3 ms·

My point is that every single lock (or password) is susceptible to trying every key combination: the only protection against that is to increase the number of c

My point is that every single lock (or password) is susceptible to trying every key combination: the only protection against that is to increase the number of combinations available. Sure, if a particular lock is more prone to brute-forcing due to its design than an average lock (eg. side channel attacks like timing attacks with passwords), one could surely qualify that as a pickable lock (or a "weak" password scheme). So I am not saying that a brute-forceable lock is not pickable, but that those are independent since every lock is brute-forceable. Sure, devil is in the details, and what seems like brute forcing is sometimes something smarter, but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Again, maybe I am totally off base with regards to terminology as used in lock picking circles, but this is how I would differentiate between different approaches.

bryans 4y ago
> I am not sure if I would call trying all combinations "picking s lock" [...] that would not make the lock pickable if I was to talk about it [...] but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. [...] So I am not saying that a brute-forceable lock is not pickable You quite literally said it's not pickable and not even lockpicking at all, and have even reiterated as much in this new comment, so please don't pretend otherwise. > but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. All of the dictionaries and an entire industry of professional locksmiths disagree with that statement. Given that you've twice admitted to having "no clue about locks," I'm not sure why you continue to insist that uninformed personal opinions are somehow factually obvious. > Sure, if a particular lock is more prone to brute-forcing due to its design than an average lock (eg. side channel attacks like timing attacks with passwords), one could surely qualify that as a pickable lock (or a "weak" password scheme). You keep trying to apply the concepts of digital authentication to locksmithing, but they're just not applicable in the way you're describing. The "average lock" doesn't exist, and certainly can't be used as a basis for determining the threshold of whether an entirely different lock qualifies as pickable. As far as I can determine, your opinion boils down to believing that successfully brute-forcing a lock with only 100 possible combinations does qualify as lockpicking, but successfully brute-forcing a lock with 1,000,000 possible combinations somehow doesn't qualify as lockpicking. I'm not sure how that position is justifiable, made worse that the lock being discussed is notably prone to brute force and within a very reasonable amount of time. So, if "weakness" is your qualification for a lock being pickable, then you're arguing against your own assertion that this lock is unpickable.
- necovek 4y ago
  >> So I am not saying that a brute-forceable lock is not pickable > You quite literally said it's not pickable and not even lockpicking at all I think you have a problem with me communicating using (formal) logic. If I say that A (lock is brute-forceable) is true, I am not making a statement on whether B (lock is pickable) is true: it could be either true or false. When I say that B is not true when A is, it means that B does not follow from A. As an admittedly non-expert, I find it useless to consider something that's a tautology (always true, lock is bruteforceable) as a special skill (lock-picking), and I complain of the terminology. IOW, it is my personal opinion that this is a useless terminology if it's used like that. > As far as I can determine, your opinion boils down to believing that successfully brute-forcing a lock with only 100 possible combinations does qualify as lockpicking But I explicitly clarified my position, and you even quote that twice: > but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Which means that a lock with 100 combinations, and you try all 100 of them, you are not lock picking, but if you reduce that to trying out 50 combinations, then you are (again, I hope I don't have to highlight how this is my opinion of the terminology: I am repeatedly claiming I am no authority, but I can still have an opinion on language, along with the argument I am presenting). I apologize if my use of somewhat general language confuses you: my background in formal maths influences the way I communicate sometimes.
  - bryans 4y ago
    > I think you have a problem with me communicating using (formal) logic. The problem is that what you're saying is contradictory to itself. You're conveniently ignoring all of the flaws being pointed out, and instead reiterating the same argument ad nauseam, while also moving goal posts and morphing qualifiers as needed. > but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Which means that a lock with 100 combinations, and you try all 100 of them, you are not lock picking, but if you reduce that to trying out 50 combinations, then you are The fundamental concept which you keep acknowledging but refuse to accept, is that brute force is a reduction of the problem space. In fact, it's a >99% guarantee to be reduced. Whereas the other lockpicking methods with a reduced space are not actually guaranteed to defeat the lock in a shorter amount of time, if at all. You even acknowledged in your first comment that brute-forcing a limited set will, on average, require half as many attempts. Since your qualification for being pickable is that the problem space is reduced by half, then brute-forcing meets your definition of lockpicking half of the time. At that point, it's irrefutably classifiable as lockpicking, with the understanding that other methods may be more (or less) effective. And you're still ignoring that the entire point of the lock being discussed is that traditional lockpicking methods wouldn't work. At all. Yet, when presented with an option to defeat the lock in less than 4 hours, your reaction was to repeatedly state that it doesn't even count as lockpicking. I don't know what else to say.
8note 4y ago
To brute force it, don't you need to know the alphabet used? Without a few sample keys, you won't know which heights to set to your brute force keys You can however use other properties of the lock to avoid brute forcing it, and get more like a gradient descent: A blank key will be scratched by pins that are set at the wrong height, and you can keep filing and scratching till it's at the right value

bryans 4y ago

> I am not sure if I would call trying all combinations "picking s lock" [...] that would not make the lock pickable if I was to talk about it [...] but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. [...] So I am not saying that a brute-forceable lock is not pickable You quite literally said it's not pickable and not even lockpicking at all, and have even reiterated as much in this new comment, so please don't pretend otherwise. > but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. All of the dictionaries and an entire industry of professional locksmiths disagree with that statement. Given that you've twice admitted to having "no clue about locks," I'm not sure why you continue to insist that uninformed personal opinions are somehow factually obvious. > Sure, if a particular lock is more prone to brute-forcing due to its design than an average lock (eg. side channel attacks like timing attacks with passwords), one could surely qualify that as a pickable lock (or a "weak" password scheme). You keep trying to apply the concepts of digital authentication to locksmithing, but they're just not applicable in the way you're describing. The "average lock" doesn't exist, and certainly can't be used as a basis for determining the threshold of whether an entirely different lock qualifies as pickable. As far as I can determine, your opinion boils down to believing that successfully brute-forcing a lock with only 100 possible combinations does qualify as lockpicking, but successfully brute-forcing a lock with 1,000,000 possible combinations somehow doesn't qualify as lockpicking. I'm not sure how that position is justifiable, made worse that the lock being discussed is notably prone to brute force and within a very reasonable amount of time. So, if "weakness" is your qualification for a lock being pickable, then you're arguing against your own assertion that this lock is unpickable.

necovek 4y ago
>> So I am not saying that a brute-forceable lock is not pickable > You quite literally said it's not pickable and not even lockpicking at all I think you have a problem with me communicating using (formal) logic. If I say that A (lock is brute-forceable) is true, I am not making a statement on whether B (lock is pickable) is true: it could be either true or false. When I say that B is not true when A is, it means that B does not follow from A. As an admittedly non-expert, I find it useless to consider something that's a tautology (always true, lock is bruteforceable) as a special skill (lock-picking), and I complain of the terminology. IOW, it is my personal opinion that this is a useless terminology if it's used like that. > As far as I can determine, your opinion boils down to believing that successfully brute-forcing a lock with only 100 possible combinations does qualify as lockpicking But I explicitly clarified my position, and you even quote that twice: > but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Which means that a lock with 100 combinations, and you try all 100 of them, you are not lock picking, but if you reduce that to trying out 50 combinations, then you are (again, I hope I don't have to highlight how this is my opinion of the terminology: I am repeatedly claiming I am no authority, but I can still have an opinion on language, along with the argument I am presenting). I apologize if my use of somewhat general language confuses you: my background in formal maths influences the way I communicate sometimes.
- bryans 4y ago
  > I think you have a problem with me communicating using (formal) logic. The problem is that what you're saying is contradictory to itself. You're conveniently ignoring all of the flaws being pointed out, and instead reiterating the same argument ad nauseam, while also moving goal posts and morphing qualifiers as needed. > but only when you are able to reduce the problem space from the full set of combinations would I say you are picking a lock. Which means that a lock with 100 combinations, and you try all 100 of them, you are not lock picking, but if you reduce that to trying out 50 combinations, then you are The fundamental concept which you keep acknowledging but refuse to accept, is that brute force is a reduction of the problem space. In fact, it's a >99% guarantee to be reduced. Whereas the other lockpicking methods with a reduced space are not actually guaranteed to defeat the lock in a shorter amount of time, if at all. You even acknowledged in your first comment that brute-forcing a limited set will, on average, require half as many attempts. Since your qualification for being pickable is that the problem space is reduced by half, then brute-forcing meets your definition of lockpicking half of the time. At that point, it's irrefutably classifiable as lockpicking, with the understanding that other methods may be more (or less) effective. And you're still ignoring that the entire point of the lock being discussed is that traditional lockpicking methods wouldn't work. At all. Yet, when presented with an option to defeat the lock in less than 4 hours, your reaction was to repeatedly state that it doesn't even count as lockpicking. I don't know what else to say.

8note 4y ago

To brute force it, don't you need to know the alphabet used? Without a few sample keys, you won't know which heights to set to your brute force keys You can however use other properties of the lock to avoid brute forcing it, and get more like a gradient descent: A blank key will be scratched by pins that are set at the wrong height, and you can keep filing and scratching till it's at the right value