking paul. You can buy locks that don’t have easy bypasses, and can’t be easily drilled, and can’t be picked by beginners.
  - lrvick 5y ago
    You can also buy locks that can't be picked by people like me who have been at it 20 years. To keep people like me out for a while buy a Medeco. Pins not only need to be at the right height, but also the right rotation. They are a real pain in the ass to pick. I don't even know any locksmiths that can pick them. Good security for the money. Bosnian Bill and LPL... Okay they can pick them, but they are like the 0.0001% in skill. Still even then pay an extra $100 for really high quality disk detainer lock like a Protec 2 and you will keep even them out for quite a while. That is what I use on my luggage. TSA has to call me to unlock them with my consent every time. The way I like it. Great tip I picked up from Deviant Ollam.
    - mmastrac 5y ago
      I'm surprised TSA doesn't just cut it off, TBH.
      - ukd1 5y ago
        Also this; especially after watching this happen to DeviantOllam
    - djrogers 5y ago
      > TSA has to call me to unlock them with my consent every time. No - no they don’t. Anything locked with a non-TSA compliant lock is fair game for the bolt cutters, and frankly probably draws a lot of extra attention. All you’re doing is asking for extra screening… [1] https://www.tsa.gov/blog/2014/02/18/tsa-travel-tips-tuesday-tsa-recognized-locks https://www.tsa.gov/blog/2014/02/18/tsa-travel-tips-tuesday-...
- godelski 5y ago
  Just because a highly skilled professional lock picker can pick a lock doesn't mean you can nor the parent's coworkers.
nrr 5y ago
The lock doesn't even need to be that good. As you said, the name of the game is intrusion detection, not necessarily intrusion avoidance. The Lock Picking Lawyer chronicled very nicely a technique for turning a KW1-keyed Kwikset core (extremely common here in the US) into something that is tamper evident. See the YouTube video linked herein. https://www.youtube.com/watch?v=7JlgKCUqzA0 https://www.youtube.com/watch?v=7JlgKCUqzA0 This kind of thing thwarts covert attack attempts and serves as a good way to trigger an audit on the trust of the asset behind that lock.
- Chirael 5y ago
  I’m into locksport as well and would favor that kind of modification on a back door which is more likely to be targeted by thieves. Not sure I’d do it on a front door in case I put a family member actually locked themselves out and actually needed a locksmith to be able to get in.
  - nrr 5y ago
    Sure, and the application of access control devices generally requires a degree of discretion and understanding what your threat model is. If you don't fear your front door will be clandestinely accessed, I feel it's perfectly valid not to worry about doing this to the lock there. Not being you, that isn't my call to make.
    - Chirael 5y ago
      Yeah, my threat model is common house thieves, not intelligence agencies or police.
thaumasiotes 5y ago
> I don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system. The term for what you want is a "seal", not a lock.
btbuildem 5y ago
Imagine someone broke the lock, but did nothing more. You'd be driven mad trying to find what the intrusion was on your system.

I don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system.

by lrvick 5y ago

I don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system.

Ajedi32 5y ago

Unfortunately, there aren't really all that many "good locks" on the market. The Lock Picking Lawyer on YouTube[1] has pretty much destroyed my faith in the modern lockmaking industry. [1]: https://www.youtube.com/c/lockpickinglawyer/videos https://www.youtube.com/c/lockpickinglawyer/videos

hirundo 5y ago
https://www.youtube.com/watch?v=qV8QKZNFxLw https://www.youtube.com/watch?v=qV8QKZNFxLw
- akavel 5y ago
  Apparently, picked here: https://youtu.be/ai5Hf-wPXFE https://youtu.be/ai5Hf-wPXFE but check out this one instead: https://youtu.be/sES_Hbj92BQ https://youtu.be/sES_Hbj92BQ - ~2h to open fully (though the author of the video claims impressioning could speed up the thing; anyway, reportedly attacking the door is just easier in this case)
  - lrvick 5y ago
    I have Bowley locks in my collection. Amazing quality. Not only does it take a couple hours to pick for an expert but you have to make a custom set of tools that only work on that one particular lock. If a lock keeps someone out for several hours it is a great lock.
  - Norlin 5y ago
    Guy who made the video here. The lock mechanism itself isn't one of the easiest, but also not one of the hardest to pick skill-wise. However, it does take a very long time to pick through which means that the lock is doing its job very well. Also, I have read that this lock is very resistant to destructive attack as well. So combining pick resistance with physical resistance, you have a very good lock as long as it's installed on a good door and the building has all other security measures in place (no ground level unprotected windows, etc) Also worth noting, Bosnian Bill (a more recognized name) also attempted this lock here https://www.youtube.com/watch?v=tLeiPmfm-2s https://www.youtube.com/watch?v=tLeiPmfm-2s
lrvick 5y ago
I have hundreds of locks and lock bypass tools. I make sure to pay for ones that are not quickly defeated when it counts. LPL covers most locks in the wild which are bad, but locks like the Protec2 are quite strong and while it is implied one person in the world can beat it with custom tools (huxleypig)... even then not quickly.
- Godel_unicode 5y ago
  And the best features are (proudly) locked behind patents, so if you need a great lock in a form factor they don't make, oh well.
  - lrvick 5y ago
    Some of the best locks are very very hard to buy as well and still protected with weird export controls held over from the encryption export days. I frequently use FF-L-2740 spec locks, which is the spec locks need to hit for use in classified government work, military contractors etc. They are very good locks I can't begin to defeat in any practical amount of time and don't know anyone who can. Particularly since they have timed brute force lockouts. Problem is not a single vendor is allowed to sell locks of that spec to civilians by contract so you have to jump through lots of hoops to get them.
worik 5y ago
For most uses of a lock its job is to keep honest people out. I have had doors kicked in, so these days I want the lock to be the weakest, not strongest, part of the door. So when it is kicked in it is a cheap lock that is destroyed not an expensive hardwood door (I like hardwood doors...)
- lrvick 5y ago
  Most locks can be picked by a child with a hair pin. I would know. I grew up as that child opening every door and safe I could to amuse myself. If a door is broken then a lock did its job. It let you know you were broken into.
  - worik 5y ago
    Cheaper if the lock is broken. Locks (that are broken easily) are cheaper than doors, which are not hard to break and expensive to fix Who is going to pick a lock that is cheap and easy to break?
    - caf 5y ago
      Even cheaper just to leave the door unlocked, I suppose.
      - worik 5y ago
        The purpose of a lock is to keep honest people out. Mēh. I have dogs.
        caf 5y ago
        If that were literally true then a sign saying "This door is on the honour system, please don't enter" would work just as well.
    - IncRnd 5y ago
      > Who is going to pick a lock that is cheap and easy to break? Probably a criminal who is trying to be quiet, so they can enter your house.
JTbane 5y ago
Watching his channel, a beefy disc tumbler locks seem to be your best bet for keeping a bike secure. For your home, a high security pin tumbler with security pins are fine too. It takes very high skill to defeat these.
traceroute66 5y ago
> there aren't really all that many "good locks" on the market. You can say that again. I was once proud of myself for having thoroughly researched the market and I thought EVVA MCS was a safe bet[1]. Then someone showed me a YouTube video (published a year after I bought the locks) of someone picking it (not LPL, another YouTuber). Given the cost of EVVA MCS I was not a happy bunny. [1] https://www.evva.com/int-en/products/mechanical-locking-systems/mcs-locking-system/ https://www.evva.com/int-en/products/mechanical-locking-syst...
repiret 5y ago
He can defeat just about anything, but he’s also exceptionally skilled. As a consumer of locks, I expect them to be defeatable by a skilled lockpicker. But I don’t expect them to be defeatable by a bic pen or by reaching in the keyhole with an oddly shaped wire to move the locking paul. You can buy locks that don’t have easy bypasses, and can’t be easily drilled, and can’t be picked by beginners.
- lrvick 5y ago
  You can also buy locks that can't be picked by people like me who have been at it 20 years. To keep people like me out for a while buy a Medeco. Pins not only need to be at the right height, but also the right rotation. They are a real pain in the ass to pick. I don't even know any locksmiths that can pick them. Good security for the money. Bosnian Bill and LPL... Okay they can pick them, but they are like the 0.0001% in skill. Still even then pay an extra $100 for really high quality disk detainer lock like a Protec 2 and you will keep even them out for quite a while. That is what I use on my luggage. TSA has to call me to unlock them with my consent every time. The way I like it. Great tip I picked up from Deviant Ollam.
  - mmastrac 5y ago
    I'm surprised TSA doesn't just cut it off, TBH.
    - ukd1 5y ago
      Also this; especially after watching this happen to DeviantOllam
  - djrogers 5y ago
    > TSA has to call me to unlock them with my consent every time. No - no they don’t. Anything locked with a non-TSA compliant lock is fair game for the bolt cutters, and frankly probably draws a lot of extra attention. All you’re doing is asking for extra screening… [1] https://www.tsa.gov/blog/2014/02/18/tsa-travel-tips-tuesday-tsa-recognized-locks https://www.tsa.gov/blog/2014/02/18/tsa-travel-tips-tuesday-...
godelski 5y ago
Just because a highly skilled professional lock picker can pick a lock doesn't mean you can nor the parent's coworkers.

nrr 5y ago

The lock doesn't even need to be that good. As you said, the name of the game is intrusion detection, not necessarily intrusion avoidance. The Lock Picking Lawyer chronicled very nicely a technique for turning a KW1-keyed Kwikset core (extremely common here in the US) into something that is tamper evident. See the YouTube video linked herein. https://www.youtube.com/watch?v=7JlgKCUqzA0 https://www.youtube.com/watch?v=7JlgKCUqzA0 This kind of thing thwarts covert attack attempts and serves as a good way to trigger an audit on the trust of the asset behind that lock.

Chirael 5y ago
I’m into locksport as well and would favor that kind of modification on a back door which is more likely to be targeted by thieves. Not sure I’d do it on a front door in case I put a family member actually locked themselves out and actually needed a locksmith to be able to get in.
- nrr 5y ago
  Sure, and the application of access control devices generally requires a degree of discretion and understanding what your threat model is. If you don't fear your front door will be clandestinely accessed, I feel it's perfectly valid not to worry about doing this to the lock there. Not being you, that isn't my call to make.
  - Chirael 5y ago
    Yeah, my threat model is common house thieves, not intelligence agencies or police.

thaumasiotes 5y ago

> I don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system. The term for what you want is a "seal", not a lock.

btbuildem 5y ago

Imagine someone broke the lock, but did nothing more. You'd be driven mad trying to find what the intrusion was on your system.