News for hackers. Stuff that matters.
Re:Saintcon: Lock Picking Lawyer Keynote by iso1210 on Sunday November 28, 2021 @05:03AM (#29367683)
You have to realise that LPL has a very specific set of skills. Skills he has acquired over a very long career. Skills that make hom a nightmare for people like masterlock.

I had a locksmith out a couple of years ago, and was very disappointed when he simply got out a drill rather than starting with 'click out of one'.

LPL makes things look easy, I'm sure they aren't.

Re:Saintcon: Lock Picking Lawyer Keynote by Quequau on Sunday November 28, 2021 @05:27AM (#29367780)
I feel like this comment comes up every time LPL is discussed outside of his context and I think it discounts the hundreds of low / no skill attacks he has demonstrated which apply to many, probably most, of the locks with recognisable name brands that are for sale in brick & mortar stores.

It took me 30 minutes to make and use a tool that he demonstrated using on a lock similar to one I own and most of that time was spent rummaging around my place trying find stuff.

Lastly, I think you got taken advantage of by a locksmith out to sell more locks and keys.

Re:Saintcon: Lock Picking Lawyer Keynote by notatoad on Sunday November 28, 2021 @01:45PM (#29371607)
The biggest part of the LPL skillset is his knowledge about all the low-skill attacks that exist, and which locks they work on. Low-skill attacks are only effective if you know about them, and remember which locks each exploit applies to.

The only low-skill attack that seems to have any widespread effectiveness (and would therefore be worth trying on every lock) is raking, and that is pretty easily defeated by any lockmaker who cares.

Re:Saintcon: Lock Picking Lawyer Keynote by Quequau on Sunday November 28, 2021 @03:07PM (#29372430)
I believe that "low skilled attack" also includes the ability to search the internet and watch a video. There are literally thousands of videos on YouTube with demonstrations of low skilled attacks using improvised tools.

For example I made a shim and opened a lock I own in less than 30 minutes after watching one of his videos that featured a similar lock. I had never opened a lock without a key before that day, don't have much use of two fingers on one hand, and my toolbox fits in a kitchen drawer.

For your list of common low skill attacks which have widespread effectiveness I would also include shimming, hammering, and cutting. Also in the case of locks with electronics associated with them, strong magnets.

Re:Saintcon: Lock Picking Lawyer Keynote by sdmike1 on Sunday November 28, 2021 @03:19PM (#29372557)
He is also a very skilled SPPer which he will frequently demonstrate. He mentioned in the video the reason he uses so many low skill attacks is because they work so well on locks people *care* about.
Re:Saintcon: Lock Picking Lawyer Keynote by celticninja on Sunday November 28, 2021 @05:42AM (#29367859)
The locksmith drills your lock because it takes no skill and allows them to sell (or forces you to buy) a new lock and set of keys at whatever weird time of day it happens to be. The price is almost certainly going to be higher out of normal hours. Plus if he picks the lock in 30 seconds you may not pay such a high fee.
Re:Saintcon: Lock Picking Lawyer Keynote by paranoidrobot on Sunday November 28, 2021 @06:16AM (#29367999)
> Plus if he picks the lock in 30 seconds you may not pay such a high fee.

A story I was told once by an electrician who worked at a steel works for years.

The story goes something like this:

One day he was called out to a big engineering workshop, all their fancy new equipment is on the blink.

He walks up to one of the machines, has a look, then without saying anything promptly turns around and walks outside, followed by the curious manager.

The electrician circles the building and turns on the first tap he sees, and lets the water flow for a few minutes spilling on the ground. After leaving that go for a while, he turns the tap off again, and walks back in and tells the machine operators to try again. Magically, they all start working again.

The electrician has been there for barely a few minutes and hasn't even touched the machine or anything else electrical.

The manager asks for an explanation, since the electrician didn't even touch anything electrical. By way of response, the electrician says "You had someone fix that tap outside that was leaking, didn't you?" the manager replies in the affirmative. The electrician then explains that the leaking tap was keeping the building grounded - the slow leak was just enough to keep the sandy soils moist enough for a proper earth connection.

The electrician hands over the bill, with the emergency callout fee and minimum hours, etc. The manager protests that surely just turning on a tap didn't warrant a fee that large.

The electrician replies that turning the tap on was free, knowing to turn the tap on was what they were paying for.

Whether that story is true or not, there's plenty of similar ones.

The point is that while you might get annoyed that an expert came in and solved the problem quickly, without that expert you were going to wait a lot longer or spend a lot more trying to fix it some other way.

Personally, I'd rather deal with a locksmith that gave me the option: We can drill the lock, you can pay (say) $300 for new locks and keys and it'll take 30 minutes. Or, you can pay $300, we'll pick it in a minute, you keep your existing keys.

The locksmith I called a few years ago used a long piece of wire with a string attached, slid it under the door to pull down the door handle from the inside.

Re:Saintcon: Lock Picking Lawyer Keynote by jcrawfordor on Sunday November 28, 2021 @01:17PM (#29371311)
This seems like a variation on the old story about Steinmetz, the Wizard of Schenectady, making a chalk mark on a generator at a Ford plant. Which seems to be a true story, although often not attributed. The punchline to this one has always been Steinmetz's itemized bill, of $1 to make the chalk mark and $9,999 to know where to make it.
Re:Saintcon: Lock Picking Lawyer Keynote by iso1210 on Sunday November 28, 2021 @09:17AM (#29369052)
Another version of the old "hit with a hammer" parable, albeit one where the incompetence of the elecrtician is rewarded.
Re:Saintcon: Lock Picking Lawyer Keynote by thesmok on Monday November 29, 2021 @06:33AM (#29378620)
Electrician in that story should have billed for and installed a better grounding, because grounding is safety.
Re:Saintcon: Lock Picking Lawyer Keynote by RyJones on Sunday November 28, 2021 @12:01PM (#29370528)
I locked myself out one night and called a service. The guy showed up and asked if I wanted a show, or the door open. I said open the door please. He did in about ten seconds and I gladly paid full fare for the work.

Spoiler: he leaned on the door to hold the latch in place, then used a plastic shim to trip it open.

Re:Saintcon: Lock Picking Lawyer Keynote by nirui on Sunday November 28, 2021 @06:04AM (#29367959)
I would probably (mentally) look down on the locksmith if he/she just going to drill it out without trying anything else first. I own a power drill too and I know how to use it to break a lock myself with zero knowledge on how lock works (for some weak locks, even a flat head screwdriver is enough to get it done).

On the other hand, if the locksmith clicked my lock out in just 30 seconds, I would probably ask him/her to sell me a better (and sometimes more expensive) lock based on his/her professional opinion.

Re:Saintcon: Lock Picking Lawyer Keynote by loloquwowndueo on Sunday November 28, 2021 @06:46AM (#29368129)
But how are you going to get your power drill if you’re locked outside? :)
Re:Saintcon: Lock Picking Lawyer Keynote by eatbitseveryday on Sunday November 28, 2021 @10:31AM (#29369633)
Garage door opener glued to the outside that uses a PIN?
Re:Saintcon: Lock Picking Lawyer Keynote by loloquwowndueo on Sunday November 28, 2021 @10:49AM (#29369806)
You assume a garage exists or that said person keeps tools there and not in the basement.
Re:Saintcon: Lock Picking Lawyer Keynote by nirui on Sunday November 28, 2021 @10:46PM (#29376148)
If we're really going for the detail.... well, my neighbor is a contractor, he owns multiple almost-dead power drills with unlimited supply of dull bits (enough to get the door open). If that's not an option, there are few hardware shops within my walking distance where I can by a new cheap power drill as well as a cheap lock. And if I really messed it up, there is a market for home renovation supplies not really far, they sell doors with comes with lock.

Now that I thought about it this deep, I think I can be a locksmith too with all the nature advantages that I clearly have here. I don't even need a power drill, a battering ram is well enough for my job. And if somebody call me to open their door, I'll just ask which color they would like for the new door that whey about to own.

Re:Saintcon: Lock Picking Lawyer Keynote by accountofme on Sunday November 28, 2021 @08:10AM (#29368637)
The hardware store?
Re:Saintcon: Lock Picking Lawyer Keynote by dwighttk on Sunday November 28, 2021 @08:13AM (#29368649)
If he picked it as fast as LPL does some locks I may be inclined to buy a new lock from them
Re:Saintcon: Lock Picking Lawyer Keynote by wayoutthere on Sunday November 28, 2021 @09:34AM (#29369191)
The one who I call is more than happy to drive by, smack a bump key with a hammer and charge me $125 for the pleasure.
Re:Saintcon: Lock Picking Lawyer Keynote by kzrdude on Sunday November 28, 2021 @11:40AM (#29370301)
Don't you need a new lock anyway? After all, you no longer have the keys.
Re:Saintcon: Lock Picking Lawyer Keynote by evilduck on Sunday November 28, 2021 @01:47PM (#29371626)
A locksmith (or interested individual) can rekey a lock. The pins and keys are the cheapest part of the lock too, which is a contributing factor towards why locksmiths lean towards destructive entry. They get to be lazy, the method can't fail and make them look stupid in front of a customer and they get to offer you a sales pitch on buying a new lock right then and there.
Re:Saintcon: Lock Picking Lawyer Keynote by lrvick on Sunday November 28, 2021 @07:12AM (#29368285)
Honestly, when it comes to most US locks, they really are a joke.

I learned to pick my parents safe and door locks by 8, and have taught dozens of children to pick virtually every lock you can find in a hardware store.

As a security engineer the first thing I teach peers isn't even software, but lock picking.

Peoples minds really open up when you show them how to open every lock in their own office in under an hour of training.

"Is security on almost everything we trust every day really this shit?!"

"Yes"

Re:Saintcon: Lock Picking Lawyer Keynote by techdragon on Sunday November 28, 2021 @07:46AM (#29368508)
Thank you for this insight. I will forever advise anyone interested in getting started with computer security to learn lock picking first. Having done both In the other order id never thought of how insightful it is for fully realise the fragility of the illusion of safety as it exists in the real world as a better grounding for anyone about to learn the fragility of everything in the more complex and more abstract digital world.
Re:Saintcon: Lock Picking Lawyer Keynote by xondono on Sunday November 28, 2021 @05:11AM (#29367720)
> I had a locksmith out a couple of years ago, and was very disappointed when he simply got out a drill rather than starting with 'click out of one'.

That’s a common occurrence because of the incentives. The locksmith wants to spend as little time as possible (average time), and doesn’t pay a premium for destroying the lock, since most people don’t confront them on that.

LPL is amazing, but any decent locksmith could get at least near enough him in competence. It’s not that it’s so hard that very little people can do it, it’s that is very niche for most people to learn.

Re:Saintcon: Lock Picking Lawyer Keynote by celticninja on Sunday November 28, 2021 @05:45AM (#29367870)
I bet most locksmiths are the drill and replace type and could not pick a lock reliably anyway. Locksmiths are taught how to dismantle and remove a lock these days rather than how a lock works and therefore how to beat it.
Re:Saintcon: Lock Picking Lawyer Keynote by xondono on Sunday November 28, 2021 @09:15AM (#29369042)
After thinking about this, I realized it makes a lot of sense given what LPL is saying.

After all, if you spent a fortune in some lock and the locksmith can open it in 5 seconds flat, you’ll feel ripped off. It’s possible that a lot locksmiths believe the locks to be safe, and they think they’re saving time by going the drill route.

Not to mention that if the locksmith is selling you the lock, he will want to avoid damaging their reputation.

Re:Saintcon: Lock Picking Lawyer Keynote by TravelPiglet on Sunday November 28, 2021 @06:45AM (#29368126)
Damaging the lock in the process of picking it is also an outcome that isn’t shown in the videos. LPL damages locks as well.
Re:Saintcon: Lock Picking Lawyer Keynote by lathiat on Sunday November 28, 2021 @05:59AM (#29367934)
Time to watch this one

“Locksmith says my videos are BS… Loses $75 (Maybe)”

https://youtu.be/NSuaUok-wTY

Also if you actually watch this keynote half the problem isn’t locks you can actually pick but stuff you can just open with very basic tools that don’t even require the skill he has. Like combs, rakes, hammers, slithers of metal, etc.

Re:Saintcon: Lock Picking Lawyer Keynote by josefx on Sunday November 28, 2021 @06:26AM (#29368043)
Going by a presentation from a professional pen tester lock picking is usually far down on their list because there are easier ways to open many doors without picking the lock.

https://www.youtube.com/watch?v=rnmcRTnTNC8

Someone who wants to get in is probably already on his way out while LPL is only halfway through with the lock.

Re:Saintcon: Lock Picking Lawyer Keynote by JshWright on Sunday November 28, 2021 @07:42AM (#29368485)
A big part of what LPL does is exploit those non-destructive bypasses.
Re:Saintcon: Lock Picking Lawyer Keynote by delusional on Sunday November 28, 2021 @05:08AM (#29367710)
You have to excuse that I didn't watch the video, so i might be missing some context.

LPL's career isn't lockpicking is it? I was under the impression that it was just a hobby that turned into a youtube channel. I seem to recall him saying that he just picks locks all the time, and that's why he's good. I think he said that when he watches movies he takes a 30 locks and then he just sits there and picks them while watching.

Re:Saintcon: Lock Picking Lawyer Keynote by Quequau on Sunday November 28, 2021 @05:40AM (#29367850)
It wasn't (he used to be lawyer) but he's won lock picking contests, apparently has a gargantuan collection of locks some of which he habitually practises on, and these days runs a company that sells lock picking tools (though I have no idea if that's his only gig).

Anyway, if you watch all / most of his videos the near constant refrain running through them isn't "with finely honed skills and the right hard to find speciality tools it's easy to open this lock" (though he does do that). Instead it's: "it's easy to open this lock with no or few skills, no or little practice, with trivially found, improvised, or purchased tools, using exploits that have been known in the lock manufacturing and locksmithing industries for decades or centuries".

That in turn is his point in this keynote. These exploits have been known in the lock manufacturing and locksmithing industries for decades or centuries and yet many, perhaps most of the locks that people can buy in stores, still have those flaws (which are easy and inexpensive to eliminate in the design and construction process).

Re:Saintcon: Lock Picking Lawyer Keynote by donatzsky on Sunday November 28, 2021 @05:57AM (#29367928)
> (though I have no idea if that's his only gig).

Pretty sure it's not. From what I've gathered, watching his videos, he's also doing consulting/training for companies on physical security.

Re:Saintcon: Lock Picking Lawyer Keynote by tylermenezes on Sunday November 28, 2021 @06:40AM (#29368093)
Locks are worse than you think. I'm not skilled, I don't practice, but I've been able to get my parents back in their house within 5 minutes both times they've locked themselves out.

You call out masterlock but they're particularly bad. I lost the key to one and kept using it for a year because unlocking it was as simple as just putting the pick in while turning.

Re:Saintcon: Lock Picking Lawyer Keynote by OkayPhysicist on Sunday November 28, 2021 @08:15PM (#29375186)
I encourage you to try out locksport as a hobby. Pretty much anyone can learn to pop open a masterlock padlock in 30 seconds or so with maybe a couple hours practice. Don't get me wrong, he makes even really, really hard to pick locks look easy, but that doesn't negate the fact that a lot of locks are just actually easy.