9 ms·

Full title: Deadbolt Locks Offer False Sense of Security… … when they are not installed properly. Mythbusters inadvertently demonstrated the problems of the "

by Syonyk 4y ago

Full title: Deadbolt Locks Offer False Sense of Security… … when they are not installed properly. Mythbusters inadvertently demonstrated the problems of the "short" screws that come with most strike plates in one of their episodes. They were testing "bashing through doors," and built a bunch of door frames, put doors in them, added locks, and proceeded to learn to slam through them - with rather great success, splitting the door trim. Except for one, in which one of them rather nicely injured themselves (either Adam or Tory, can't recall which at the moment). The difference? 3" long screws into the studs, instead of the 3/4" or 1" screws that the others used. I went through and replaced the screws securing all my strike plates after that episode. Though, for most homes, all a lock will do is keep out the people who don't want to be there in the first place. They can be good if you don't want someone snooping around without you noticing, but unless you go out of your way to get "not abysmally shitty locks," anyone with a tiny bit of skill and a bump key or bump gun can pop your doors anyway without you noticing. It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well.

owlninja 4y ago
>It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. I've never looked into these much, care to expand a bit on why?
- maxfurman 4y ago
  Depends on the exact make and model, but they have all the same problems as any other IoT device - insecure defaults, poor vendor support, users that can't install an update even if one is available, etc. etc. And these devices aren't just inside your house, they're right on the door! I wouldn't be surprised if a dedicated hacker could remotely open nearly any connected door lock
  - owlninja 4y ago
    Yea that makes sense! It is definitely a 'device' you want to work no matter what.
- suyula 4y ago
  You've either got a company with experience with locks trying to make a good IoT product, or a company with IoT experience trying to make a good lock. The issue isn't so much that the intruder can hack the lock, as that the intruder can bypass the smarts of the lock with age-old techniques that had been bred out of traditional lock designs.
  - rootusrootus 4y ago
    Eh, just get a Schlage z-wave lock and be done with it. The electronic bit is just a motor that can push a traditional deadbolt mechanism, it's otherwise like any other schlage deadbolt. Also, there are no default codes, every lock comes with unique PINs. And since it's z-wave, not wifi, it's not connected to any cloud.
digitallyfree 4y ago
The use of a standard residental lock is to prevent someone from directly opening your door. E.g. neighbor, aggressive door-to-door sales, etc. It's not intended to prevent someone from breaking in.
- copperx 4y ago
  That's obvious, as most walls in US are just drywall. You can kick your way into a house without touching any doors or breaking any glass. Houses in the US aren't made to prevent break ins. If you want to prevent a break in, first construct a fence around your house. Then add steel window protection. Only then you should worry about deadbolts.
  - dangerlibrary 4y ago
    Houses in the US are sheathed with OSB or plywood. There may exist very low-quality homes that are sheathed with siding, but even that would need to meet shearing stability requirements that you can't meet with drywall alone (and nobody puts drywall on the exterior of a home). So, if you can kick through an 16" OC mounted sheet of 5/8ths OSB, then yeah, maybe you could kick your way into a house?
    - zdragnar 4y ago
      Exterior sheathing is a structural element. Any stick built house without it is going to struggle under the weight of a roof and a stiff breeze.
      - frosted-flakes 4y ago
        Stick-built houses in New Zealand (maybe Australia too?) don't use exterior sheathing. They rely on more horizontal cross members between studs and the interior drywall for shear strength. The drywall is specially rated for shear strength applications, and there needs to be screws every 5cm at the corners.
        4y ago
silisili 4y ago
I thought about doing it a while back, but then looked over at the 8ft of windows right next to the door. Seems silly to spend effort on the door when the windows are just as kickable. All of that said, just bought a Kwikset Halo and it came with extra long screws, for anyone curious. I'm pretty happy with it.
- rkagerer 4y ago
  Any good smart lock recommendations that wired instead of wireless?
  - silisili 4y ago
    Sorry, I don't. I leaned Kwikset because of their smartkey system. You can rekey the lock to match your existing home keys. I'm not sure if any other brand does that, but it was so simple to do I'm a Kwikset guy now(even their newer dumb locks have this, too).
    - rootusrootus 4y ago
      Schlage makes z-wave locks that are traditional schlage locks in every other way, including the key. I had all mine keyed to match by my local locksmith.
    - Fezzik 4y ago
      Another upside to the newer versions of the Kwikset smartkey systems: they are moderately difficult to force open, even for a pro, if they are trying to be remotely discreet - I locked myself out, deadbolt and doorknob, and it took a professional locksmith more than 10 minutes to get my front door open. Obviously drills and/or bashing nullify all of this, but I’m happy to have a secure lock.
  - rootusrootus 4y ago
    Not wired, but I recommend the schlage z-wave deadbolts. No wifi madness, so if you want to access them remotely (I do), you have to set up some kind of home automation server and then VPN to it. No cloud for me, and encrypted z-wave is secure enough. If someone really wants in, they'll smash the window next to my front door and reach through and turn the deadbolt. Nobody's going to bother trying to hack z-wave.
WWLink 4y ago
> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. Are they really though? Having something tell me that my front door was unlocked when I know nobody is home and nobody is SUPPOSED to be home, is yet another handy piece of info. I mean, a good alarm system can fix that as well. Plus smart locks can lock themselves. Plus usually they're not any worse than any other lock you could get at home depot.
- pram 4y ago
  Agreed! Mine uses a keypad, and it also tells me who actually opened the door. Has been very useful for letting my parents and a nanny in without any nonsense.
majormajor 4y ago
> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. Given the ease of picking most locks anyway, any of those that could be set up to send a notification when locked/unlocked would at least add some logging.
rootusrootus 4y ago
> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. I disagree. Even the most technologically savvy intruder isn't going to hack my bluetooth/wifi/zwave/whatever lock, they're just going to break the lock or window. And on the bright side, I can tell remotely if my deadbolts are locked, and then lock them if necessary.
- yakak 4y ago
  I think you have the same problem as car owners. Seeing these occasionally it isn't worth the trouble. Once a prevalence of a defect is popular enough (or barely popular but easy to locate) and indictive of a good bounty it makes more sense for some to drop universal attacks and focus on only these lower visibility/noise attacks.
  - marcus0x62 4y ago
    That’s not a problem - it is a completely rational threat model.
- bradknowles 4y ago
  Have you watched the Lock Picking Lawyers videos on YouTube? Have you even heard of LPL?
spacemanmatt 4y ago
I replaced mine with 3" deck screws when I moved in. Still amazed at how horrible the standard 3/4" screw is in this situation.
Throwawayaerlei 4y ago
"Though, for most homes, all a lock will do is keep out the people who don't want to be there in the first place. They can be good if you don't want someone snooping around without you noticing, but unless you go out of your way to get "not abysmally shitty locks," anyone with a tiny bit of skill and a bump key or bump gun can pop your doors anyway without you noticing." For insurance purposes if nothing else, I want there to be solid evidence someone forced entry. So while my heavy duty strike plate and three hinges on the other side aren't anchored as well as I'd like and there's pretty easy access through a porch window, it's secured by an Abloy lock from https://securitysnobs.com/ https://securitysnobs.com/ so force will be required. And I can lend out a key with confidence that if I get it back, it won't have been copied in the meanwhile.

by Syonyk 4y ago

owlninja 4y ago

>It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. I've never looked into these much, care to expand a bit on why?

maxfurman 4y ago
Depends on the exact make and model, but they have all the same problems as any other IoT device - insecure defaults, poor vendor support, users that can't install an update even if one is available, etc. etc. And these devices aren't just inside your house, they're right on the door! I wouldn't be surprised if a dedicated hacker could remotely open nearly any connected door lock
- owlninja 4y ago
  Yea that makes sense! It is definitely a 'device' you want to work no matter what.
suyula 4y ago
You've either got a company with experience with locks trying to make a good IoT product, or a company with IoT experience trying to make a good lock. The issue isn't so much that the intruder can hack the lock, as that the intruder can bypass the smarts of the lock with age-old techniques that had been bred out of traditional lock designs.
- rootusrootus 4y ago
  Eh, just get a Schlage z-wave lock and be done with it. The electronic bit is just a motor that can push a traditional deadbolt mechanism, it's otherwise like any other schlage deadbolt. Also, there are no default codes, every lock comes with unique PINs. And since it's z-wave, not wifi, it's not connected to any cloud.

digitallyfree 4y ago

The use of a standard residental lock is to prevent someone from directly opening your door. E.g. neighbor, aggressive door-to-door sales, etc. It's not intended to prevent someone from breaking in.

copperx 4y ago
That's obvious, as most walls in US are just drywall. You can kick your way into a house without touching any doors or breaking any glass. Houses in the US aren't made to prevent break ins. If you want to prevent a break in, first construct a fence around your house. Then add steel window protection. Only then you should worry about deadbolts.
- dangerlibrary 4y ago
  Houses in the US are sheathed with OSB or plywood. There may exist very low-quality homes that are sheathed with siding, but even that would need to meet shearing stability requirements that you can't meet with drywall alone (and nobody puts drywall on the exterior of a home). So, if you can kick through an 16" OC mounted sheet of 5/8ths OSB, then yeah, maybe you could kick your way into a house?
  - zdragnar 4y ago
    Exterior sheathing is a structural element. Any stick built house without it is going to struggle under the weight of a roof and a stiff breeze.
    - frosted-flakes 4y ago
      Stick-built houses in New Zealand (maybe Australia too?) don't use exterior sheathing. They rely on more horizontal cross members between studs and the interior drywall for shear strength. The drywall is specially rated for shear strength applications, and there needs to be screws every 5cm at the corners.
      - 4y ago

silisili 4y ago

I thought about doing it a while back, but then looked over at the 8ft of windows right next to the door. Seems silly to spend effort on the door when the windows are just as kickable. All of that said, just bought a Kwikset Halo and it came with extra long screws, for anyone curious. I'm pretty happy with it.

rkagerer 4y ago
Any good smart lock recommendations that wired instead of wireless?
- silisili 4y ago
  Sorry, I don't. I leaned Kwikset because of their smartkey system. You can rekey the lock to match your existing home keys. I'm not sure if any other brand does that, but it was so simple to do I'm a Kwikset guy now(even their newer dumb locks have this, too).
  - rootusrootus 4y ago
    Schlage makes z-wave locks that are traditional schlage locks in every other way, including the key. I had all mine keyed to match by my local locksmith.
  - Fezzik 4y ago
    Another upside to the newer versions of the Kwikset smartkey systems: they are moderately difficult to force open, even for a pro, if they are trying to be remotely discreet - I locked myself out, deadbolt and doorknob, and it took a professional locksmith more than 10 minutes to get my front door open. Obviously drills and/or bashing nullify all of this, but I’m happy to have a secure lock.
- rootusrootus 4y ago
  Not wired, but I recommend the schlage z-wave deadbolts. No wifi madness, so if you want to access them remotely (I do), you have to set up some kind of home automation server and then VPN to it. No cloud for me, and encrypted z-wave is secure enough. If someone really wants in, they'll smash the window next to my front door and reach through and turn the deadbolt. Nobody's going to bother trying to hack z-wave.

WWLink 4y ago

> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. Are they really though? Having something tell me that my front door was unlocked when I know nobody is home and nobody is SUPPOSED to be home, is yet another handy piece of info. I mean, a good alarm system can fix that as well. Plus smart locks can lock themselves. Plus usually they're not any worse than any other lock you could get at home depot.

pram 4y ago
Agreed! Mine uses a keypad, and it also tells me who actually opened the door. Has been very useful for letting my parents and a nanny in without any nonsense.

majormajor 4y ago

> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. Given the ease of picking most locks anyway, any of those that could be set up to send a notification when locked/unlocked would at least add some logging.

rootusrootus 4y ago

> It should go without saying that the various internet connected and smartphone enabled locks are a security comedy if you care about security as well. I disagree. Even the most technologically savvy intruder isn't going to hack my bluetooth/wifi/zwave/whatever lock, they're just going to break the lock or window. And on the bright side, I can tell remotely if my deadbolts are locked, and then lock them if necessary.

yakak 4y ago
I think you have the same problem as car owners. Seeing these occasionally it isn't worth the trouble. Once a prevalence of a defect is popular enough (or barely popular but easy to locate) and indictive of a good bounty it makes more sense for some to drop universal attacks and focus on only these lower visibility/noise attacks.
- marcus0x62 4y ago
  That’s not a problem - it is a completely rational threat model.
bradknowles 4y ago
Have you watched the Lock Picking Lawyers videos on YouTube? Have you even heard of LPL?

spacemanmatt 4y ago

I replaced mine with 3" deck screws when I moved in. Still amazed at how horrible the standard 3/4" screw is in this situation.

Throwawayaerlei 4y ago

"Though, for most homes, all a lock will do is keep out the people who don't want to be there in the first place. They can be good if you don't want someone snooping around without you noticing, but unless you go out of your way to get "not abysmally shitty locks," anyone with a tiny bit of skill and a bump key or bump gun can pop your doors anyway without you noticing." For insurance purposes if nothing else, I want there to be solid evidence someone forced entry. So while my heavy duty strike plate and three hinges on the other side aren't anchored as well as I'd like and there's pretty easy access through a porch window, it's secured by an Abloy lock from https://securitysnobs.com/ https://securitysnobs.com/ so force will be required. And I can lend out a key with confidence that if I get it back, it won't have been copied in the meanwhile.