News for hackers. Stuff that matters.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by ashtonkem on Tuesday August 18, 2020 @11:04PM (#24206751)
Most American locks just aren’t that secure; even I can pick a Masterlock #3 in a few minutes, and I’m a total novice at lock picking. A little bit of practice and there’s a good chance you could pick most front doors in a few minutes.

The simple reality is that if you’re going to get robbed, chances are the robber is going to use a pry bar to ruin the door jam or break your window. Locks are about keeping honest citizens honest.

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by jjeaff on Tuesday August 18, 2020 @11:16PM (#24206815)
>locks are about keeping honest citizens honest

I've heard that, and I get it, but I don't think that's actually it. Locks are about making it too inconvenient or risky to be worth stealing or breaking into. I guess some people might just all the sudden steal something if given the chance but would never do so otherwise, but usually, it's people who are already willing to steal if the difficulty and stakes are low enough.

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by kens on Wednesday August 19, 2020 @02:08AM (#24207633)
I agree that "locks keep honest people honest" is a nice but bogus sentiment. Bike locks are a clear counterexample. While a cheap cable lock will keep honest people honest, your bike will soon get stolen. A Kryptonite-style lock is kind of the minimum. But even those need constant upgrades as bad guys figure out how to pick them or freeze them with canned air. Thus, the goal of a lock is to make it not worth the effort for a thief, not to keep honest people honest.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by SAI_Peregrinus on Wednesday August 19, 2020 @10:31AM (#24210740)
That and to provide evidence of forcible entry for insurance companies to pay out. It's easier to cut the lock off than to learn to pick most locks, so the victim can easily prove the theft.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by retsibsi on Wednesday August 19, 2020 @03:57AM (#24208183)
I don't know if this is actually true, but I've heard that it's partly about taking away plausible deniability (for people caught on another person's property). If you had to break something/pick a lock/climb through a window, it's hard to argue that you had no malicious intent and were merely trying to pay a visit, or that it was dark and you were a little bit drunk and you opened your neighbour's front door by mistake.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by salawat on Wednesday August 19, 2020 @07:07AM (#24209124)
That reminds me of the time growing up that we actually had someone astonishingly drunk who ended up falling asleep in our unlocked minivan because he completely screwed up navigating home and apparently we had the same type of van he did. Mom was not at all amused at the time, but the more I think about the implementation of car locks (most share key cuts), the more I find the entire thing somewhat amusing in hindsight.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by dec0dedab0de on Tuesday August 18, 2020 @11:50PM (#24206974)
I think the saying "locks keep honest people out" means that locks are there to keep out the overzealous girlscout selling cookies, that annoying friend who comes over when you dont text him back, and your neighbor that heard a noise and wants to make sure everything is ok.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by Polylactic_acid on Wednesday August 19, 2020 @01:08AM (#24207315)
It also deters some dishonest people. A while ago my suburb was hit by a drug addict who moved in and would steal change/ipods from unlocked cars and tools from unlocked sheds. He never touched anything that was locked because the extra risk and effort wasn't worth it.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by SAI_Peregrinus on Wednesday August 19, 2020 @10:29AM (#24210718)
> Locks are about keeping honest citizens honest.

No, locks are about making forcible entry easier than covert entry, so that your insurance company pays out. The primary function of the lock is tamper evidence. The secondary function is deterrence (easier to get into an unlocked place than a locked one). Actually preventing entry isn't the point for any but the strongest locks, and even then they only serve to delay entry.

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by ric2b on Thursday August 20, 2020 @05:08PM (#24229003)
I don't think most people buy locks for that reason, they buy them because they think the lock is secure enough so that only serious criminals will do anything, and then they hope those criminals don't show up.

Besides, a lot of locks are so easy to pick that you might as well do it instead of making a lot of noise forcing it open.

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by amock on Tuesday August 18, 2020 @11:19PM (#24206827)
Are non-American locks better? Why would American locks be worse?
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by donw on Wednesday August 19, 2020 @12:46AM (#24207198)
Dimple locks are exceedingly common here in Japan, and German padlocks (Abus, etc.) are generally considered what you want to buy if you're actually trying to secure something.

The thing is, those locks are more expensive to produce, both in terms of metallurgy and skilled labor. Germany has done a solid job of ensuring that it retains local experience in both areas, through a combination of tariffs, a robust skilled-trade education system, and consumer preference for domestic goods.

American consumers, on the other hand, tend to be very price-sensitive, and Master locks are cheap.

That's not to say that there aren't some rock-solid American locks, but Germany and Japan tend to be the leaders here (and for the same reason)

If you're keen to learn more about locks and security, I suggest having a look at LockPickingLawyer on YouTube: https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by rockinghigh on Tuesday August 18, 2020 @11:53PM (#24206993)
At least in France, dimple locks (keys have holes instead of teeth) are more common and feel more secure, even though they can still be lockpicked.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by Polylactic_acid on Wednesday August 19, 2020 @12:21AM (#24207119)
Most of the dimple locks I have seen can be opened with just a rake and 2 seconds time.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by Uberphallus on Wednesday August 19, 2020 @04:10AM (#24208256)
Most dimple locks in Europe won't open by raking because they also carry spools.
Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by Tuna-Fish on Wednesday August 19, 2020 @03:47AM (#24208130)
Most countries/regions tend to "standardize" almost all common locks to one type, which all the local locksmiths learn to work with and sell, and which all the people in that area learn to operate. The actual level of security or cost of the lock type seems to be insignificant, it's all just network effects.

The most common locks in America are all of the pin-tumbler type, which essentially provides "security theater"-level protection. They are very easy to pick with very little skill or specialized tools required, and most of them can be even be bumped in 5 seconds. [1] When people got concerned about the security of pin-tumbler locks, American lock manufacturers generally did not move to more secure lock types (or, if some did, they were probably outcompeted by other companies), they just added various extra "security features" on top of the fundamentally broken mechanism. Some of those "security features" are able to stop a curious 12-year old who spent 4 hours learning lockpicking on youtube, none of them will actually do much to deter a professional. On the positive side, pin-tumbler locks are really cheap and easy to use.

My native Finland has mostly standardized on Abloy's (now part of Assa Abloy) disc-detainer style locks. [2] They are somewhat more expensive than pin-tumbler style locks, but are dramatically more secure. This is because they typically have many orders of magnitude larger key spaces, and are designed in such a way that it is very hard to get feedback by manipulating the lock. They, too, can be picked, but this generally requires hard-to-acquire specialized tools, a very high skill level and a lot more time than weaker locks. They are hard enough to pick that if you lock yourself out, and don't have the coding of the lock stored somewhere, you basically cannot hire a locksmith to pick the lock for you -- you just have to break into your house some other way.

Why have Abloy locks not been a runaway success in America, replacing all the insecure locks? It turns out that the security of a lock really does not matter. Almost all American home locks are comically weak, yet almost no criminals ever pick or bump locks. So the additional security doesn't actually buy you much, if anything. However, Abloy locks have real disadvantages. For one, they require much more fine machining, which makes them more expensive. On top of that, they are somewhat more complex to use, as the locks have no internal springs (which is part of what makes them secure), so the lock has some persistent state or "memory". If the lock has last been normally locked or unlocked, you can just insert the key, turn, and pull it out. However, if I insert the key fully, and then extract it slightly, turn a little, and then fully pull it out, you can only insert the key up to that same point, and you then have to turn it straight before you can insert it further. If I do this individually to every disc with different rotations, it's going to take you a while. This can happen on it's own for, say, a padlock on a container that jostles as it's being transported. Everyone in Finland learns how to open a scrambled Abloy lock with the key right about at the time they get their first key, and most of us probably don't actually think of this as a skill, but do you want to try selling these locks to people who were not just taught how this works by their parents?

So why did Finland standardize on such an expensive, idiosynchratic lock type? It was invented by a Finnish company, their manufacture was domestic, and there were periods when Finland was really starved for foreign currency. It's all network effects from there.

But yeah, every now and then there is a news story or a paper of how you can open an American door lock by 3d-printing a key or by sound or by whatever exotic method. These news are always stupid because you can already open the lock by gently tapping it, so why waste your time with the tech?

[1]: A video of an 11-year-old kid at defcon learning to bump a lock after a few minutes of teaching: https://www.youtube.com/watch?v=C5fLgxqWvJQ

[2]: http://www.lockwiki.com/index.php/Disc-detainer

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by Uberphallus on Wednesday August 19, 2020 @04:26AM (#24208323)
Came here to praise disc detainer locks.

It's the only major type of lock I haven't been able to pick within a reasonable timeframe.

Normally once you learn how to pick a certain model of lock, another lock of the same model will fall within 10 min, broadly speaking, and most cheap locks in just seconds.

Disc detainer lock's design just prevents you from freely accessing each of the discs except with specialized tools, and there's no feedback from any spring, so there's no "touch" or "feeling" you can learn.

That leaves to brute force all "combinations" from the innermost to the outermost disc as the only way to pick it.

In a 8 disc, 4 "angle" lock like the one I have to practice, that means 4096 combinations. With a very optimistic 1 sec per combination, on average you need 34 minutes per lock.

At that point it's less suspicious to use a drill or an angle grinder to open what you want to open.

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by hipokampa on Wednesday August 19, 2020 @07:02AM (#24209088)
You would have to be very unlucky to take 34 minutes[1]. After mere 75 tries (seconds) the chances are >50%.

[1] https://en.wikipedia.org/wiki/Birthday_problem

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by speakeron on Wednesday August 19, 2020 @08:32AM (#24209720)
The birthday problem isn't applicable here, because you're trying to match a specific combination rather than looking for any matching pair. So the average number of attempts needed is indeed 4096/2.

This is the same as the difference between a preimage (specific input) attack and a collision (any pair of inputs) attack on a hash algorithm[1].

[1] https://en.wikipedia.org/wiki/Preimage_attack

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by vonmoltke on Wednesday August 19, 2020 @10:08AM (#24210494)
> The most common locks in America are all of the pin-tumbler type, which essentially provides "security theater"-level protection. They are very easy to pick with very little skill or specialized tools required, and most of them can be even be bumped in 5 seconds.

A well-designed pin-and-tumbler deadbolt is not easy to pick: https://www.frontrangelocksmith.com/blog/the-best-lock-for-y...

Bumping is a different story.

Re:Listen to Your Key: Towards Acoustics-based Physical Key ... by timonoko on Wednesday August 19, 2020 @09:08AM (#24209963)
Original Abloy was incredibly easy to pick. I remember seeing weird-looking generic Abloy-opener in 1957 when a lock-smith opened our door in about 5 seconds. Then Abloy changed the tensioning disk from front to back. And nowadays the tensioning disk is some random disk. But still no problem to Lock-Picking Lawyer or some other Youtube star.