6 ms·

I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.

more_corn 4y ago
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
- reidjs 4y ago
  The more hassle involved with breaking the lock the harder it is to be steal, that makes sense. Don't forget about security by obscurity, though. Let's say a criminal with a bolt cutter finds their way to an unattended gym locker room and they can only have time to snip one or two locks. The majority of the lockers have generic Master Locks, a few have some exotic "ultra-secure" locks on them. Do they randomly snip a locker with a generic Master Lock, or do they pick the bright-orange-ultra-secure-lock-probably-hiding-a-tablet-and-laptop locker?
  - giantg2 4y ago
    Wouldn't that be a bad example? That they could still snip the better locks seems like they're not really better. In general, you would want a lock that they would need a special tool that they didn't bring. For example, maybe the thief could have cut(saw) the higher end locks, but they only brought bolt cutters because they're faster and work on 90% of the locks.
    - johannes1234321 4y ago
      Not necessarily. The attack has to be expensive enough (in time, noise, ....) To be discouraging for making the attacker go elsewhere or not attacking at all.
      - giantg2 4y ago
        My point was that the example give involved "better" locks that were just as vulnerable as the cheaper ones.
    - lazide 4y ago
      Many better locks from a picking perspective are only mildly better from a physical security perspective. If someone has brought tools (portable angle grinder, hydraulic bolt cutters, or a prybar) sufficient to take out most locks, they'll take out most locks unless you upgrade A LOT. At which point they can usually use the same tools to defeat the hasp, and you're still compromised.
- giantg2 4y ago
  Same logic for basic deadbolts in the US (kiwkset/schlage/etc).
  - SAI_Peregrinus 4y ago
    Kwikset's SmartKey deadbolts are very common in hardware stores, and quite difficult to pick.
    - giantg2 4y ago
      Interesting. I hadn't heard about them.
      - SAI_Peregrinus 4y ago
        They're "purple belt" rank for the reddit /r/lockpicking belt ranking system[1]. That rank's description is "You are now picking locks that are categorically hi-sec. They have two or more discrete locking mechanisms and are considered unpickable by nearly every locksmith on the planet. You are helping new pickers frequently and sharing challenge locks." The SmartKey locks have two major flaws: a tiny endoscope camera can view the positions of the sliders and allow visual decoding of the correct position of each one independently (very specialized expensive equipment, about $350[2]), and it's possible to stick a shim in between the cylinder and body of some of the locks to tension the sidebar directly. Without a way to tension the sidebar it's extremely difficult to get any feedback. [1] https://www.reddit.com/r/lockpicking/wiki/beltranking#wiki_rankings https://www.reddit.com/r/lockpicking/wiki/beltranking#wiki_r... [2] https://www.lockpicks.com/catalog/product/view/_ignore_category/1/id/9195/s/kwikset-smartkey-decoder-by-locktech/ https://www.lockpicks.com/catalog/product/view/_ignore_categ...
- kube-system 4y ago
  Finding vulnerabilities in low security locks is just an academic exercise. If you need high security, you are buying a product very different than a master lock, and you need to consider the integrity of the entire system it is connected to. Low security locks work mainly by deterrent, and even if they were without vulnerability, the container you’re attaching it to probably is vulnerable. Brute force attacks are the much more common scenario against low security locks, and there’s not much of a low cost solution to that; it requires expensive materials: https://youtu.be/2guvwQvElA8 https://youtu.be/2guvwQvElA8 If you put an unpickable lock on sheet metal box, you’re spending more money, but not actually improving security. The reason that master locks are popular is because they are fairly reliable, easy to get keys for, have useful feature sets, etc. These are the features that commercial users often care about the most. They don’t want to spend more money to get an unpickable lock that interrupts their daily business when it inevitably gets dirty, keys are lost, etc. especially if it provides no additional resistance against an angle grinder.
- donthellbanme 4y ago
- Enginerrrd 4y ago
  >Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are. I think you misunderstand the threat model and/or use case. Most of the time I don't think anyone expects locks to do anything except keep honest people honest and dissuade the lowest level of opportunistic attacks. A sledge hammer is cheap. It can open just about any door. The difference between a cheap door and hardware and a high end security door might be ~5 minutes of hammer time. (Nothing can stop hammer time). Nothing will stop someone with time and tools. But if that threat model were a concern, we'd see a lot more bars on ground-level windows and the like. No one cares. Because 99.99% of the time, it's not going to be a problem. Now, there are definitely use cases out there where it makes a big difference and people want the security. But MOST of the time, people aren't trying to stop or slow down someone with bolt cutters, a bump key, or shim.
  - mnd999 4y ago
    A sledge hammer is not subtle. Someone breaking a door with a sledgehammer is very obviously breaking a door. It’s also very obvious in the aftermath that the door has been opened.
  - ramses0 4y ago
    A lock is a delaying device. A lock is (should be) tamper-evident. All locks can (probably) be bypassed (eg: sledgehammer), but it’s best if it is visible that tampering has occurred.
  - beardedwizard 4y ago
    Nit: isn't this a threat scenario? Where a composition of scenarios and mitigations relevant to a use case would be the model?
- lazide 4y ago
  The people who don't know don't care usually, or they'd be buying a lock that costs more than $5-20. Either because it's protecting something of low value, or they don't know how to quantify when something needs more value, or because it doesn't matter. For instance, if you have a shed with windows and a hasp on it, that it has a $10 master lock on it is the least of your security problems. If you're storing $100m in gold bars in said shed, putting the $10 master lock on it is also probably the least negligent thing you're probably doing.
Animats 4y ago
Ah, someone who watches Lock Picking Lawyer videos.
midasuni 4y ago
Click out of three

more_corn 4y ago

Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.

reidjs 4y ago
The more hassle involved with breaking the lock the harder it is to be steal, that makes sense. Don't forget about security by obscurity, though. Let's say a criminal with a bolt cutter finds their way to an unattended gym locker room and they can only have time to snip one or two locks. The majority of the lockers have generic Master Locks, a few have some exotic "ultra-secure" locks on them. Do they randomly snip a locker with a generic Master Lock, or do they pick the bright-orange-ultra-secure-lock-probably-hiding-a-tablet-and-laptop locker?
- giantg2 4y ago
  Wouldn't that be a bad example? That they could still snip the better locks seems like they're not really better. In general, you would want a lock that they would need a special tool that they didn't bring. For example, maybe the thief could have cut(saw) the higher end locks, but they only brought bolt cutters because they're faster and work on 90% of the locks.
  - johannes1234321 4y ago
    Not necessarily. The attack has to be expensive enough (in time, noise, ....) To be discouraging for making the attacker go elsewhere or not attacking at all.
    - giantg2 4y ago
      My point was that the example give involved "better" locks that were just as vulnerable as the cheaper ones.
  - lazide 4y ago
    Many better locks from a picking perspective are only mildly better from a physical security perspective. If someone has brought tools (portable angle grinder, hydraulic bolt cutters, or a prybar) sufficient to take out most locks, they'll take out most locks unless you upgrade A LOT. At which point they can usually use the same tools to defeat the hasp, and you're still compromised.
giantg2 4y ago
Same logic for basic deadbolts in the US (kiwkset/schlage/etc).
- SAI_Peregrinus 4y ago
  Kwikset's SmartKey deadbolts are very common in hardware stores, and quite difficult to pick.
  - giantg2 4y ago
    Interesting. I hadn't heard about them.
    - SAI_Peregrinus 4y ago
      They're "purple belt" rank for the reddit /r/lockpicking belt ranking system[1]. That rank's description is "You are now picking locks that are categorically hi-sec. They have two or more discrete locking mechanisms and are considered unpickable by nearly every locksmith on the planet. You are helping new pickers frequently and sharing challenge locks." The SmartKey locks have two major flaws: a tiny endoscope camera can view the positions of the sliders and allow visual decoding of the correct position of each one independently (very specialized expensive equipment, about $350[2]), and it's possible to stick a shim in between the cylinder and body of some of the locks to tension the sidebar directly. Without a way to tension the sidebar it's extremely difficult to get any feedback. [1] https://www.reddit.com/r/lockpicking/wiki/beltranking#wiki_rankings https://www.reddit.com/r/lockpicking/wiki/beltranking#wiki_r... [2] https://www.lockpicks.com/catalog/product/view/_ignore_category/1/id/9195/s/kwikset-smartkey-decoder-by-locktech/ https://www.lockpicks.com/catalog/product/view/_ignore_categ...
kube-system 4y ago
Finding vulnerabilities in low security locks is just an academic exercise. If you need high security, you are buying a product very different than a master lock, and you need to consider the integrity of the entire system it is connected to. Low security locks work mainly by deterrent, and even if they were without vulnerability, the container you’re attaching it to probably is vulnerable. Brute force attacks are the much more common scenario against low security locks, and there’s not much of a low cost solution to that; it requires expensive materials: https://youtu.be/2guvwQvElA8 https://youtu.be/2guvwQvElA8 If you put an unpickable lock on sheet metal box, you’re spending more money, but not actually improving security. The reason that master locks are popular is because they are fairly reliable, easy to get keys for, have useful feature sets, etc. These are the features that commercial users often care about the most. They don’t want to spend more money to get an unpickable lock that interrupts their daily business when it inevitably gets dirty, keys are lost, etc. especially if it provides no additional resistance against an angle grinder.
donthellbanme 4y ago
Enginerrrd 4y ago
>Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are. I think you misunderstand the threat model and/or use case. Most of the time I don't think anyone expects locks to do anything except keep honest people honest and dissuade the lowest level of opportunistic attacks. A sledge hammer is cheap. It can open just about any door. The difference between a cheap door and hardware and a high end security door might be ~5 minutes of hammer time. (Nothing can stop hammer time). Nothing will stop someone with time and tools. But if that threat model were a concern, we'd see a lot more bars on ground-level windows and the like. No one cares. Because 99.99% of the time, it's not going to be a problem. Now, there are definitely use cases out there where it makes a big difference and people want the security. But MOST of the time, people aren't trying to stop or slow down someone with bolt cutters, a bump key, or shim.
- mnd999 4y ago
  A sledge hammer is not subtle. Someone breaking a door with a sledgehammer is very obviously breaking a door. It’s also very obvious in the aftermath that the door has been opened.
- ramses0 4y ago
  A lock is a delaying device. A lock is (should be) tamper-evident. All locks can (probably) be bypassed (eg: sledgehammer), but it’s best if it is visible that tampering has occurred.
- beardedwizard 4y ago
  Nit: isn't this a threat scenario? Where a composition of scenarios and mitigations relevant to a use case would be the model?
lazide 4y ago
The people who don't know don't care usually, or they'd be buying a lock that costs more than $5-20. Either because it's protecting something of low value, or they don't know how to quantify when something needs more value, or because it doesn't matter. For instance, if you have a shed with windows and a hasp on it, that it has a $10 master lock on it is the least of your security problems. If you're storing $100m in gold bars in said shed, putting the $10 master lock on it is also probably the least negligent thing you're probably doing.

Animats 4y ago

Ah, someone who watches Lock Picking Lawyer videos.

midasuni 4y ago

Click out of three