Researchers, regardless of the discipline, often work at the edge of what's possible, not what's practical. Decade after decade, we have consumed news about researchers finding ways to cure cancer, immunize against HIV, break encryption with quantum computing, etc. It will be a couple more decades before any of these endeavours come to fruition. Just remember how long researchers have been working on quantum computers and how much longer they need to work to create something even remotely useful.
Science news hints how the world might look like half a century or a century in the future, not next year. For that, you need to read corporate announcements.
You mince your words a lot mate.
The simple reality is that if you’re going to get robbed, chances are the robber is going to use a pry bar to ruin the door jam or break your window. Locks are about keeping honest citizens honest.
I've heard that, and I get it, but I don't think that's actually it. Locks are about making it too inconvenient or risky to be worth stealing or breaking into. I guess some people might just all the sudden steal something if given the chance but would never do so otherwise, but usually, it's people who are already willing to steal if the difficulty and stakes are low enough.
No, locks are about making forcible entry easier than covert entry, so that your insurance company pays out. The primary function of the lock is tamper evidence. The secondary function is deterrence (easier to get into an unlocked place than a locked one). Actually preventing entry isn't the point for any but the strongest locks, and even then they only serve to delay entry.
Besides, a lot of locks are so easy to pick that you might as well do it instead of making a lot of noise forcing it open.
The thing is, those locks are more expensive to produce, both in terms of metallurgy and skilled labor. Germany has done a solid job of ensuring that it retains local experience in both areas, through a combination of tariffs, a robust skilled-trade education system, and consumer preference for domestic goods.
American consumers, on the other hand, tend to be very price-sensitive, and Master locks are cheap.
That's not to say that there aren't some rock-solid American locks, but Germany and Japan tend to be the leaders here (and for the same reason)
If you're keen to learn more about locks and security, I suggest having a look at LockPickingLawyer on YouTube: https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ
The most common locks in America are all of the pin-tumbler type, which essentially provides "security theater"-level protection. They are very easy to pick with very little skill or specialized tools required, and most of them can be even be bumped in 5 seconds. [1] When people got concerned about the security of pin-tumbler locks, American lock manufacturers generally did not move to more secure lock types (or, if some did, they were probably outcompeted by other companies), they just added various extra "security features" on top of the fundamentally broken mechanism. Some of those "security features" are able to stop a curious 12-year old who spent 4 hours learning lockpicking on youtube, none of them will actually do much to deter a professional. On the positive side, pin-tumbler locks are really cheap and easy to use.
My native Finland has mostly standardized on Abloy's (now part of Assa Abloy) disc-detainer style locks. [2] They are somewhat more expensive than pin-tumbler style locks, but are dramatically more secure. This is because they typically have many orders of magnitude larger key spaces, and are designed in such a way that it is very hard to get feedback by manipulating the lock. They, too, can be picked, but this generally requires hard-to-acquire specialized tools, a very high skill level and a lot more time than weaker locks. They are hard enough to pick that if you lock yourself out, and don't have the coding of the lock stored somewhere, you basically cannot hire a locksmith to pick the lock for you -- you just have to break into your house some other way.
Why have Abloy locks not been a runaway success in America, replacing all the insecure locks? It turns out that the security of a lock really does not matter. Almost all American home locks are comically weak, yet almost no criminals ever pick or bump locks. So the additional security doesn't actually buy you much, if anything. However, Abloy locks have real disadvantages. For one, they require much more fine machining, which makes them more expensive. On top of that, they are somewhat more complex to use, as the locks have no internal springs (which is part of what makes them secure), so the lock has some persistent state or "memory". If the lock has last been normally locked or unlocked, you can just insert the key, turn, and pull it out. However, if I insert the key fully, and then extract it slightly, turn a little, and then fully pull it out, you can only insert the key up to that same point, and you then have to turn it straight before you can insert it further. If I do this individually to every disc with different rotations, it's going to take you a while. This can happen on it's own for, say, a padlock on a container that jostles as it's being transported. Everyone in Finland learns how to open a scrambled Abloy lock with the key right about at the time they get their first key, and most of us probably don't actually think of this as a skill, but do you want to try selling these locks to people who were not just taught how this works by their parents?
So why did Finland standardize on such an expensive, idiosynchratic lock type? It was invented by a Finnish company, their manufacture was domestic, and there were periods when Finland was really starved for foreign currency. It's all network effects from there.
But yeah, every now and then there is a news story or a paper of how you can open an American door lock by 3d-printing a key or by sound or by whatever exotic method. These news are always stupid because you can already open the lock by gently tapping it, so why waste your time with the tech?
[1]: A video of an 11-year-old kid at defcon learning to bump a lock after a few minutes of teaching: https://www.youtube.com/watch?v=C5fLgxqWvJQ
It's the only major type of lock I haven't been able to pick within a reasonable timeframe.
Normally once you learn how to pick a certain model of lock, another lock of the same model will fall within 10 min, broadly speaking, and most cheap locks in just seconds.
Disc detainer lock's design just prevents you from freely accessing each of the discs except with specialized tools, and there's no feedback from any spring, so there's no "touch" or "feeling" you can learn.
That leaves to brute force all "combinations" from the innermost to the outermost disc as the only way to pick it.
In a 8 disc, 4 "angle" lock like the one I have to practice, that means 4096 combinations. With a very optimistic 1 sec per combination, on average you need 34 minutes per lock.
At that point it's less suspicious to use a drill or an angle grinder to open what you want to open.
This is the same as the difference between a preimage (specific input) attack and a collision (any pair of inputs) attack on a hash algorithm[1].
A well-designed pin-and-tumbler deadbolt is not easy to pick: https://www.frontrangelocksmith.com/blog/the-best-lock-for-y...
Bumping is a different story.
Once you get the bitting and know what key it is, this is really not hard at all, provided you have the right tools. There's handheld tools for this [0] stuff, so you can do this pretty quickly in a parking lot, in theory.
Yes, these tools are relatively expensive and you probably don't need to worry about your bike getting stolen that way. Probably also not about someone breaking into your home like this, they'll just smash a window or something.
But if the attack described here gets to the point where you have an app that outputs the bitting code then I believe this is a legitimate attack that should worry (some) companies. This could let you go from access to a building with a 'visitor' badge to getting easy permanent access.
With more research the designers can certainly overcome the problems other commenters have posted here regarding noise, or more challenging lock design. Lock makers could build effective countermeasures. But there are so many locks that never will be upgraded.
Key and lock security is for low security situations where it just has to be more secure than the window.
(That and noise.) Can we say academic project?
Ok, maybe you can copy a key from sound but getting a clean recording and then going home and producing a new key and getting it correct is 100000x harder than just sticking 2 metal sticks in the lock and opening it in 15 seconds.
To us these posts might provide some light entertainment but then they get shared around by people who people who don't know better and next thing you know people are installing sound proof booths on the front of doors or telling us locks are insecure because they just found out about this trick.