3 ms·

Except here the key was weakened to satisfy export requirements, without telling users. So they advertise an 80bit key, but secretly and intentionally use some

by lokar 3y ago

Except here the key was weakened to satisfy export requirements, without telling users. So they advertise an 80bit key, but secretly and intentionally use something much weaker. A back door

lazide 3y ago
Should I not mention Masterlocks 'high security' line, which can usually be picked in seconds by anyone with a paperclip and 15 minutes to an hour of training? Or the numerous 'high security' locks with trivial bypasses?
- dylan604 3y ago
  now do TSA locks
  - lazide 3y ago
    My favorite part of TSA locks is there are only 7 different keys. So if you lose your key in the airport, if you have more than a handful of people near you, you don't even need to know how to pick or break it. Someone has your key already! [https://techcrunch.com/2016/07/27/security-experts-have-cloned-all-seven-tsa-master-keys/ https://techcrunch.com/2016/07/27/security-experts-have-clon...] Or, just buy the replacement on amazon I guess [https://www.amazon.com/tsa-key/s?k=tsa+key https://www.amazon.com/tsa-key/s?k=tsa+key] Frankly, it's probably better to just use a random re-usable zip-tie. At least then you won't figure out you lost your 'key' somewhere inconvenient.
    - dylan604 3y ago
      a TSA lock is nothing better than a fancy zip tie. except, when the TSA inspects your back, they will not use a new zip tie after cutting yours off. so you're SOL if you were hoping the zippers would stay together, but they will at least re-lock the TSA lock so the zippers will stay together.
    - sneak 3y ago
      End users don't use keys with TSA locks. They use the combination. The key way is only for TSA use when the combination is unknown.
      - lazide 3y ago
        Yes and no. [https://www.amazon.com/Master-Lock-Padlock-TSA-Accepted-4683Q/dp/B000HWPJRU/ref=sr_1_10?crid=2MM5DN803MI72&keywords=tsa+lock%5C&qid=1690387351&sprefix=tsa+l%2Caps%2C224&sr=8-10 https://www.amazon.com/Master-Lock-Padlock-TSA-Accepted-4683...] https://www.amazon.com/Pack-Approved-Luggage-Locks-Travel/dp/B01N5YBGLZ/ref=sr_1_19_sspa?crid=2MM5DN803MI72&keywords=tsa%2Block%5C&qid=1690387404&sprefix=tsa%2Bl%2Caps%2C224&sr=8-19-spons&sp_csd=d2lkZ2V0TmFtZT1zcF9tdGY&th=1 https://www.amazon.com/Pack-Approved-Luggage-Locks-Travel/dp... But good point. I haven't bothered with one in a long time.
    - singleshot_ 3y ago
      Knapheide truck service bodies only have ten keys. I suspect this model is a lot more common than you might hope.
- mschuster91 3y ago
  According to Lock Picking Lawyer, a wave rake or a comb are enough to defeat a MasterLock without training, suspicion or major cost...
  - lazide 3y ago
    He's not wrong. It does take a few minutes for most people to learn how to use the wave rake correctly (there are many bad ways), and if you want to learn how to do it for any arbitrary master lock reliably you'd need some practice. Occasionally you'll run across one that takes a little skill to get open, and it's always the one you expected to be easy.
  - OkayPhysicist 3y ago
    Most masterlocks are even easier than that: tear an aluminum can in half (or if you're feeling civilized, cut a strip) and you've got a shim that works on most cheap padlocks. And that's not counting the ones that can be opened with a hard strike (say, from another masterlock). Any company competing in the cheap-tier lock segment shouldn't be trusted, for ANY of their locks. They'll leverage the name recognition they get from the cheap locks to try and get you to choose their more expensive, "higher security" locks, but in many cases they'll be selling you a just as shitty product.
- mcpackieh 3y ago
  Masterlocks aren't shit because the government makes them so with rules or regulations. Masterlocks are shit because people want a cheap lock and mostly don't know how to evaluate lock quality. The government is just going to cut the lock off, and if they want to go through your front door they're just going to kick it in. They don't bother with lock picking, not even on trivial locks. There is no government conspiracy to compromise lock security, except in the specific case of "TSA locks"
  - lazide 3y ago
    I'm not saying it's a conspiracy. I'm saying there is no need for there to be a conspiracy. At least with physical locks, usually. If you think things like the S&G code books for their high security safe locks aren't widely available in certain gov't agencies, then you're not paying attention. But the gov't also doesn't care to make it better except when it helps them (when they definitely could and frankly should if they cared for individuals rights or protection!), because the current situation is very convenient for them. And if you think cops (or federal agents) don't occasionally 'take a peek' where they aren't supposed to look using that to their advantage (both physical locks using lock picking sometimes, but usually bypasses and the like, and crypto), we've got a LOT of evidence to contradict that. Some circumstantial, some, uh... not. [https://nypost.com/video/lock-picking-cops-charged-after-kicking-in-door-and-handcuffing-man/ https://nypost.com/video/lock-picking-cops-charged-after-kic...] They're usually not doing it while their body cameras are on though. Assuming they're not that dumb, if they find something juicy, they'll of course figure out a way to come back with a warrant and bust the door down so they can admit the evidence, or 'luckily' show up a the right time to catch someone during a 'routine traffic stop' or similar. Assuming they're being above board. [https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction] Being able to come up with Probable Cause on anyone is actively taught and a prized skill at most Police Academies.
    - matt-attack 3y ago
      A google search for S&G code Books turned up nothing. Any more info? Is that related to mechanical or electronic dials?

by lokar 3y ago

Except here the key was weakened to satisfy export requirements, without telling users. So they advertise an 80bit key, but secretly and intentionally use something much weaker. A back door

lazide 3y ago

Should I not mention Masterlocks 'high security' line, which can usually be picked in seconds by anyone with a paperclip and 15 minutes to an hour of training? Or the numerous 'high security' locks with trivial bypasses?

dylan604 3y ago
now do TSA locks
- lazide 3y ago
  My favorite part of TSA locks is there are only 7 different keys. So if you lose your key in the airport, if you have more than a handful of people near you, you don't even need to know how to pick or break it. Someone has your key already! [https://techcrunch.com/2016/07/27/security-experts-have-cloned-all-seven-tsa-master-keys/ https://techcrunch.com/2016/07/27/security-experts-have-clon...] Or, just buy the replacement on amazon I guess [https://www.amazon.com/tsa-key/s?k=tsa+key https://www.amazon.com/tsa-key/s?k=tsa+key] Frankly, it's probably better to just use a random re-usable zip-tie. At least then you won't figure out you lost your 'key' somewhere inconvenient.
  - dylan604 3y ago
    a TSA lock is nothing better than a fancy zip tie. except, when the TSA inspects your back, they will not use a new zip tie after cutting yours off. so you're SOL if you were hoping the zippers would stay together, but they will at least re-lock the TSA lock so the zippers will stay together.
  - sneak 3y ago
    End users don't use keys with TSA locks. They use the combination. The key way is only for TSA use when the combination is unknown.
    - lazide 3y ago
      Yes and no. [https://www.amazon.com/Master-Lock-Padlock-TSA-Accepted-4683Q/dp/B000HWPJRU/ref=sr_1_10?crid=2MM5DN803MI72&keywords=tsa+lock%5C&qid=1690387351&sprefix=tsa+l%2Caps%2C224&sr=8-10 https://www.amazon.com/Master-Lock-Padlock-TSA-Accepted-4683...] https://www.amazon.com/Pack-Approved-Luggage-Locks-Travel/dp/B01N5YBGLZ/ref=sr_1_19_sspa?crid=2MM5DN803MI72&keywords=tsa%2Block%5C&qid=1690387404&sprefix=tsa%2Bl%2Caps%2C224&sr=8-19-spons&sp_csd=d2lkZ2V0TmFtZT1zcF9tdGY&th=1 https://www.amazon.com/Pack-Approved-Luggage-Locks-Travel/dp... But good point. I haven't bothered with one in a long time.
  - singleshot_ 3y ago
    Knapheide truck service bodies only have ten keys. I suspect this model is a lot more common than you might hope.
mschuster91 3y ago
According to Lock Picking Lawyer, a wave rake or a comb are enough to defeat a MasterLock without training, suspicion or major cost...
- lazide 3y ago
  He's not wrong. It does take a few minutes for most people to learn how to use the wave rake correctly (there are many bad ways), and if you want to learn how to do it for any arbitrary master lock reliably you'd need some practice. Occasionally you'll run across one that takes a little skill to get open, and it's always the one you expected to be easy.
- OkayPhysicist 3y ago
  Most masterlocks are even easier than that: tear an aluminum can in half (or if you're feeling civilized, cut a strip) and you've got a shim that works on most cheap padlocks. And that's not counting the ones that can be opened with a hard strike (say, from another masterlock). Any company competing in the cheap-tier lock segment shouldn't be trusted, for ANY of their locks. They'll leverage the name recognition they get from the cheap locks to try and get you to choose their more expensive, "higher security" locks, but in many cases they'll be selling you a just as shitty product.
mcpackieh 3y ago
Masterlocks aren't shit because the government makes them so with rules or regulations. Masterlocks are shit because people want a cheap lock and mostly don't know how to evaluate lock quality. The government is just going to cut the lock off, and if they want to go through your front door they're just going to kick it in. They don't bother with lock picking, not even on trivial locks. There is no government conspiracy to compromise lock security, except in the specific case of "TSA locks"
- lazide 3y ago
  I'm not saying it's a conspiracy. I'm saying there is no need for there to be a conspiracy. At least with physical locks, usually. If you think things like the S&G code books for their high security safe locks aren't widely available in certain gov't agencies, then you're not paying attention. But the gov't also doesn't care to make it better except when it helps them (when they definitely could and frankly should if they cared for individuals rights or protection!), because the current situation is very convenient for them. And if you think cops (or federal agents) don't occasionally 'take a peek' where they aren't supposed to look using that to their advantage (both physical locks using lock picking sometimes, but usually bypasses and the like, and crypto), we've got a LOT of evidence to contradict that. Some circumstantial, some, uh... not. [https://nypost.com/video/lock-picking-cops-charged-after-kicking-in-door-and-handcuffing-man/ https://nypost.com/video/lock-picking-cops-charged-after-kic...] They're usually not doing it while their body cameras are on though. Assuming they're not that dumb, if they find something juicy, they'll of course figure out a way to come back with a warrant and bust the door down so they can admit the evidence, or 'luckily' show up a the right time to catch someone during a 'routine traffic stop' or similar. Assuming they're being above board. [https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction] Being able to come up with Probable Cause on anyone is actively taught and a prized skill at most Police Academies.
  - matt-attack 3y ago
    A google search for S&G code Books turned up nothing. Any more info? Is that related to mechanical or electronic dials?