10M people watched a YouTuber shim a lock; the lock company sued him – bad idea

https://arstechnica.com/tech-policy/2025/10/suing-a-popular-youtuber-who-shimmed-a-130-lock-what-could-possibly-go-wrong/

by Brajeshwar • 9 months ago

1587 627 9 months ago

arstechnica.com

https://www.youtube.com/shorts/YjzlmKz_MM8

catlikesshrimp• 9 months ago

I am concerned about the public reacting aggressively agaisnt the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit, however unjust it was.

The correct support for a just cause must have been constructive: providing financial support for the defendant, public manifestation campaign, professional lobbying, etc

Although this time I agree with the defendant cause, the response by the public was as toxic bullying as the plaintiff, only stronger.

tyleo• 9 months ago

You’re getting downvoted which is unfortunate because I think you make a worthwhile point.

Emotionally I disagree with you. It feels like a bully is getting what a bully deserves. Logically, I think you are right though. Crowds just aren’t equipped to handle these situations. There are cases where the wisdom of the crowd is correct, but there are many more where it multiplies harms.

The underlying problem is that it never feels like justice is being served. Another comment mentions that there should be harsher punishment for false DMCAs. I don’t think the “wisdom of the crowd” approach is the best way to write those wrongs but I lament that modern justice has not been up to the task.

mikestew• 9 months ago

I’m going to border closely to blaming the “victim” here, but if the lawsuit had been filed without toxic, threatening, man-baby social media posts, we wouldn’t be hearing about it. Harassed because he filed a lawsuit? C’mon, there’s a lot more to it than that. When one goes swinging their dick around on Twitter in an attempt to garner support (from one’s equally toxic fans, I presume), one will also likely attract equally toxic folks who disagree. Talk enough shit, and you’ll eventually get a punch to the face. Right or wrong, such is the world long before social media.

MBCook3• 9 months ago

That’s the internet these days. It’s been going on for decades. Game developers got death threats over minor changes to video games and nothing happened to them. Is it that surprising that tactic has continued?

People can make fun of the company all they want. That’s fair game. They shouldn’t be calling the guy’s personal phone or harassing his family, that’s totally over the line.

But nothing happens. The behavior gets a pass so it continues to become more common. That passes for debate now.

ipaddr• 9 months ago

Phone numbers are public not personal secrets. If you have a number someone can call it.

greedo• 9 months ago

This all sounds great in the abstract. But reality is different due to the power differential. McNally is just one dude (albeit with a huge following). Lee is obviously a toxic jerk and his attacks and mockery of McNally triggered both McNally repeatedly proving the flaws in Proven's technology.

McNally obviously did the correct thing it seeking counsel and basically demolishing Proven's case in court. Too bad the SLAPP stuff doesn't work with DMCA takedowns.

And everyone else cheering on the sidelines (who isn't a paid shill of Proven's like the guy making the "liberal" comment)? Well giving Lee's company shit is fine IMHO. Call up the publicly available phone numbers, make service requests to flood his business etc. Fine with me. You poke the Internet bear, you get some claws.

As to the threats? If they actually occurred (which is questionable considering the BS Proven has been saying), then let the authorities know about them. That's not on McNally at all, it's more Lee being a jerk who doesn't know about the Streisand Effect, combined with social media companies that allow stuff like that to happen. It's also a good idea to not expose too much info about your personal life on social media that can be linked to your business, opsec ya know?

mindslight5• 9 months ago

the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit

I think you're confusing who filed the lawsuit here. That was also the lock company owner as well (Lee/Proven).

While I agree that flash mob harassment from the Internet is a terrible dynamic, filing baseless lawsuits has been a longstanding way to predictably summon them. So if the table stakes of launching or defending these type of aggressive attacks have gone from a significant amount of money for attorneys, to a significant amount of money for attorneys plus public relations and/or having a large audience, does that really actually change much? Either way most people simply don't file lawsuits, even if they've been actually wronged, due to the extreme personal stress.

The straightforward way of diminishing mob justice is to make people believe the system provides justice. If we lived in a society where McNally would predictably win the lawsuit [0], and be predictably compensated for his expenses/time/emotionalDistress for being on the receiving end of this baseless SLAPP, then there would be much less mob outrage to begin with. As it stands, everyone can imagine themselves receiving these types of legal shakedown letters, but having much less power to push back.

[0] it sounds like this particular suit was slapped down pretty hard and "quick" by the standards of the legal system, but there are many similar cases that don't go this way

zamalek• 9 months ago

Someone seriously needs to be taken to task for filing a false DMCA. DMCA is just another term for SLAPP these days. If anyone is a lawyer, they could still be despite retracting the case?

nerdsniper• 9 months ago

Anti-SLAPP is a great tool to have, but we do need slightly stronger ones. It’s a tough balance to find - to minimize the potential ways to abuse the system for all different kinds of entities/people.

YouTube’s TOS would be the most critical place to begin in terms of evaluating legal options. To file a “DMCA” (not really DMCA but YT’s proprietary version of it) claimants generally have to create an account and agree to the TOS. So it may bind both parties (the YTer and the abusive DMCA claimant). That might limit legal options for anti-SLAPP, tortious interference, etc.

But without either significant legal expertise or someone finding some particularly relevant case law, it seems like a nuanced enough domain that no one’s lay “legal” opinion would be particularly illuminating.

ProllyInfamous8• 9 months ago

As the recipient of a SLAPP lawsuit (~decade ago) for truth I published online, the biggest problem with Anti-SLAPP statutes is that laypeople (particularly poorer ones) have limited access to attorney representation... the judicial system isn't accessible/friendly to the pro se litigant.

So even if the case is clearly being used to strategicly silence you, it'll probably still work (from plaintiff's POV). Same for DMCA.

OkayPhysicist4• 9 months ago

My pitch for an improved system is to give defendants the opportunity to file a lawyer-less motion for summary dismissal, which is 1) geared towards being filled out by a layperson and 2) doesn't disqualify you from a subsequent filing for summary dismissal once you get a lawyer. Basically, an initial "this is a stupid lawsuit, here's why" type deal.

And then fine plaintiffs (and pay the defendants) that lose a summary dismissal, because if your case can be thrown out before trial, it was a shit case that should have never been filed in the first place.

LorenPechtel3• 9 months ago

The real problem with DMCA is that in theory it's under penalty of perjury, but in practice it's completely ignored. What is really needs is statutory damages for bogus takedown requests.

o11c• 9 months ago

Part of the problem with the DMCA is that the "perjury" clause only applies to "claiming that some IP exists", not "claiming that this violates the IP".

mindcrime• 9 months ago

It's probably a good thing for Proven that they didn't get into this dispute the LockPickingLawyer instead. He'd wind up owning their company in the counter-suit...

adolph• 9 months ago

That'd be an interesting channel, the "LockMakingLawyer" where the lock is highly lawsuit resistant, "Press the NDA button to always be informed when the next video comes out"

mothballed17• 9 months ago

This guy shims a $100+ lock in 10 seconds with a liquid death can, all without speaking in the video, just replays and then destroyed their claims and GTFO. Absolutely masterful.

viggity• 9 months ago

These kinds of results seem all too common. Like, why? Are companies just too used to using their general business attorneys for it, and those attorneys are just ignorant? Hungry for extra billable hours?

resoluteteeth• 9 months ago

Even if they know they would lose in court, lawsuits are expensive enough that threatening to sue or filing a lawsuit is often enough to get people without deep pockets to do whatever you want.

I don't know if that was the reasoning in this case though, considering that they didn't drop the lawsuit once it was clear that the youtuber wasn't going to give in to their demands.

topspin• 9 months ago

Like, why?

The answer, as succinctly as possible: cognitive dissonance.

This is exhibited in every human endeavor, but it's particularly acute, or at least more apparent to simple analysis, in business. In business, anything that diminishes the perception of value is a threat to earnings. Business people don't tolerate the existence of such perceptions in their minds. They readily adopt whatever mental state is necessary to deny realities that reveal a lack of value in whatever work product they sell.

In this case, someone demonstrated a weakness in a lock design. In the minds of the business people behind the product, this is impossible. Their locks are awesome. Best locks in the world! Therefore, the only conceivable possibility permitted, in their minds, is fraud or some other actionable offense that can be feasibly pursued in court.

The role of lawyers in this is a symptom, not a cause. Lawyers are paid to exhibit the necessary cognitive dissonance their clients require. Whatever aberrations or iniquities arise from this are simply denied by yet more cognitive dissonance.

walterbell• 9 months ago

Lawyers are paid to exhibit the necessary cognitive dissonance their clients require.

Thanks for answering this FAQ.

dwattttt• 9 months ago

While IANAL: even people who have done wrong deserve to be treated fairly. "Cognitive dissonance" has nothing to do with representing someone.

Businesses don't have to delude themselves to succeed either.

ProllyInfamous8• 9 months ago

Back in 2007, I published the first YouTube bypass of the Master Lock #175 (very common 4-digit code lock), using a paperclip.

After the video reached 1.5M views (over a couple years), the video was eventually demonetized (no official reason given). I suspect there was a similarly-frivolous DMCA / claim, but at that point in my life I didn't have any money (was worth negative) so I just accepted YouTube's ruling.

Eventually shut down the account, not wanting to help thieves bypass one of the most-common utility locks around — but definitely am in a position now where I understand that videos like mine and McNally's force manufacturers to actually improve their locks' securities/mechanisms.

It is lovely now to see that the tolerances on the #175 have been tightened enough that a paperclip no longer defeats the lock (at least non-destructively); but thin high-tensile picks still do the trick (of bypassing the lock) via the exact same mechanism.

Locks keep honest people honest, but to claim Master's products high security is inherently dishonest (e.g. in their advertising). Thievery is about ease of opportunity; if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).

mothballed17• 9 months ago

Actual thieves don't give a shit to learn lock picking, they can use a fine toothed sawzall or oxy-acetylene torch and defeat any lock just as fast without having to youtube the particular brand.

Ekaros• 9 months ago

It is actually surprising just how little brute force many semi-decent padlocks can handle. A decent mallet and some force concentrator and I think good amount of them will fail.

mindslight5• 9 months ago

A portable plasma cutter? What is this, Star Trek? Are there some extremely-high-power-density battery-operated plasma cutters available on Aliexpress that I haven't yet run across? Or maybe I should locate my safe far away from my stove/dryer receptacles?

polygot• 9 months ago

It’s much more difficult to tell if someone bypassed the lock if they picked it (and relocked it), as opposed to cutting it off completely

burkaman• 9 months ago

That is a subset of thieves. There are still plenty of situations where it is beneficial to have a lock that can't be opened in 5 seconds with a paperclip, like a school or gym locker room for example. Nobody is bringing a sawzall into the gym while it's open.

Similarly, I know the lock on my front door is not going to stop anyone who really wants to get inside, but it does stop drunk people or bored kids from wandering in because it's easy.

WalterBright2• 9 months ago

I used to rent a storage unit. I lost the key to it, and went to the manager. He came back to the unit with a small battery powered grinder. Cut the padlock's loop through in a few seconds.

Most locks are only good if the attacker doesn't have any tools.

ranger_danger3• 9 months ago

Entirely depends on what manner of thief we are talking about here, what they're going after, how important it is to them, and how much they care about the owner knowing the lock was tampered with.

This is why I don't like such black-and-white opinions... I think the answer is rarely so simple.

MisterTea• 9 months ago

A battery powered angle grinder with a zip wheel is the best lock picking tool out there. Hell, a cordless Dremel with a zip wheel might do it.

lisbbb3• 9 months ago

Yes. I once saw a guy open a bike U-lock using a car scissor jack and he was done in about 20 seconds and the bike was gone. Nowadays there are very good battery powered grinders that can take a cutoff wheel and no padlock is going to resist that.

b00ty4breakfast• 9 months ago

most thieves don't even go that far. they find stuff that isn't locked or they kick in the door.

slenk4• 9 months ago

No one is doing that in a nice residential neighborhood

mk89• 9 months ago

It depends on where you live. I guess it's not uncommon to hear about someone entering a building "as the delivery guy" just to try to pick a lock and see which one opens.

If you make too much noise people will get suspicious and might call the police.

umvi• 9 months ago

Actual thieves are most interested in low effort/fast methods of bypassing locks. Master single pin picking to LPL's level and the thief might as well just turn locksmithing into a career instead of stealing. Low effort attacks like shimming, raking, bumping though might be worth a thief's time to learn.

Ey7NFZ3P0nzAe3• 9 months ago

Some are still resisting this kind of attacks. The hiplok D1000 has a thick rubber like abrasive coating that makes it super hard to cut through the metal with power tools

ProllyInfamous8• 9 months ago

These jobsite storage boxes [0] are typically too heavy to steal (and can also be anchor-bolted), and the locks are highly-recessed within an enclosure... practically the only exposure is the keyway... and then there's thousands of dollars of tools inside.

Worth it for smarter crooks. I'm a former IBEW electrician, and I've seen both stranger and more-miraculous occurrences — but I've seen it all.

[0] https://www.uline.com/Product/Detail/H-10011/Tool-Storage/Kn...

dekhn4• 9 months ago

Issues with master locks are hardly new- back in the 1980s, I downloaded a file from a BBS explaining how to open a combo lock (basically by pulling on the shackle while turning, and a few other tricks.

It's still online: https://cdn.preterhuman.net/texts/anarchy_and_privacy_contro...

dimator• 9 months ago

Oh my god, I remember doing this technique on my lock, I remember doing this in the early BBS days, I remember learning this from a short text file. I'm 80% sure it was this file!

Thanks for unlocking this memory for me!

astura• 9 months ago

if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).

If you were stealing from a job site you'd just bring bolt cutters.

ProllyInfamous8• 9 months ago

You have not ever been on a large enough jobsite, then.

It is impossible to attack the shackle, due to the recessed nature of the locking mechanisms. A torch might work... blasting out the keyway.

But on IBEW jobsites each lockbox contains around $10,000 of tools, within; most thefts are from other on-site trades, and lock-picking means you can blame it on the electricians since there's no signs of forced entry (I'm sure some of the apprentices do steal, particularly the lowly-compensated first semester "greenies").

But the electricians are still paying for it.

c420• 9 months ago

https://youtu.be/qL_MeobAp5s?t=1487

For those interested in the actual case, here's some deeper coverage of this bruhaha including how Lee may have perjured himself during deposition.

hinkley• 9 months ago

That guy sure isn’t in a hurry to get anywhere. Good one to watch at 1.25x speed.

pcthrowaway• 9 months ago

Lock-makers should start including RFID and a software key checking mechanism, then sharing the key would be illegal

ranger_danger3• 9 months ago

sharing the key would be illegal

How so? And what region are you referring to? There are many countries in the world with vastly different laws.

tgsovlerkhgsel• 9 months ago

Unfortunately, the "region" would be the 193 member states of WIPO: https://en.wikipedia.org/wiki/Anti-circumvention

So, you are right, the laws in Micronesia, Palau and South Sudan might be vastly different.

dcan• 9 months ago

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

butlike4• 9 months ago

plz stop! my hddvds...

foofoo122• 9 months ago

That's an illegal number mate. Straight to the slammer!

(for those missing out: https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...)

dmbche• 9 months ago

Thabk you so much this is a beautiful rabbit hole to go down

nomel• 9 months ago

Could you make access illegal using the DMCA, by putting some copyrighted content inside, with the physical key also being the license key?

tofof• 9 months ago

This is how Nintendo engineered a legal argument disallowing 3rd party cartridges original GameBoy. The cartridge needed to display the Nintendo logo on startup which was checked pixel for pixel, otherwise the GameBoy wouldn't proceed with booting. Third party carts couldn't do so without infringing trademark.

butlike4• 9 months ago

I don't really "get" locks. If you want something to be closed forever, seal it shut. If it should be opened and closed, leave a hinge. If it should only be open and closed by a select few, leave it in a trusted environment

Don't you live in a good neighborhood?

avhon1• 9 months ago

I've lived in a fair few places, but I've never lived in a place where an unlocked bicycle wouldn't be stolen. I'll keep using locks, thank you very much.

hereme888• 9 months ago

A trusted environment, even in a "good neighborhood", requires a lock at least to the front door of your house, or gate, or w/e.

But where will you park your car when you go to work? You have to lock it.

lexszero_2• 9 months ago

Here in Finland mechanical locks with electronic keying are pretty common in some places. Some of them like iLOQ or Abloy eCLIQ are actually pretty clever: electrical bits of the lock are powered from mechanical action of inserting and turning the key, so you don't have to worry about batteries. In theory, they promise significant cost savings in scenarios like rental apartment buildings where tenants move in and out, need access to common areas, lose keys, etc, without compromising security or having to replace or recode locks - they just give you a generic key, click some buttons in the admin panel, and your key could be provisioned accordingly once you first enter the building and interact with one of the "smarter" locks that are externally powered and networked to the mothership.

In practice, in addition to the usual bugs you would expect from a software-based system managed and maintained by a plethora of organizations and contractors, they tend to become very annoying as parts wear out, so you have to fiddle with the key reinserting it repeatedly trying to find just the right angle so it will make a good contact to be recognized by the lock (for example the iLOQ system by my landlord communicates over a thin contact strip molded into the key opposite of the cutting and separated from the rest of the key with a thin layer of plastic).

georgefrowny3• 9 months ago

Sounds about right for Abloy. They own Yale and their app-based alarm is subcontracted dogshit (by https://mobilepeople.dk) that didn't get updated for years on end, logs you out constantly, has less functionally than a 90s keypad model and even the hub thing sometimes just falls over and needs a power cycle, etc etc etc. Presumably they are entirely unable to handle any of it in house and are at the mercy of the contractor to fix anything.

taneq8• 9 months ago

What criminal mastermind could possibly defeat the DMCA? :D

hinata082• 9 months ago

The internet : sees thoughts challenging facts

Someone : “Sucks to see how many people take everything they see online for face value,” one Proven employee wrote. “Sounds like a bunch of liberals lol.”

The company : Proven also had its lawyers file “multiple” DMCA takedown notices against the McNally video, claiming that its use of Proven’s promo video was copyright infringement.

When did facts and enlightenment started to be for "liberals lol" ?

Freedom of speech based on facts should be universal.

mothballed17• 9 months ago

Freedom of speech based on facts should be universal.

To be fair that's not what we have in USA. For instance, a nurse who never even signed a private privacy agreement with anyone (unusual, but could happen) could violate HIPAA if they factually tell a patient's spouse the patient is being treated for AIDS and they ought to watch out.

alwa2• 9 months ago

Yes, they could and most definitely would be. The case you describe is one of the reasons it’s that way.

For what exactly would this fly-by-night nurse be telling me to “watch out,” in relation to my partner who’s living with and being treated for HIV?

One hopes this nurse, being medically trained and apparently working with vulnerable populations, understands the efficacy of the modern HIV therapies the patient is receiving. That, when managed, HIV is not transmissible by conventional marital means [0]; and that, until recently at least [also 0], concerted public health efforts have meant that most anyone who seeks medical attention ends up on those modern therapies.

That said, I hope said nurse would catch me in a charitable mood rather than a litigious one.

[0] https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta...

nradov• 9 months ago

How could that happen exactly? In what circumstances could a nurse end up working for (or even volunteering for) a HIPAA covered entity without signing a privacy agreement?

skopje3• 9 months ago

They're all a tough guys act. It's the type. Many American men love playing soldiers. What is Liquid Death? It's water LOL. See?

viridian• 9 months ago

FWIW in my experience is less the monster energy / black rifle coffee audience, it's actually the red bull / white claw audience.

It still feels wrong to me, but that's how it is.

abustamam3• 9 months ago

I like liquid death because their water is delicious and not high in sugar. I usually drink a sparkling water with dinner and I definitely prefer liquid death over la croix. They are technically different products though.

That their marketing is so edgy is just fun. I don't take it seriously, and it doesn't seem like they do either.

But Proven is definitely full of toxic masculinity internet tough guys.

yojo• 9 months ago

"Reality has a well-known liberal bias."[0]

0: https://youtu.be/IJ-a2KeyCAY?si=cIcawm3U5-55nI2D&t=252

hinata082• 9 months ago

I just saw grokpedia results, which include a gay-free description of gay novels (Banana Fish) and forged or curated accounts of war on Iraq, Thatcher and Duterte.

So yeah, reality is liberal nowadays

zahlman2• 9 months ago

When did facts and enlightenment started to be for "liberals lol" ?

It didn't. That's one employee of the company, who has a clear bias in the matter, being ridiculous. It has nothing to do with liberal ideology, nor critique of liberal ideology, nor whatever sort of person that employee thinks should be considered a "liberal", nor their ideology. It's only the employee who even suggests that, and probably not even seriously.

jwr2• 9 months ago

If you don't know him already, I highly recommend videos by LockPickingLawyer — he routinely destroys bogus claims of various companies within seconds. It's quite entertaining to see how little security you actually get from most locks.

I wonder if anybody tried suing him…

jasoncartwright2• 9 months ago

LPL is superb. He inspired me to get a lock pick kit and a few simple padlocks - a cheap and fun hobby during COVID lockdowns.

diego898• 9 months ago

Thinking of doing the same! Which kit did you order? I see a FNG, FNG+ Bundle, and "Learn lockpicking bundle". 3rd one seems the most likely candidate. Any tips you can share? Thanks!

sillysaurusx• 9 months ago

Ditto. I was even able to put my lock picking skills to use one fine summer day when the dog park was locked due to "rain from yesterday" even though the grass and everything was clearly fine. We had a lovely time running around as a family, along with a couple other families, for about an hour before the groundskeeper came and shooed us away.

toomuchtodo• 9 months ago

I picked up and started practicing with Lishi lock tools, and I cannot recommend them enough. Pocket Tool Warehouse out of Texas has been good in my experience for sourcing them, no affiliation. Like an automatic transmission for lock picking.

https://www.classiclishi.com/about/lishi-history

https://www.originallishi.com/what-are-lishi-tools

Buttons840• 9 months ago

Putting the lock in lockdown I see.

hamburglar• 9 months ago

Same here. It also inspired me to teach my kids. Watching my nine year old daughter pick a lock warmed my subversive little heart.

OkayPhysicist4• 9 months ago

LPL owns Covert Instruments, who employs McNally, the YouTuber who got sued in this case. Probably not a coincidence that Covert Instruments wasn't named in the lawsuit.

jonhohle• 9 months ago

I wonder if McNally knows a lawyer familiar with lock picking ;-)

slenk4• 9 months ago

Oh sweet never knew there was a connection between LPL and McNally - I just notice they always cut their shims from cans the same way

jonny_eh2• 9 months ago

Probably not a coincidence that Covert Instruments wasn't named in the lawsuit

What's the non-coincidence?

asveikau• 9 months ago

In addition I've seen LPL refer to "my friend Trevor McNally" in a couple of videos.

hengheng• 9 months ago

That explains so much. Done to well for a goof channel, eclectic assortment of skills ("tactical garden trowel" vs fully equipped metal shop vs perfect video production), all fat trimmed off the videos.

I kinda want tvtropes to put a name on his slapstick humor. It's like looking over the shoulder of that weird uncle that seems to live in an entirely different world.

Kye• 9 months ago

Opening a padlock by hitting it with another padlock has to be one of my favorite bits.

danudey• 9 months ago

"This is a Master Lock XYZ. It can be opened with a Master Lock XYZ."

hdgvhicv• 9 months ago

If a lock takes more than 20 seconds to break it’s basically Fort Knox

azinman2• 9 months ago

Are there any that are truly secure?

tshaddox• 9 months ago

No one would be surprised if you showed that you could cut a hole in pretty much any normal door given the right cutting tool. Yet people seem to act surprised and betrayed to learn that a normal lock can be picked or broken given the right tool.

koolba• 9 months ago

It's quite entertaining to see how little security you actually get from most locks.

Physical locks are for honest people. They signify that something is not meant to be accessed and at best slow down someone actively trying to access the other side of the lock.

amarant• 9 months ago

They're also effective against incompetent thieves. Anecdotally that's a pretty high percentage of thieves you'll ward off that way.

mrweasel• 9 months ago

I recall either "The lock picking lawyer" or McNally explains that only in 3% of cases are locks picked during a burglary. In all other cases windows or doors are simply forced open. So at best locks are meant to prevent of crimes of opportunities.

FridayoLeary• 9 months ago

Don't know why you are being downvoted because it's true. Lots of people wouldn't try to break past a lock but if you leave a door open many people would fall for the temptation.

tim3333• 9 months ago

It requires a fair amount of skill to pick a lock quickly. Someone capable could probably make more money doing something legit.

dgacmu• 9 months ago

I think that it's more useful to think of all defenses against physical intrusion as increasing the cost of intrusion in some way, be that time, skill, risk of being caught, access to specialized devices, etc.

Most "normal" locks don't increase the cost too much but they do raise it - perhaps enough for a thief to pick another target, or perhaps enough for the thief to choose another method of entry such as kicking in the door (which itself comes with additional risk of detection).

LogicHound4• 9 months ago

Security is about layers. If I have a basic lock, all I want to do is stop an opportunist.

I have a vehicle that is extremely simple to steal (you can unlock everything with a screwdriver), to protect it I use both a pedal lock, a secret second key and a steering wheel lock.

Will it defeat a determined thief or a team of thieves? No way. However it will put off most opportunists and slow down a more experienced thief enough that they may choose another target.

sct202• 9 months ago

And even still, whenever I or a friend has hired a locksmith, they try for 5-10 minutes with no success and drill thru the lock destroying it.

jihadjihad• 9 months ago

LPL is a crown jewel of YouTube. His April Fools' Day videos are hilarious, too, like the one where he gets into his wife's beaver [0] (SFW).

0: https://www.youtube.com/watch?v=TRozAbaKs9M

bouke2• 9 months ago

The Dutch translation is NSFW though as it translates “beaver” as suggested.

ErroneousBosh10• 9 months ago

he routinely destroys bogus claims of various companies within seconds

I watched his video on high-security shipping container locks. Jeez, two minutes long? They must be tough!

No, it was two minutes long because he bypassed ten of them, one after the other.

masklinn3• 9 months ago

That’s McNally rather than LPL.

xnzakg• 9 months ago

This one? https://youtu.be/_goIYP3FfO8

QuercusMax• 9 months ago

My impression of most locks now is that they're really just to stop something from being casually broken into or even just falling open by accident.

plumeria• 9 months ago

Can he pick an Assa Abloy lock though?

JCM9• 9 months ago

Great channel, and yes the ineffectiveness of nearly all commercially available locks is depressing. At best it would briefly slow down a skilled picker.

legitster• 9 months ago

It's quite entertaining to see how little security you actually get from most locks.

Yeah, one of my conclusions after years of watching LPL is ironically to start buying cheaper locks.

The difference between a $3 and a $300 lock is just about a minute of time for an experienced lockpick. No lock is capable of dissuading a determined thief, but any lock is equally capable of dissuading a lazy one.

jaggederest• 9 months ago

The best policy is to have a lock that is resistant to cutting and destruction, with a trivial key. Nobody tries to pick a lock, and if they do, they're winning. Most or all breakins happen through brute force not technical sophistication, so a decent chunk of metal is a fine adaptation.

kraussvonespy• 9 months ago

Yep. The low hanging fruit principle in action. You can’t make anything completely secure so you put up more obstacles than your neighbor so the attackers go visit the neighbor instead.

Or in the case of targets with no neighbors like missile bases, you know approximately how long it might take an attacker to succeed, then put big guys with guns within that distance measured by time.

magicalhippo• 9 months ago

I came to the same conclusion with my bike. What's the point of an expensive and heavy chain lock, when the thief will break or bypass it anyway.

So I just fot a cheap wire combination lock, just so you can't just jump in the bike and ride away.

themafia2• 9 months ago

I use the locks my insurance company recommends. That's who it's there for anyways.

The other side is "career" thieves will know how to pop-can shim a lock but most of them are not going to use or break out a set of picks. One main reason it's an additional felony charge if you get caught using them. So a _slightly_ better lock is sometimes warranted for outdoor applications.

The final piece is they'll just steal a car and then drive that car through your shop front to get what they want. Up here in Northern California a gang pulled off the same heist as the movie "Casino." They drove a van up to a wall and then knocked out a small segment of the wall to gain entry.

mrheosuper• 9 months ago

The difference between a $3 and a $300 lock is just about a minute of time for an experienced lockpick.

How about non-experienced lockpick? Or the one who gonna brute force everything? I think there's value is expensive lock (Assume you buy the high quality one, not the over-price one)

tim3333• 9 months ago

I'm considering an angle grinder resistant lock for the bicycle. They are not totally uncuttable but it means you have to be stood there for a couple of minutes changing worn cutting disks and the like. Quite expensive though.

userbinator• 9 months ago

The fact that he is actually a lawyer probably helps greatly, both in terms of what he can legally do, and as a deterrence to others trying to sue.

mothballed17• 9 months ago

This also works on places like HN. I will often make an argument in my normal, working class low educated redneck hick sort of writing style. People will assume I have an unsophisticated basis for my argument and are way more likely to debate me on it. They like to attack an 'easy' target and even better if they are culturally seen as different.

If I use my pretend upper well-to-do white guy rhetoric with precise and deep vocabulary, I can make claims with a lower likelihood someone will challenge it, even if they are equally well backed.

tuetuopay• 9 months ago

The most absurd thing is the original video response from the company was good, and with a very compelling argument: their customers never saw shimming in the field. Their user base don't need shimming resistance: security needs to be adequate, not perfect. And they follow-up by presenting options about people requiring the lock to be shim-proof.

Granted, in this day and age, it's a disgrace to still make locks that can be shimmed. Especially when the shim-proof alternatives they show just have an additional notch to catch the shim.

adgjlsfhk1• 9 months ago

their customers never saw shimming in the field.

This is arguably good PR, but a terrible response. Shimming is so quick and hard to detect that even if you had 24-7 video of the lock, you probably wouldn't notice that the lock had been shimmed. You would just assume that someone lost a key.

masklinn3• 9 months ago

Also the company sold a picking-proof version… at a higher price.

yreg• 9 months ago

It's a trailer hitch lock. If someone steals your trailer then you definitely do notice. And if they just shim the lock and put it back then it doesn't really matter.

robotnikman2• 9 months ago

I wonder how many stories like this are caused simply because a corporate lawyer is looking for some work to do, and maybe to meet some kind of internal KPI.

pcaharrier2• 9 months ago

Former in-house lawyer here and in my experience the answer is something like "probably less than you think." The job of the lawyer is to advise the client and (within the bounds of ethical rules) advocate for their position, not to come up what the company's position should be.

robotnikman2• 9 months ago

Interesting, thanks for the insight!

dghlsakjg3• 9 months ago

Honest question.

Is it the job of an in-house lawyer (or any lawyer) to say that this appears to be a vexatious or SLAPP case, and the client should not pursue it?

Is there an ethical obligation not to get involved in a case that you know is being prosecuted in bad faith?

jimbokun• 9 months ago

Under questioning, however, one of Proven’s employees admitted that he had been able to duplicate McNally’s technique, leading to the question from McNally’s lawyer: “When you did it yourself, did it occur to you for one moment that maybe the best thing to do, instead of file a lawsuit, was to fix [the lock]?”

Sometimes a single question tells you how the entire case is going to go.

rdtsc• 9 months ago

On July 7, the company dismissed the lawsuit against McNally instead.
Proven also made a highly unusual request: Would the judge please seal almost the entire court record—including the request to seal?

Tough at first then running away with the tail between their legs. Typical bullying behavior.

but Proven complained about a “pattern of intimidation and harassment by individuals influenced by Defendant McNally’s content.”

They have to know it's generated by their own lawsuit and how they approached it, right? They can't be that oblivious to turn around and say "Judge, look at all the craziness this generated, we just have to seal the records!". It's like an ice-cream cone that licks itself.

the case became a classic example of the Streisand Effect, in which the attempt to censor information can instead call attention to it.

A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

embedding-shape3• 9 months ago

A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

I'm just guessing based on the contents of the article, but it sounds like a typical "hard-fist founder-run company" so good luck convincing the founder to not sit on social media and argue their points.

dekhn4• 9 months ago

also known as the 'double down on stupid' and 'triple down on stupid'

SacToHacker• 9 months ago

If you want an extreme example of this; go look at the Sacramento startup Sircles. 7+ year old "startup" that has sub $100k revenue after several years but 9 million in debt. The founder has an account there under u/Sirclesapp where he goes off on toxic and insane tirades to anyone who dares say anything but utmost praise at his app. Apparently he stalks their reddit accounts and sends threatening letters to their personal home addresses from his lawyer for "defamation". That I understand he sent one to some ex employees and one to some woman who I think is a paralegal and is now suing them in civil court.

He partnered with some radio program called radradio where the host had a lot of personal issues and the show ultimately got axed. The radio host was known for having issues with alcohol, but they kept partnering with him because he kept shilling their WeFunder. They've raised over $6m in SAFEs but considering they are $9m in debt, haven't broken $100k lifetime revenue after 7 years, and seem to have over a million a year burn rate, it's doubtful that the shares from those SAFEs (if ever executed) would ever be in the money.

karlgkk• 9 months ago

Wow, it seems like the whole purpose of the product is grievance based against yelp. Don’t get me wrong, I’m not a fan of yelp, but I get the vibe that maybe this person would be even more extractive if given the opportunity

eru5• 9 months ago

[...] go look at the Sacramento startup Sircles. 7+ year old "startup" that has sub $100k revenue after several years but 9 million in debt.

Going on a tangent:

Depending on your industry, taking a while to see any revenue is common. Eg look into biotech or the people trying to make atomic fusion a reality.

Debt is just as valid a way to finance your company as equity is. See https://en.wikipedia.org/wiki/Modigliani%E2%80%93Miller_theo... for the theory.

samtho• 9 months ago

I’m from Sacramento and I know of people who worked at Sircles. It’s comically mismanaged and run by a comic book villian.

anitil2• 9 months ago

They also made sloppy mistakes like naming the Proven owner's partner un-redacted in a document they submitted to the court (which is then available through legal search engines). If they were concerned with privacy they could easily have withheld her name.

bux93• 9 months ago

The one time security through obscurity would have helped them?

Brian_K_White• 9 months ago

Guy who paid someone to throw a brick through his ex wife's window is insensed at being intimidated.

ljm2• 9 months ago

There is delicious irony in the owner of a lock company being so insecure.

DecentShoes2• 9 months ago

The company who sued him is, still, embarrassingly, attempting to hold a social media presence, despite getting exposed as fraudsters and bullies:

https://m.youtube.com/@provenindustries8236

7moritz7• 9 months ago

Proven Is so secure that if they detect a robber trying to lock pick they sue them.

Incredible

qwertox• 9 months ago

That article just kept getting better and better.

Also:

“Sucks to see how many people take everything they see online for face value,” one Proven employee wrote. “Sounds like a bunch of liberals lol.”

So when a great product is not a great product, it turns out to be great alone for the fact of being built by republicans.

hnlmorg2• 9 months ago

I think their point was that the lock picking videos were faked. But it’s still a silly comment from the Proven employee.

I’ve also seen people use “liberal” as a literal curse word before. On one “reality show”, a member of the cast broke down while highly intoxicated and started screaming at other people saying:

“You’re worse than a beep! You’re a liberal”

It’s insane just how far the political divide has become.

moomin• 9 months ago

Yeah, I noticed that. I’d put money on not a single person in this whole dispute being a liberal at all.

oneeyedpigeon• 9 months ago

That was probably the final straw for me. Well, one of the final straws. Imagine trying to politicise this.

itchyjunk• 9 months ago

Shushh, don't tell people about Streisand Effect.

strangattractor• 9 months ago

One thing Proven might have done is to analyze the attack. Then see if the lock could be improved to prevent it. Offer exchanges for the old locks (most of which are unlikely to be requested). Instead they resort to Lawyers, refuse to solve the problem and waste everyones time and money.

zahlman2• 9 months ago

So... what should we be using for physical security?

shagie2• 9 months ago

The question is "what do you want to secure against?" Describe the threat and then go from there. What are you securing? Is it meth-head or teenager? Or is it person determined to get in while making your insurance grill you over "did you lock it?"

alistairSH• 9 months ago

In the case of a trailer, you do some combination of...

- Receiver pin lock similar to the one highlighted here (but probably not that exact one) - Wheel lock / boot - Receiver coupler lock (locks inside the cup-shaped receiver, preventing somebody towing the trailer with an undersized ball) - Secured storage lot / garage

But, basically all options are only going to stop random opportunistic thieves. If somebody really wants whatever you're protecting, they'll find a way. That's why insurance exists.

teekert• 9 months ago

Just clicked around after watching the vid and stumbled onto [0]. So there are locks he recommends... When it requires focus + several minutes to pick.

[0] https://www.youtube.com/watch?v=HrV86GqlY8o

sebstefan2• 9 months ago

I do lockpicking and swear by "Abus" locks

shagie2• 9 months ago

Long (often an hour long) with significant snark videos going over the filings: https://www.youtube.com/@RunkleOfTheBailey/search?query=Prov...

modeless2• 9 months ago

In the end, Proven’s lawsuit likely cost the company serious time and cash—and generated little but bad publicity.

There's no such thing as bad publicity. People say this for a reason. It's true. I'm willing to bet that their sales have only increased since this started.

Tade0• 9 months ago

Who is in the market for a product that doesn't work as advertised?

leni536• 9 months ago

Lockpicking youtubers? But I guess that market got exhausted early on.

paxys• 9 months ago

There's absolutely such a thing as bad publicity. Entire products and even companies have tanked because of bad publicity. I don't know why this myth continues to be so prevalent.

dec0dedab0de• 9 months ago

I think the saying is for people who can take the bad publicity and use it to their advantage.

henry20232• 9 months ago

I didn’t buy a Juicero back in 2015. Seems like I was not the only one.

modeless2• 9 months ago

Bad publicity doesn't guarantee success for a bad product. But it doesn't doom a good one either.

ktallett• 9 months ago

You're right! I'm off to the next Fyre festival and making sure my bag is secure with a Proven lock..... I wonder if Dassani still exist so I definitely can quench my thirst.

jasonjmcghee• 9 months ago

Humane Pin?

rkhassen9• 9 months ago

Um...shouldn't Proven just hire Trevor McNally as a consultant or heck, make him a partner? I mean...can you imagine the next level reputation they'd have if they can adapt and make a Trevor-proof lock?

I'd buy it.

zem• 9 months ago

clearly proven needs to sue whoever initiated that lawsuit for "mockery produced for the purpose of humiliating plaintiff”.

tptacek• 9 months ago

The whole case is up on RECAP:

https://www.courtlistener.com/docket/70036390/proven-industr...

vladmk• 9 months ago

Yeah saw this - I can't believe a company would steer so far wrong...

dekhn4• 9 months ago

I once worked for a company that kept its passwords locked in a safe. One day, all other copies of the password were lost, and they needed it, but the safe's key could not be found.

They expensed a sledgehammer and obtained the password through physical modification of the safe using a careful application of force. Some employees complained that meant the safe wasn't... well, safe.

The security team replied "Working as Intended" - no safe is truly safe, it's just designed to slow down an attacker. At that moment, I was enlightened.

russdill• 9 months ago

Excellent koan

Terr_3• 9 months ago

    All Security
    Hinges on the arrival
    Of people with guns

cwsx• 9 months ago

Obligatory xkcd

https://xkcd.com/538/

spigottoday2• 9 months ago

Thunderbolt and Lightfoot (movie).

astroflection• 9 months ago

  All security
  is merely a fantasy
  of mortal people.

kqr• 9 months ago

Slow down -- sometimes. But for the most part, locks are more like envelopes. They produce evidence of tampering.

eru5• 9 months ago

They produce evidence of tampering.

That's why one of the more advanced challenges in lock picking is to minimize the amount of evidence you leave. Eg even a normal pick can leave some scratches on and in the lock in different places than a normal key.

If I remember right, 'bumping' is an interesting technique partially because it leaves even less of a trace.

implements• 9 months ago

Yep. There’s a safe engineer on YouTube who was explaining the history of dial combination locks commonly used for government filing cabinets, etc. He pointed out that you can drill them in minutes but you’d need several hours to make good the damage such that the break in wouldn’t be easily detected. The combined time is therefore the ‘strength’ of the security. (Also, why it might be a good idea to have open sensors on safes, cabinets, etc)

Cthulhu_• 9 months ago

Yup, I've got a three bolt break in resistant front door in my house, but right next to it is a window that can be breached in .5 seconds by yeeting a brick though it. But both will leave traces if they've been forced so my home owner's insurance should cover any losses / damages.

wongarsu• 9 months ago

Which is why McNally (the youtube in the title) demonstrating poor locks that can be opened by simple bypass attacks like shimming or whacking is especially damning for those locks. You can always destroy a lock with brute force, preferably power tools. You also spend years honing your lock-picking skills and open any keyed lock in less than a minute, but good locks make this a difficult craft. But shimming a padlock or whacking a masterlock with another masterlock takes no skill, doesn't leave evidence and allows you to relock it when you are done. It defeats every protection the lock was supposed to provide

al_borland• 9 months ago

Most locks are there to keep honest people honest.

hvenev• 9 months ago

From what I remember, the quality of a safe is measured in minutes, with "15-minute" safes being OK for general use.

Beretta_Vexee• 9 months ago

I worked on port facilities. Everything corrodes quite quickly, and locks and keys need to be replaced fairly regularly. Once, there was a problem with key management following the replacement of locks on a building containing emergency diesel generators.

The doors were heavy, 45-minute fire-rated security doors, aka "Fucking heavy doors that can cut your fingers just from inertia or wind.".

These doors had to be opened quickly in the middle of the night. There was no locksmith on call, but there were boilermakers. Supports and a chain were welded to the doors, and a T-Rex container mover was used to carefully pull the doors off the building.

The whole operation took less than an hour. Physical security is a matter of time and resources.

atoav3• 9 months ago

I mean theoretically ever the hardest encryption just buys you time. That time may be long past the lifetime of our own sun, but it just buys you time.

The same is true for locks and safes as well.

Being one of the few people who never had their bicycle stolen in a city where this is common, the trick that always works is: Just make your lock harder to attack than other locks that safeguard comparable things.

  Good lock + old looking bicycle = no theft

Unless your stuff is unique and high stakes that means regular criminals won't pick you since the surrounding stuff looks more intersting and is the easier target.

tim3333• 9 months ago

I think 'one time pad' encryption can't be decrypted unless you get the key, even given infinite time.

Ylpertnodi2• 9 months ago

Good lock + old looking bicycle = no theft

"I parked my old, crappy bike and started locking it. Some guy went past and said, "Don't worry, love - no-one will nick that", and a passing crackhead said "I fuckin' would", and we three strangers shared a moment of humour together. "

smartbit• 9 months ago

I’d say

  Good lock¹ + old looking bicycle = no theft
  ¹ attached to solid fence or bicycle rack

muyuu• 9 months ago

reminds me of how a few years ago it became fashionable to say that "walls don't work"

HexPhantom3• 9 months ago

When the theory hits reality with a sledgehammer

Animats• 9 months ago

However, for good safes, there's a rating on how long it takes.[1] Ratings start at TL-15, for 15 minute resistance against hand tools. They go up to TXTL-60: torch, explosive and tool resisting for 60 minutes. Safes with these ratings will have a metal plate indicating UL testing and approval.

If there are any rated safes on Amazon, I can't find them. A real TL-30 1 cubic foot safe sells for about $2000 and weighs about 500 pounds. Amazon sells something that looks similar for about $100 and weighs about 15 pounds.

There's a separate set of ratings for fire protection, from the NFPA. Fire safes are much simpler. They have more insulating materials and less steel.

[1] https://www.vaultandsafe.com/vault-safe-classifications/

duxup• 9 months ago

It kinda fits how I feel sometimes.

Folks come up with some super secure idea for securing my account and I think "Yeah but maybe I forget the thing ... I do still want to access it."

croes2• 9 months ago

Proven argued that it would be difficult for an untrained user to perform.

That’s are exactly the people who usually break locks. All others fail on simple locks too.

croes2• 9 months ago

Lee’s partner and his mother both “received harassing messages through Facebook Messenger,” while other messages targeted Lee’s son, saying things like “I would kill your f—ing n—– child” and calling him a “racemixing pussy.”

Some people always go too far, undermining the good cause of the others

anitil2• 9 months ago

If anyone is interested in the legal side, I'd also recommend 'Runkle of the Bailey' who has a series on this saga but with a focus on the legal shenanigans [0]

[0] https://www.youtube.com/watch?v=y3WVme9LAcQ&list=PLo0bMOObfk...

logicallee• 9 months ago

This is the stupidest thing I read today.

realaaa• 9 months ago

so they were even asking for it themselves? ahah, geniuses

sreekanth850• 9 months ago

Suing someone because your product doesn't work correctly is diabolical. Instead of filing a lawsuit, they should have acknowledged the issue and released an upgrade to their locks.

bdamm• 9 months ago

Ah, but the truth came out here; the can't sell a lock that is upgraded, because they already do sell one at a higher price.

There are cheaper locks if you don't care to defend against shimming.

rdiddly• 9 months ago

What a snowflake.

kuil009• 9 months ago

OMG

DecentShoes2• 9 months ago

The company who sued him is, still, embarrassingly, attempting to hold a social media presence, despite getting exposed as fraudsters and bullies:

https://m.youtube.com/@provenindustries8236

lenkite• 9 months ago

Haven't laughed so much reading an article recently. Wow, this story looked taken right off a comedy movie.

jeffreygoesto• 9 months ago

https://youtu.be/PVhYhLQ4Y64?si=5UrMMeovCkP2J3Nr

jbs789• 9 months ago

Sounds like the guy had rude awakening that his lock wasn’t as good as he thought it was.

Another way of responding to this is… to improve the lock?

Could even explore a positive collaborative social media campaign promoting the new lock.

Ship has sailed now…

jeroenhd3• 9 months ago

There were locks that were secure against this attack, but they're more expensive. The cheaper locks vulnerable to this attack probably still makes them a load of money, though.

hufdr• 9 months ago

If a company’s first reaction to a flaw is to sue instead of fix it, the problem probably goes beyond the lock itself. A real security company would appreciate someone pointing out a weakness rather than trying to take the video down. That kind of openness would actually make people trust them more.

jeroenhd3• 9 months ago

The weird thing is, they actually had someone competent dealing with the issue:

The strange thing about the whole situation is that Proven actually knew how to respond constructively to the first McNally video. Its own response video opened with a bit of humor (the presenter drinks a can of Liquid Death), acknowledged the issue (“we’ve had a little bit of controversy in the last couple days”), and made clear that Proven could handle criticism (“we aren’t afraid of a little bit of feedback”).
The video went on to show how their locks work and provided some context on shimming attacks and their likelihood of real-world use. It ended by showing how users concerned about shimming attacks could choose more expensive but more secure lock cores that should resist the technique.

Sounds to me like someone professional in the company with a cooler head was on this and was handling it well, but someone else higher up got angry and aggressive and decided that revenge was more important.

pkphilip• 9 months ago

One of my favourite lock pickers is Marc Tobias. He was also sued by a number of lock companies.

https://www.youtube.com/watch?v=NadPAE6BDbA

It is interesting to see that these companies still don't know about the Streisand Effect or they choose to think that it won't happen to them.

foofoo122• 9 months ago

He just dropped a new video. Totally roasted the cunt out of that Easilok: https://www.youtube.com/watch?v=3lS5_6D4q9k

Azkron• 9 months ago

This reminds me of the CEO of a cyber security company that challenged Anonimous https://en.wikipedia.org/wiki/HBGary. If you work for any kind of security company, do not ever ever ever challenge any kind penetration specialist. Everything is hackable, it is only a matter of cost vs reward, but when you challenge someone that goes out of the window.

matheusmoreira13• 9 months ago

Generalizing the advice..

Don't challenge people. Don't insult people. Don't humiliate people. Don't threaten people. Allow them to maintain their self-respect even when they lose. Don't rub it in. Give them a face-saving exit.

Plenty of violence and aggression is caused by violation of the above rules. They seem simple but they're broken on a daily basis. Famous last words: "you don't have the guts".

kh_hk• 9 months ago

It would be funny if all this was just a liquid death marketing campaign

wafflemaker• 9 months ago

Once came back to work after 4 week holidays (not USA) and realized I forgot the 3 digit code to my locker.

But I remembered that friend's locker (he was on holidays then) used US police code for murder. (Police in US use codes for crimes when communicating on the radio).

I googled the code, used friend's locker for the day, and by lunch the next day I've bruteforced through enough codes to learn that my code was the embarrassing 420.

simonw• 9 months ago

This reminded me of Matt Blaze's work on physical lock security back in 2003. He found a method of deriving the "master key" for a building (one key that opens all locks) from a single example: https://www.mattblaze.org/masterkey.html

When he published about this he was bombarded with messages from locksmiths complaining that they all knew about this and kept it secret for a reason! https://www.mattblaze.org/papers/kiss.html

It was a fascinating clash between computer security principles - disclose vulnerabilities - and physical locksmith culture, which was all about trade secrets.

czx111331• 9 months ago

Perhaps the most important difference is that software — even after being purchased and used — remains relatively easy to patch, unlike a physical lock.

sigmoid102• 9 months ago

Tbf that's a new-ish principle. 2003 was Windows XP era and the early days of Metasploit. I.e. Microsoft and all the other companies were still figuring out this internet thing, while most computers were riddled with unpatched vulnerabilities. There was no such thing as zero day back then, because you could use many exploits years later.

chmod775• 9 months ago

It just takes seconds to swap the core on most locks.

yubblegum4• 9 months ago

In 'Three Days of Condor', Robert Redford's character locates the hotel room of a professional hitmat (who is after him) by going to a locksmith and asking him "which hotel and room this key belongs to?" and the locksmith asks him "are you in the trade?" and he responds, "No, but I read a lot".

bean4692• 9 months ago

Watched it a few months ago, such a great and under-rated film! RIP Robert Redford

HexPhantom3• 9 months ago

In the long run, transparency always wins

jama2115• 9 months ago

But in the short run it could cause enormous damage if you are irresponsible in your methods.

smcin• 9 months ago

There's a reason for the different cultures and information asymmetry: in most countries you need a criminal background check to be a locksmith. But not to operate a keyboard.

DrewADesign• 9 months ago

Right. I’m in a structured trade right now and learning about _~hF.8f@,8zKub&&@(4’v but we’re not supposed to talk about it. At least they let us use the company computers for personal net stuff.

mike50• 9 months ago

That only applies to access to modern electronic tools and digital codebooks requiring accounts. Nothing prevented people in the past from buying the physical books used.

trollbridge• 9 months ago

Long ago I used to maintain a door lock system. I was responsible for designing a new system to encode the room keys and it became obvious as I worked with the internals that it had a vulnerability that would allow anyone to open any lock from this vendor with the right tool.

When I quietly mentioned this, the response was that everyone knows this but we don’t talk about it.

When Mahmoud al-Mabhouh was assassinated with no signs of forced entry on his hotel room, let’s just say it wasn’t surprising. And no, I don’t think these security flaws are some conspiracy or by design - it’s simply the difficulty of updating firmware on 10 year old boards with a 20 year old design with millions of them out in the field. And they cost around $750 a piece to replace and that was back in 2010.

polynomial• 9 months ago

Securing the room's internal physical latch after the assassination was a nice touch.

SoftTalker• 9 months ago

"Who are you and how did you get in here?"

"I'm a locksmith, and I'm a locksmith."

giovani• 9 months ago

Police Squad!

vdfs• 9 months ago

"Although a few people have confused my reporting of the vulnerability with causing the vulnerability itself, I can take comfort in a story that Richard Feynman famously told about his days on the Manhattan project. Some simple vulnerabilities (and user interface problems) made it easy to open most of the safes in use at Los Alamos. He eventually demonstrated the problem to the Army officials in charge. Horrified, they promised to do something about it. The response? A memo ordering the staff to keep Feynman away from their safes."

jama2115• 9 months ago

Security through obscurity in a way…

jmpman2• 9 months ago

When my first house was under construction in 2001, I created my own key from the builder’s key. When I finally moved in, my key would then disable the builder’s key. Curious how this work, I disassembled my lock and found that there were (iirc) 8 keys which would open all my neighbors houses, even after they had moved in and had disabled the builder’s key. Of course I rekeyed my house to prevent that vulnerability, but in theory it remains on all my neighbors. I also didn’t disclose the vulnerability.

shaftway• 9 months ago

I don't know about builder's keys from that era, but modern builder's keys aren't vulnerable to this problem. The builder's key uses a deeper cut on one or more pins, but the owner's key can and should be pretty unique. The only real requirement is that there be at least one cut to a high enough number to allow for a builder's key. There's a good video here: https://www.youtube.com/watch?v=GUCW4OnE6Mc

Maybe they used a master key system instead.

agumonkey• 9 months ago

Even as a computer nerd, I find computing culture to be often too radical sometimes.

jama2115• 9 months ago

Agreed

amelius• 9 months ago

Wait, what if a hacker found an exploit and then published it without giving the company a chance to fix it?

HexPhantom3• 9 months ago

They turned a one-minute critique into a PR disaster that millions of people now know about

aswegs8• 9 months ago

The wohle article reads to me like: "AMERICA FKK YEAHHH BROO, HE GOT PWNNNDD, SON!" eagle sounds

Gotta admit its entertaining, though.

dpoloncsak• 9 months ago

Saw the headline, knew it was going to be McNally.

God Bless McNally

throw7• 9 months ago

Who knew shaking a juice box could be so intimidating!

xyst• 9 months ago

LPL (Lock Picking Lawyer) has been making a fool of MasterLock and other physical security products/marketing for many years.

Guess ML realizes it’s best to be humiliated online where a small subset of population would never buy their products anyways. Rather than humiliate themselves in public like Proven Industries did (Barbara Streisand effect?)

ngcc_hk• 9 months ago

Interesting story but surprisingly bad write up. What happen to arstechnica.

sebstefan2• 9 months ago

The entire field of locksmithing has a failing culture around security. They still rely on security by obscurity, they sue attackers, and they never improve

10M people watched a YouTuber shim a lock; the lock company sued him – bad idea

Related Stories