A fairly lame response from Level considering the price tag of this lock. My guess is they simply outsourced making this to cheapest vendor they cut find and never talked to a engineer familiar with actual locks. The inclusion of various security pins would have defeated these simple attacks and not really increased their cost.
Having your lock defeated by the LPL is just normal as he's an expert at doing in. Many skilled locksmiths cannot open locks he able to do. Not guarding against raking and bumping, that's shameful for an exterior door lock. Then doubling down on their failure, that's Baghdad Bob level of PR right there.
Absolutely arrogant. Either they're producing a lock without doing the least bit of research to uncover the easiest, most basic attacks, or they know about them and don't care.
There would have been engineering cost to designing a better lock. Also, that's not their product concept. These are not locks for people who care about security, they are for people who care about iphone ecosystem synergy.
If you look at it a certain way, this isn't really a defect: when this lock gets bricked by a firmware update or recruited into a botnet, you won't be trapped on your porch for too long before your neighbor's kid can let you in.
But also, full agree on "our goal is to be better than an open window." I hope they don't extend a job offer to that marketing intern.
No, better locks are already invented and will fit that standardised barrel just fine. This is either someone minmaxing the BOM or just not knowing much about what they were specifying.
Yes, this is more accurate. They would need to spend fractionally more on the tumbler, which I really think they have no incentive to do because the target customer will not know or care about the physical security upgrade.
And the opposite. I had seen this and was waiting to buy one when brass is available. Now I’m going to pass. If they can’t take very basic measures then I don’t want it as a product. It tells me a lot about their process.
Level is an existing smart lock manufacturer and has several non-Apple-specific models which are on the market. I would assume they didn't go find a cylinder with zero pick resistance just for their newest and most expensive model.
The presence of an Apple specific model at a higher cost (adding NFC for HomeKey entry, which works even if your phone/watch battery is dead) caused it to get pushed onto the LPL's radar.
For the price point it's all embarrassing. I purchased Avocet locks after I saw they gave LPL trouble and a set for my entire house didn't cost as much as this horrible, shitty thing would. This is literally a scam product.
Not to defend this product, but what’s the threat model for a pick resistant lock? I assume, but don’t actually know, that my biggest risk is having my rear door window smashed and the door opened from inside while I am not home.
Lock picking (even raking or bumping) seems like the kind of thing that someone smart enough to figure out how to do is also smart enough not to engage in home burglary.
So unless your threat model is the three letter agencies entering and bugging your house, I assume other physical security upgrades should come first.
I think the idea is if the lock makers won't bother protecting from simple attacks, what else have they skimped out on? It's not like the pick-resistant locks are exceptionally more expensive.
House insurance will cover the robbery if they break the back window to get in. It might be more difficult to file a claim if they rake the lock and don’t leave any trace beyond your missing valuables.
There's an interesting DEFCON presentation on lock picking forensics[1]. I don't know if there's any certified agency that can do a forensics report which an insurance company would accept, but if there is such a thing, most (all?) lock picking techniques leave marks.
You can pick a lock, steal things a lot of people wouldn’t notice for a very long time and leave like nothing happened. There would be no call to the police, no threat of window alarms etc. easiest way to get away Scott free.
Lock picking as others have pointed out is not the most common method of entry. But if you see one lock that is really hard to pick due to good engineering, they probably also spent effort to make it resist other kinds of attacks like kicking the door, etc.
Firstly, locks should be immune to raking. If I can enter your property with a piece of metal in 20 seconds and with no training, the lock manufacturer fucked up. That's casual and you want to deter casual opportunists.
So, other than picking, there's a bunch. There's snapping the cylinder, which is common in the UK and only takes pliers, there's using a crowbar against the door to move the frame out of the way around the latch, breaking windows, and more.
My threat model doesn't include pickers, for sure, but I'm particularly angry about this product because it's visually distinctive and famous, so unlike a regular lock which is basically a roll of the dice as to its quality, this quietly screams for attention and that's a problem. Thieves do canvas houses looking for targets.
Think of it in context. A passer-by seeing someone smash a window will 100% call the police. Glass shattering makes quite a bit of noise as well and leaves behind a clearly broken window.
Meanwhile, lockpicking has a chance of looking no different from the rightful owner using a key, especially at a distance, is relatively quiet, and leaves basically no trace.
Threat model: stealing a “something you have” credential from your house and then using it before you can become aware of it to then remotely deactivate / decommission / rotate said credential.
For another data point, I never managed to pick locks in my twenties, but something aligned for me in an evening lock picking course in my sixties, and I picked everything in the room. One wants a training set of locks to learn on, one pin, two pins, three pins, ... then one learns easily. It also helps that with age one's brain quiets down. To pick a lock, you need to listen to it.
I asked the organizers, surely they had something that would stump me. They handed me an American padlock identical to one I'd been buying for years. It stumped me.
It took LPL more than one pass to pick a basic American. He made it look easy, still reassuring me there was some skill involved:
Videos by others describe more advanced American locks that took several months to overcome. American takes basic countermeasures, that Level could have easily adopted.
LPL opened it via raking. That alone means there are no security pins. A serrated pin and a couple spool pins isn't expensive and is standard for locks that aren't budget or master locks.
Spool pins actually can make picking easier by providing you with more feedback about the pins vs normal pics. (A lockpicking friend explained this to me once)
I have found that serrated pins are pretty easy to defeat by manipulating the torque you apply a little bit. I actually have a slightly harder time with spool pins although they do give you nice feedback about when they are set (and false set).
I think the point is, almost anyone with 5 minutes to watch a video on basic techniques (or who is interested in spending 30 minutes just messing around with no prior knowledge) could probably pick this very expensive lock.
To do what you're describing, some people wouldn't get it, and for those that can do it (most, with some practice), it'll probably take 30 minutes to an hour of practice - or a day or so for the outliers.
It's a huge difference in difficulty between the two for a few cents in parts.
The irony is that the best Master Lock in terms of picking resistance is a plastic LOTO lock that offers almost no protection against brute force attacks.
I wonder if Schlag's Encode Plus, which is designed to work with Apple Home Key as well, is also at all vulnerable. Schlage seems to have a fine record[0] but you never know what corners might be cut to get a product like this to market. https://www.schlage.com/en/home/smart-locks/encode-plus.html
I was curious what 4% of the homes in the US is. 5.6 Million. Pretty wild. I would not trust my front door to these people. It's silly simple to make a presence system for your house. Assuredly cheaper than the price of this lock.
I know they framed the statistic as “only 4%” but that’s higher than I would have guessed, given that modern locks (should) have anti-picking security features. If we could calculate the fraction of break-ins by the picking where the lock was vulnerable to raking or bumping, we should expect it to be higher.
The way I am reading the link, it was 4% of all 3.7 million household burglaries or 148,000 subject to raking.
Regardless, if someone is intent on breaking into a house, I doubt a locked door is going to do anything. Not only are windows abundant, but even exterior doors seem to have gotten cheaper and thinner than days of yore.
The worst part about their response is they're basically admitting that any $10 lock would be roughly as effective and the $330 price tag is for unlocking via the app.
Interestingly, one of the big selling points for Level is that it looks virtually identical to a normal lock unless you look closely and know what to look for.
I've been told they've had internal discussions around having LPL test their products, but they never went anywhere. Level was pretty dismissive when I brought it up as a suggestion in one of their many recruiting attempts.
I love how their response to "your lock is bad" is "you don't really need a good one". I guess that's supposed to convince me that spending over $300 on a lock is what I need.
"designed to be used with them; the Level Lock Plus can be unlocked using one of the best iPhone or best Apple Watch devices even if you’ve forgotten your actual house key."
The way "best" was added to each of those links was the best part of this article.
No, but the point remains: Apple is implicitly vouching for the quality of everything in its store, and with their ultra-limited selection, one would expect the best of the best.
Yes, Apple should be willing to give everyone a refund who purchased this if they stand by their vetting.
Especially because all the things sold via Apple are priced higher than similar products elsewhere, so if the products are not higher quality, then Apple’s reputation is getting dinged.
The purpose of retailers is to signal to consumers that the products they sell were curated and have the approval of that retailer.
If B&H started selling cheap equipment off of AliExpress, they'd rightfully take the reputation hit for attaching their name to those products and choosing to sell them to consumers.
This is a stupid product for stupid people, offering as much security than a lock 1/10 of the price.
Worse, it sends a message. It says "I am a rich idiot who doesn't understand security and has too much money, and who subscribes to the apple ecosystem so hard that I buy their unrelated merchandise, so you know there'll be stuff to steal here".
I cannot think of a better advertisement to criminals.
I was just wondering why apple market share is so relatively high in USA.
I think it may be cus apple stuff is aimed at people with 2 qualities..
1. Has money to burn.
2. Doesn't know anything about computers or technology.
USA has a really bad gini index and education system so I suppose there is a high proportion of people there who fit both criteria.
In the early iPhone era, US phones were usually subsidized/financed by mobile phone carriers, e.g. an expensive iPhone could be heavily discounted or "included" in a 2-year contract, with the carrier looking at the lifetime value of the customer's data subscription. This was less common in Europe and elsewhere, where customers were more likely to purchase their phone separately. If anyone was burning money, it was US carriers, rather than US mobile phone users.
Notice that they essentially rake (with the godawful demonstration of "picking") on what looks like a Level lock to then make the conclusion that AlL Locks are pickable because even an idiot that doesn't know the difference between picking and raking can do it.
The phrase "keeps honest people honest" is oft said but I think it isn't quite true to the real mechanism at play, which is a system of societal incentive structures. How about this: "locks only keep people out long enough to notice them trying to get in." The relevant factor then is the ratio of picking difficulty to situational difficulty.
You could have the worst lock in existence, but if you're using it to chain your bike to the rack next to the police station in the worlds busiest street corner, no one will ever attempt to pick it because even though they could, there's a near 100% chance of getting caught. Conversely, you can put the best lock ever constructed on a door in some secluded alleyway no one ever checks up on and it won't matter because there's no upper limit on what a thief can do without arousing suspicion, so they will simply use a blow torch.
There are neither honest people nor dishonest people, just rational incentives. The real locking mechanism is the societal system of property rights which will take you to jail if caught trying to subvert the mechanical system of property rights.
That is completely wrong. Society is able to function (or not) based on agreed upon behavior. The police is mostly useless if someone broke into your home and stole your keyboard. Most people, who needs keyboards, will not break into their neighbor's home but instead will buy one from a store.
Most suburban homes are actually unlocked. If the front door is locked, there is a high chance you can get in from the backyard or from a window. It's easier than you think to break into a home. Most of your neighbors are working in the day, or even if they are not, they are not actively checking your home. It takes less than 2 minutes to break in.
You can also bring a van and two uniformed men and take all the possessions there is. People will think you are moving out; and not being actually robbed. When you have a higher criminal population, life become hell and no amount of policing or security will help. (ie: Some countries in South America and Africa).
> keeps honest people honest
More like keep curious people out. Most people will not enter your house even if the door is left open.
You say I'm completely wrong but then go on to make exactly my same point. Sure theft is possible and yes, a lot of the time the lock is merely a signifier that "taking this breaks the rules" rather than a substantial physical obstacle to breaking the rules. Most of the time people do follow the rules.
But, if the value is simply as a signifier and the rules of society are just agreement, can I replace all the locks with signs that say "please don't take this" and replace the police with just expecting people to be kind all the time? Of course not. The agreement of society is meaningless if nothing actually enforces any of rules. Enforcement may not be perfect, you indeed often can get away with crime, but for most people the expected payoff from stealing their neighbors keyboard is worse than the expected payoff of just getting a keyboard the "right" way from the store.
The cost to stealing the keyboard depends on the time spent in jail if caught, times the probability of being caught. The probability of being caught goes up the longer I have to fiddle with a lock. The lock doesn't protect the keyboard per se, it merely makes the expected payoff of stealing not worth it to most people.
Even if the door is left open, most people aren't entering your house for the same reason. If you're gainfully employed, the price of going to jail is high enough that you aren't going to start breaking into places even if you know for a fact the door is left open 90% or more of the time. The expected payoff of stealing from your neighbors isn't worth it.
> the vast majority of locks are only used for keeping honest people honest.
No the point is that if your house is locked, that it will make the burglar try your neighbor's house which is unlocked. Or they'll just throw a rock through your window.
For $330 I would expect rake and bump resistance at least, though, that isn't rocket science.
LPL is good no doubt about that, but as mentioned multiple times in here this particular lock needed no skill to defeat, and the fix for this is wildly simple and cheap on the manufacturing side.
This is downright hilarious. I couldn’t imagine running a lock company and arguing that it’s actually good and normal that my locks can be defeated by anybody with a $1 bit of kit off Aliexpress and exactly 3 minutes of Youtube knowledge.
99% of locks used for $600 bikes or to store your wallet in the gym locker room can be picked by the LPL in seconds. Hell your apartment door lock, securing everything you own, can probably be picked by him. This doesn't make it extraordinarily vulnerable, only that the LPL is very good at what he does.
No - this was not picked, it was raked. Watch the video. The difference is that raking the pins takes almost no skill. LPL also demonstrates an easy bump attack which also takes almost no skill.
Bump/rake resistance is different than pick resistance and it is inexcusable to not have at this price point.
Wow. Even being cynical, they could have just announced an upgrade cylinder at a huge markup and that would have been fine probably. What a bungled response.
That should not have been Level's response. "You can buy part of a lock for $330, and maybe know you need to replace part of it to work" is very different from "here's a smartlock"
I understand where Level is coming from with this response, but cybersecurity has taught us better.
Yes, less than 10% of attacks use this exploit, but now that it’s public that you’re vulnerable to it, you become a target for 100% of attacks involving this exploit.
So for instance, if the delivery address of Level customers leak (and given the security of their physical locks, I would say them having bad cyber-security practices is not something too far-fetched), a malicious attacker would essentially have a database of home addresses with users that have bought a $300 locker that he can break into with the help of any YouTube tutorial
I don't expect a $5 to try to do much beyond preventing someone from accidentally opening the door. I do expect a $329 lock to not skimp on basic features to cut a dollar off the BOM.
I remember looking at this lock. I really wondered how strong it was because the battery is in the deadbolt. How easy would it be to smash the door open?
I never even considered a bump key might work. And raking? It’s like they’re not even trying.
You’re right with the $5. This now sounds like a $5 lock with automation around it. I’m not saying it needs to be the best lock on the market but come on.
And Level’s response is just sad. It’s very clear they got caught flat footed (shouldn’t happen) and are trying a bad move-the-goalposts to save face.
By their argument you don’t even need a key. Just let someone insert an Allen wrench to turn the bolt directly! No one breaks into houses that way. It’s secure!
So long as the battery is on the inside piece, it really isn't much different from a manual deadbolt. There's some extra gears and the motor, but they're going to be behind plates of metal- if you are taking a crowbar or hammer to one, you'll make enough noise that you might as well just break a window.
On the other hand, a super distinctive deadbolt on your front door that is known to be easy to open with a bobby pin is basically anti-security as you are advertising that your home can be entered without leaving a trace.
If you’re gonna have your house robbed anyway you might as well save on the lock. Even better if you don’t add your name to a database of people with weak locks.
Oh this again. The idiots at the WireCutter already covered this and they think it's just fine.
Mass market smart locks are a dumpster fire and they have the full support of the mass media. The #1 Wirecutter smart lock pick has this exact same flaw - a shitty cylinder that is prone to trivial bumping and that could easily be improved - the cheapest big box deadbolts have better cylinders. Someone had commented on that article (since removed) about this flaw - and the moron behind the Wirecutter smart section has just gone on and on about how this isn't a real problem, bla, bla - even had the audacity to post of a video of I'm guessing him demonstrating a poor raking attempt on one of these crappy locks to "prove" how "easy" locks are to pick - yes you dumbass, if you only use shitty locks with no protection.
He followed up with the gem that "the point of the lock picking lawyer is to show that any lock can be picked" - Again, no, idiot - the LPL does a tremendous amount of education to expose trivial weaknesses in particular products that can and should be addressed - he often points out when products provide a reasonable level of security for the price. The Level lock and the Ultraloq (the NYT top pick), do not. Fuck Wirecutter and the New York Times, enjoy your referral money you dishonest pricks. (U-Tecs customer service is also shit tier, something they even admit in their own review)
https://www.nytimes.com/wirecutter/blog/picking-smart-deadbo...
The premise of this article seems to be - there are some high priced smart locks (that we promote) that are easy to bump open, therefore all locks are easy to bump, and you shouldn't factor pick resistance into buying decision at all. And also: raking and bumping is in the same class of difficulty as pin picking (this difference has been explained to them - this is not for lack of information).
Actually is that the Level lock they demonstrate on back in October? Notice that isn't a Schlage - I'd like to see him try that.
Another thing they keep bringing up this ANSI Grade 1 nonsense - I have looked - I cannot find any evidence of 3rd party certification for their top pick. It's all bullshit.
You have to keep in mind that any of these "review" websites are in it to maximize their revenue with referrals. They will spout whatever it takes to get you to click on the links that get them the largest kickbacks. They certainly aren't going to come out and say, "All smart locks are terrible, don't buy one."
But the Lock Picking Lawyer didn't pick the locks! He opened it two ways that require little skill: bumping and raking. At least they could have made the lock bump and rake resistant at that price.
He didn't single pin pick the lock, as that wasn't the point of the video. Raking is a picking technique, though, and common as a starting move in locksport competitions.
I think everyone is missing point on this. This is actually a feature!
Loose your key?
Loose your iphone?
Loose your Apple Watch?
No worries just ask your friendly neighborhood door to door sales person to open your door for you!
You will literally never be locked out again!
/s
Jokes aside it is pretty shameful to sell a poorly made product, and then justify it by saying that it’s still safer then leaving your door unlocked. $330.
Check the videos from the LockPickingLawyer. That will take a long (if entertaining) time, though. It would be great if someone compiled a list of locks that LPL & friends recommend; I'm not aware of one.
Assa Abloy and Bowley stand up if that's all you care about. But he also shows that you can replace the lock cylinder, or take apart the lock and put your own pins in it, so in a way it's not important.
LPL hasn't recommended this lock, but the Kaba Mas X-10 [1] has no known successful pick, but they're not normally available to anyone outside US Federal Government agencies and their specifically-authorized contractors. Only a little over a million units out there, so it is difficult to assess just how secure it is as it isn't open to any and everyone who wants to attempt a pick. But there aren't any even credible rumors of a pick. It's not even a mechanical lock, and it isn't anywhere in the same universe as the crappy electronic locks that are out there in the retail market.
At a less esoteric more commercially accessible scale, while picked the pick is not published yet, and deploying in the wild currently takes an infeasibly long time (about an hour by the inventor of the pick): the Assa Abloy Protec 2 [2]. Unless you're trying to lock away national security secrets, it is quite sufficient to deter the common lockpicking burglars out there around the world.
I agree it should use a better core for that price, but the chances a burglar is going to rake your lock open instead of kicking in the door is pretty low.
Even in physical pentesting, lock picking is rarely used. There are usually much quicker and easier ways that exploit the various ways that doors and hardware can be installed incorrectly. A simple travelers hook is a much more useful tool than a lock pick set.
According to the very statistics cited by the lock company in their own defense, the odds are better than 1 in 8 (I only saw min/max) that they will rake your lock instead of kick it in. So that's 12.5%+ of the time it will get raked open instead of your door being smashed in.
> Even in physical pentesting, lock picking is rarely used.
As I recall, that's because it's known that locks can be picked. Unless the client thinks they have uber locks or thinks their guards should catch it, it's not the vulnerability they are looking for.
209 comments
[ 3.1 ms ] story [ 250 ms ] threadHaving your lock defeated by the LPL is just normal as he's an expert at doing in. Many skilled locksmiths cannot open locks he able to do. Not guarding against raking and bumping, that's shameful for an exterior door lock. Then doubling down on their failure, that's Baghdad Bob level of PR right there.
I would reckon they would change it for a v2 but they need to recoup costs first, but I could be wrong.
If you look at it a certain way, this isn't really a defect: when this lock gets bricked by a firmware update or recruited into a botnet, you won't be trapped on your porch for too long before your neighbor's kid can let you in.
But also, full agree on "our goal is to be better than an open window." I hope they don't extend a job offer to that marketing intern.
But then again, all press is good press
And a reputation cost for not.
The presence of an Apple specific model at a higher cost (adding NFC for HomeKey entry, which works even if your phone/watch battery is dead) caused it to get pushed onto the LPL's radar.
Putting security pins in there wouldn't have involved any engineering at all.
Lock picking (even raking or bumping) seems like the kind of thing that someone smart enough to figure out how to do is also smart enough not to engage in home burglary.
So unless your threat model is the three letter agencies entering and bugging your house, I assume other physical security upgrades should come first.
[1] https://www.youtube.com/watch?v=AVZzBjK1kmI
You get notified if unusual movement within your property is detected rather than you having to do the boring task of reviewing surveillance footage.
If they canvas your house and see a shitty, easily bumped lock, you are now an easier target and they're more likely to break in.
I reckon opportunistic break ins it wouldn't make a big difference whether it's this lock or a better one though.
So, other than picking, there's a bunch. There's snapping the cylinder, which is common in the UK and only takes pliers, there's using a crowbar against the door to move the frame out of the way around the latch, breaking windows, and more.
My threat model doesn't include pickers, for sure, but I'm particularly angry about this product because it's visually distinctive and famous, so unlike a regular lock which is basically a roll of the dice as to its quality, this quietly screams for attention and that's a problem. Thieves do canvas houses looking for targets.
Meanwhile, lockpicking has a chance of looking no different from the rightful owner using a key, especially at a distance, is relatively quiet, and leaves basically no trace.
The three letter agencies will have no problems gaining access to a house via picking a lock.
Their ability to access without detection extends beyond that.
On top of that, let’s be honest, if they want to bug someone, they will just access the mic on their phone, Alexa device, smart tv, etc.
For another data point, I never managed to pick locks in my twenties, but something aligned for me in an evening lock picking course in my sixties, and I picked everything in the room. One wants a training set of locks to learn on, one pin, two pins, three pins, ... then one learns easily. It also helps that with age one's brain quiets down. To pick a lock, you need to listen to it.
I asked the organizers, surely they had something that would stump me. They handed me an American padlock identical to one I'd been buying for years. It stumped me.
It took LPL more than one pass to pick a basic American. He made it look easy, still reassuring me there was some skill involved:
https://www.youtube.com/watch?v=oaP1nFZ9AXE
Videos by others describe more advanced American locks that took several months to overcome. American takes basic countermeasures, that Level could have easily adopted.
I don't know about serrated pins though!
I think the point is, almost anyone with 5 minutes to watch a video on basic techniques (or who is interested in spending 30 minutes just messing around with no prior knowledge) could probably pick this very expensive lock.
To do what you're describing, some people wouldn't get it, and for those that can do it (most, with some practice), it'll probably take 30 minutes to an hour of practice - or a day or so for the outliers.
It's a huge difference in difficulty between the two for a few cents in parts.
For those who don't know, watch LPLs videos on this brand and you'll see what's level of security they offer (basically none)
0: video https://youtu.be/WpbKOL1cM34
Even "real lock companies" are not immune from selling shiny gadgetry with misleading marketing
That said, I do intend to re-core and re-key it someday.
Regardless, if someone is intent on breaking into a house, I doubt a locked door is going to do anything. Not only are windows abundant, but even exterior doors seem to have gotten cheaper and thinner than days of yore.
No, $10 lock would not be as effective as $330 lock in displaying someone's vanity and Apple cult membership.
The way "best" was added to each of those links was the best part of this article.
Especially because all the things sold via Apple are priced higher than similar products elsewhere, so if the products are not higher quality, then Apple’s reputation is getting dinged.
If B&H started selling cheap equipment off of AliExpress, they'd rightfully take the reputation hit for attaching their name to those products and choosing to sell them to consumers.
[1] https://www.washingtonpost.com/technology/2021/06/06/apple-a...
[2] https://www.laptopmag.com/news/84-scam-apps-still-active-on-...
(sold separately for only $29.99)
Worse, it sends a message. It says "I am a rich idiot who doesn't understand security and has too much money, and who subscribes to the apple ecosystem so hard that I buy their unrelated merchandise, so you know there'll be stuff to steal here".
I cannot think of a better advertisement to criminals.
Therefore I shall assume nobody else can tell the difference.
They're not even trying to hide their grifts these days, are they?
https://www.nytimes.com/wirecutter/blog/picking-smart-deadbo...
Notice that they essentially rake (with the godawful demonstration of "picking") on what looks like a Level lock to then make the conclusion that AlL Locks are pickable because even an idiot that doesn't know the difference between picking and raking can do it.
The $330 price is for being "smart", not for any additional security.
You could have the worst lock in existence, but if you're using it to chain your bike to the rack next to the police station in the worlds busiest street corner, no one will ever attempt to pick it because even though they could, there's a near 100% chance of getting caught. Conversely, you can put the best lock ever constructed on a door in some secluded alleyway no one ever checks up on and it won't matter because there's no upper limit on what a thief can do without arousing suspicion, so they will simply use a blow torch.
There are neither honest people nor dishonest people, just rational incentives. The real locking mechanism is the societal system of property rights which will take you to jail if caught trying to subvert the mechanical system of property rights.
Most suburban homes are actually unlocked. If the front door is locked, there is a high chance you can get in from the backyard or from a window. It's easier than you think to break into a home. Most of your neighbors are working in the day, or even if they are not, they are not actively checking your home. It takes less than 2 minutes to break in.
You can also bring a van and two uniformed men and take all the possessions there is. People will think you are moving out; and not being actually robbed. When you have a higher criminal population, life become hell and no amount of policing or security will help. (ie: Some countries in South America and Africa).
> keeps honest people honest
More like keep curious people out. Most people will not enter your house even if the door is left open.
But, if the value is simply as a signifier and the rules of society are just agreement, can I replace all the locks with signs that say "please don't take this" and replace the police with just expecting people to be kind all the time? Of course not. The agreement of society is meaningless if nothing actually enforces any of rules. Enforcement may not be perfect, you indeed often can get away with crime, but for most people the expected payoff from stealing their neighbors keyboard is worse than the expected payoff of just getting a keyboard the "right" way from the store.
The cost to stealing the keyboard depends on the time spent in jail if caught, times the probability of being caught. The probability of being caught goes up the longer I have to fiddle with a lock. The lock doesn't protect the keyboard per se, it merely makes the expected payoff of stealing not worth it to most people.
Even if the door is left open, most people aren't entering your house for the same reason. If you're gainfully employed, the price of going to jail is high enough that you aren't going to start breaking into places even if you know for a fact the door is left open 90% or more of the time. The expected payoff of stealing from your neighbors isn't worth it.
No the point is that if your house is locked, that it will make the burglar try your neighbor's house which is unlocked. Or they'll just throw a rock through your window.
For $330 I would expect rake and bump resistance at least, though, that isn't rocket science.
Aren't there only one or two locks that picker has never easily opened? Bowley?
It really wasn’t picked at all.
This is like step #2 in making a good lock after “require a key”.
HN is not exactly the front page of the new york times or something.
I would expect this kind of security from a $20 lock, and that's totally normal. For $330 you should get something better.
Bump/rake resistance is different than pick resistance and it is inexcusable to not have at this price point.
Yes, less than 10% of attacks use this exploit, but now that it’s public that you’re vulnerable to it, you become a target for 100% of attacks involving this exploit.
So for instance, if the delivery address of Level customers leak (and given the security of their physical locks, I would say them having bad cyber-security practices is not something too far-fetched), a malicious attacker would essentially have a database of home addresses with users that have bought a $300 locker that he can break into with the help of any YouTube tutorial
I never even considered a bump key might work. And raking? It’s like they’re not even trying.
You’re right with the $5. This now sounds like a $5 lock with automation around it. I’m not saying it needs to be the best lock on the market but come on.
And Level’s response is just sad. It’s very clear they got caught flat footed (shouldn’t happen) and are trying a bad move-the-goalposts to save face.
By their argument you don’t even need a key. Just let someone insert an Allen wrench to turn the bolt directly! No one breaks into houses that way. It’s secure!
Wow.
On the other hand, a super distinctive deadbolt on your front door that is known to be easy to open with a bobby pin is basically anti-security as you are advertising that your home can be entered without leaving a trace.
It's the "only have to run faster than you" joke.
And since this lock is a joke, having one is a nice little advertisement.
Mass market smart locks are a dumpster fire and they have the full support of the mass media. The #1 Wirecutter smart lock pick has this exact same flaw - a shitty cylinder that is prone to trivial bumping and that could easily be improved - the cheapest big box deadbolts have better cylinders. Someone had commented on that article (since removed) about this flaw - and the moron behind the Wirecutter smart section has just gone on and on about how this isn't a real problem, bla, bla - even had the audacity to post of a video of I'm guessing him demonstrating a poor raking attempt on one of these crappy locks to "prove" how "easy" locks are to pick - yes you dumbass, if you only use shitty locks with no protection.
He followed up with the gem that "the point of the lock picking lawyer is to show that any lock can be picked" - Again, no, idiot - the LPL does a tremendous amount of education to expose trivial weaknesses in particular products that can and should be addressed - he often points out when products provide a reasonable level of security for the price. The Level lock and the Ultraloq (the NYT top pick), do not. Fuck Wirecutter and the New York Times, enjoy your referral money you dishonest pricks. (U-Tecs customer service is also shit tier, something they even admit in their own review)
https://www.nytimes.com/wirecutter/blog/picking-smart-deadbo... The premise of this article seems to be - there are some high priced smart locks (that we promote) that are easy to bump open, therefore all locks are easy to bump, and you shouldn't factor pick resistance into buying decision at all. And also: raking and bumping is in the same class of difficulty as pin picking (this difference has been explained to them - this is not for lack of information).
https://www.nytimes.com/wirecutter/reviews/the-best-smart-lo...
Actually is that the Level lock they demonstrate on back in October? Notice that isn't a Schlage - I'd like to see him try that.
Another thing they keep bringing up this ANSI Grade 1 nonsense - I have looked - I cannot find any evidence of 3rd party certification for their top pick. It's all bullshit.
https://buildershardware.com/Certification-Program/Certified...
What? Is that a typo, or can you only open it with the "best" iphone and apple watch? whatever they are.
I'll save you the trouble--they rank the most expensive models the best. Surprising!
You will literally never be locked out again! /s
Jokes aside it is pretty shameful to sell a poorly made product, and then justify it by saying that it’s still safer then leaving your door unlocked. $330.
At a less esoteric more commercially accessible scale, while picked the pick is not published yet, and deploying in the wild currently takes an infeasibly long time (about an hour by the inventor of the pick): the Assa Abloy Protec 2 [2]. Unless you're trying to lock away national security secrets, it is quite sufficient to deter the common lockpicking burglars out there around the world.
[1] https://www.kabamas.com/x-10-high-security-lock/
[2] https://www.reddit.com/r/lockpicking/comments/amjumx/abloy_p...
Even in physical pentesting, lock picking is rarely used. There are usually much quicker and easier ways that exploit the various ways that doors and hardware can be installed incorrectly. A simple travelers hook is a much more useful tool than a lock pick set.
Not to mention that this is a dead bolt lock and completely impervious to a travelers hook…
> Even in physical pentesting, lock picking is rarely used.
As I recall, that's because it's known that locks can be picked. Unless the client thinks they have uber locks or thinks their guards should catch it, it's not the vulnerability they are looking for.
Lame excuse and doesn’t even mention the flimsy bolt.
Apple should remove them and sell bolt instead or something
It is the same price, not nearly as attractive, and is regularly sold out for months at a time.
But Schlage locks require at least some skill to pick.