HN user

emhart

2,460 karma

Security Anthropologist

[ my public key: https://keybase.io/shoebox; my proof: https://keybase.io/shoebox/sigs/mtTjfegwtFEHgx0Hw0eMLsT6UO7GbbgqN1OLbp6emIw ]

Posts47
Comments308
View on HN
schuylertowne.com 11y ago

Rethinking the Origins of the Lock

emhart
48pts10
www.spymesat.com 11y ago

SpyMeSat: Know When a Satellite Could Be Imaging You

emhart
1pts0
sijmen.ruwhof.net 11y ago

Cross-site scripting in millions of web sites via #jQuery Validation Plugin

emhart
1pts0
schuylertowne.com 11y ago

The Current State of Smart Locks

emhart
95pts52
blog.blacknews.com 11y ago

Judge Sentenced to 28 Years for Selling Kids to the Prison System (2013)

emhart
184pts102
news.ycombinator.com 12y ago

Ask HN: Current state of Geo-IP?

emhart
2pts1
national.deseretnews.com 12y ago

Thief in the night: Stealing in a digital age

emhart
1pts0
www.washingtonpost.com 12y ago

The first suspected Heartbleed hacker has been arrested

emhart
2pts0
www.interpretermag.com 12y ago

Russian planes are landing in Crimea and column of APCs heading toward Simferopol.

emhart
2pts0
www.kyivpost.com 12y ago

At least 9 reported dead, more than 100 injured near Ukraine's parliament

emhart
100pts43
bemasher.github.io 12y ago

An rtl-sdr receiver for smart meters operating in the 900MHz ISM band.

emhart
1pts0
euromaidanpr.wordpress.com 12y ago

Ukrainian Security Service Prepares to Destroy its Archives

emhart
9pts2
www.independent.co.uk 12y ago

Skinny Puppy invoices US for using their music as torture device in Guantanamo

emhart
7pts1
www.platohistory.org 12y ago

Plato Emoticons Revisited

emhart
1pts0
blog.wellcomelibrary.org 12y ago

Thousands of years of visual culture made free through Wellcome Images

emhart
1pts0
www.3dsystems.com 12y ago

3D Systems and Hershey Team Up To Deliver 3D Printed Edibles

emhart
2pts0
www.quora.com 12y ago

Function that converts two numbers into one so that they can always be extracted

emhart
2pts0
www.engadget.com 12y ago

JetBlue Fly-Fi Test

emhart
1pts0
www.theatlantic.com 12y ago

Why We're Marching Across New Hampshire to Honor Aaron Swartz

emhart
2pts0
news.ycombinator.com 12y ago

Ask HN: Why are font licenses for apps ~10x more expensive than web?

emhart
3pts2
qcraft.org 12y ago

Quantum Physics mod for Minecraft

emhart
3pts0
www.newyorker.com 12y ago

Picking the Bridge

emhart
1pts0
qz.com 12y ago

Lego Looks to Expand in China, the Land of Lego Knockoffs

emhart
1pts0
physicsworld.com 12y ago

Physicists create 'molecules' of light

emhart
1pts0
www.3ders.org 12y ago

Peachy Printer - The world's first $100 3D Printer

emhart
1pts0
eprint.iacr.org 12y ago

How to Run Turing Machines on Encrypted Data

emhart
1pts0
www.cooperhewitt.org 12y ago

Planetary: collecting and preserving code as a living object

emhart
1pts0
www.techspot.com 12y ago

Google’s legal counsel says Gmail users have no expectation of privacy

emhart
21pts6
dartthrowingchimp.wordpress.com 12y ago

Using Wiki Surveys to Forecast Rare Events

emhart
1pts0
www.theatlantic.com 12y ago

13 Little Things NASA Did to Get Alan Shepard Ready for Space

emhart
2pts0

Thanks. I hadn't yet arrived at the greedy lock portion when I posted the above, but I finished the article soon after and absolutely loved it. The other thing worth noting is that while it sounds like there was some regional bias toward Fred Buns at your store, they should have different combinations of dials/letters on some of their locks. Also, also, some should be reconfigurable, which leads me to the challenge:

Optimal combination of dials in the circumstance that the dials can be rearranged.

& Don't sweat dial/tumbler, dial is more specific anyway, tumbler is the generic word.

Combination locks that use letters/characters/non-numeral-glyphs have been around for an astoundingly long time, what's interesting about the word lock, though, is that they start with words, then make the dials.

https://www.google.com/patents/US6621405

The patent goes into detail - and is actually super easy/enjoyable to read - but the goal was to have a letter lock that maximized the number of real words that could be spelled from the available letters provided on the dial rings. So, a wordlist is generated under some parameters (such as word length) and then the rings are generated from that word list.

It's basically exactly what the author is doing, but in reverse.

The goal of the word lock was to increase the available keyspace of real words in a letter lock, thus increasing the security of those users who will buy a letter lock regardless. They do a number of other things right mechanically as well. Whether or not a bike lock is the best medium, I wouldn't say, but wordlock silently improved the security of a specific user base that greatly prefer convenience to security. That's awesome.

I am part way through your trajectory. I was a designer first, fell in love with html/css, eventually gave in and learned js, started to really enjoy that and have now been edging my way to the back end for a while. Now I'm job hunting at the same time and definitely feeling that desert of despair. Was glad to see your post, gives me some hope!

Yeah, southwest of Boston we are getting wrecked. Still coming down hard, hoping it finishes up soon. I'm glad we had the warnings, and I'll be particularly glad if we lose power, which seems pretty likely at this point, since the warning gave me the chance to stock up, charge battery backups, etc.

Originally because it was fun and helped pay the bills. More and more recently I code to better understand things I'm thinking about or build small tools that are useful to me.

My inspiration for all of my work is a fear that no one else is going to look at the things I'm looking at, think about the things I'm thinking about or discover the answers I'm trying to find. This is less ego-maniacal than it sounds (I think), there just aren't many people pursuing my particular passion, so I genuinely feel like I need to do everything with it I possibly can before I die.

The rififcoup!

So named for the fabulous film Rififi, in which burglars rented an apartment, then drilled through the ceiling to the floor below. This was a direct reference to the French criminal anarchist Alexandre Marius Jacob who famously carried out just such an attack in the early 20th century. At his trial (for murder, among other things) he uttered one of my favorite quotes. He was asked what had become of him, he had traveled the world as a sailor, he was educated, how had he become a murderous anarchist. To which he replied:

"I have seen the world. It is not beautiful."

Not a stupid question at all. A dive through the patent record reveals a ton of amazing ideas for locking random objects up. in my conversations with Bob Swartz he has been fond of saying that locks are essentially latches, which is a great way to think of them. Here is a quick rundown of locks that have been patented that cover your examples:

Time Lock for Cigarettes: https://www.google.com/patents/US2681560

Combination lock for Pill Bottles: https://www.google.com/patents/US3405828

Ok, not a sleeve, but a mechanical lock for jacket pockets: https://www.google.com/patents/US1138507

and, of course, briefcases take a lot of locks, including very high security ones: http://bagstogo.com.au/Secura-Case-15cm-Security-Briefcase-w...

And thanks for the kind words!

Yes, it is a very good idea. That's precisely how the Mas Hamilton/Kaba Mas X-series safe locks work. The dial is rotated a few times first, at which point the lock powers on and can be operated, solenoids fired, etc.

However, those safe locks get to control many other aspects of the mechanical makeup of the lock, and rely on well defined and reliable standards of production of the doors they are applied to. Consumer smart locks don't get that advantage, so the amount of power required to throw a bolt won't always be consistent. I don't know what it would take to ensure enough human power is transferred to provide enough force to always overcome a stuck bolt.

Mechanical locks will always be more comfortable to me, I'm sure. But I think that has something to do with understanding how it works. I'm a mechanical security guy, I'm able to follow the general field of electromechanical security and have a sense of info/network/app security, but I'll probably never completely know how those things are keeping me safe.

Most do, only the Haven explicitly positions themselves as anti-key, but Yale offers a keyless experience and it is possible to go completely keyless with both Lockitron and August as well.

Yeah, sorry to fall short of actual physical testing. There are some awesome researchers champing at the bit to get their hands on a collection of these locks, so expect blog posts, conference presentations and papers to start trickling out over the next year or so.

Personally, I'm very interested in your experience of living sans key. Do you live with anyone else? Was there any discussion or extended thought process before making the switch? Do you have an idea of what your ideal lock would be/do?

So it is potentially as cut and dry as you suggest, but I'm going to dig into the anthropology of security a bit here and posit that in certain pockets of the world we are entering a post-lock age. Where, as Paul Gerhardt said, locks are about choosing who you let in.

To do this idea justice I should give you a thousands words on the great lock controversy of 1851, but suffice it to say that there was a watershed moment in the 19th century when England, and by extension Europe & the colonies, learned that the idea of perfect security was dead. While technological innovation temporarily boomed, it ultimately fell into a century-long decline. This was punctuated by the criminalization of the exploration of security, and a bunch of other bad stuff.

In general, we saw a decline of technological methods of ensuring security and a dramatic increase in political methods of ensuring security. Whether or not this worked, in the past decade in the US we have developed pockets of this country that, despite reasonably high population density, could completely eschew locks without much worry. Locks have become as much a symbol of social order as a mechanical construct.

OK, all of that said - for those people who are enjoying this level of safety and security, locks take on a different idea. Keys often seem burdensome, and when trying to sell new products to this market, you can't rely on scare tactics anymore. Instead we see a big shift toward convenience (this is mirrored in the early 19th century, by the way) and now, the addition of social features, which shouldn't be misunderstood to mean twitter, facebook, etc. But the ability to share keys easily, to security semi-private spaces in easy, convenient ways.

As a whole, we aren't living in a post-lock world, but there is a vibrant market of people who are living in something close. To them the lock needs to do more than act as a bulwark to roving malice.

EDIT: For the record, I didn't downvote you, and I'm a little bummed to see that others did. I think you brought something up that a LOT of people think, and I don't think it's invalid. It also provided me the opportunity to inject some nuance, so I was glad you commented!

I'm glad you referenced that article with your concerns, I'm actually quoted it in, but I think it was a bit of a shallow examination of a very deep topic.

I have my sole passion on the line when it comes to the decline of purely mechanical locks. My heart is brass and pumps grease. I love locks. That said - folks who can't imagine a time when the majority of door locks are electromechanical might wind up on the wrong side of history.

One of the constant refrains when I first found locks was that electronic locks could never be used in remote places where access to power might be a problem. Then I learned about the Kaba Mas X-series of user-powered safe locks. To the drop-it-in-water concern, many people are already using phones that are fully submersible and all of those people can use their phones to open several of the locks in this article. Not to mention waterproof electronic fobs.

There are a ton of pitfalls, the worst of which I touch on in the section on Yale's Real Living lock. The electronic lock manufacturers need to look to the history of mechanical security engineering before they reintroduce long-since-solved flaws. However, these systems are becoming robust and consumer ready. There are amazing electromechanical locks meant to be used exclusively on shipping containers, holding up to some of the worst weather conditions you can subject your hardware to. The market may not be mature just yet, but it is deep into puberty and whatever comes next will convince many more skeptics.

In the meanwhile, you can find me in a library, reading 19th century engineering texts, pretending the world I love isn't changing just as I learned to love it...

from the link, and their all caps treatment preserved:

ON JANUARY 27, 2014, THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK ENTERED A STIPULATION AND ORDER FOR INTERLOCUTORY SALE OF BITCOINS WHEREIN THE UNITED STATES AND ROSS WILLIAM ULBRICHT AGREED THAT THE UNITED STATES MAY SELL ANY PORTION OR ALL OF THE COMPUTER HARDWARE BITCOINS ON A DATE OR DATES IN A MANNER TO BE DETERMINED BY THE GOVERNMENT.

So, it sounds like he clearly agreed to something, as he is mentioned by name here.

Heh, if you want to go absolutely bonkers you could go with a lockitron/august/Haven on the interior, multi-point locking system in the door, an Abloy Protec 2 or EVVA MCS for your primary lock, and a Drumm Geminy Shield over that. (the Drumm shield is a lock to protect your lock.)

Remarkably, you could probably make it all happen for just north of 1k, or less if you are willing to do much of the labor yourself. Of course you'll have to wait for your smart lock to arrive, but you can rely on the mechanical locks in the meanwhile.

And any mechanical security enthusiast you invite over will be absolutely floored by your setup.

Is there an upper limit to the number of characters this will analyze? I've gotten into arguments here & on reddit that, while civil, are certainly more vitriolic than what the script found. All I can think is that longer diatribes are ignored?

From HN: "I've researched the "why" and a couple years ago had the opportunity to discuss some of the broader ideas in the history & anthropology of locks. It was actually titled "Why do you lock your door?" -emhart

From reddit: "Very glad you dropped in. Nice to have someone with first hand experience offer this up, thanks." -schuylertowne

From twitter: "Here is the US patent filing for that taiwanese lock, so you can see the illustrations: https://t.co/K7F3aY6RTD" -shoebox

Reverse OCR 12 years ago

It has been fantastic watching Darius' myriad experiments over the past few years. His work always has a great mixture of whimsy and serious experimentation.

Started using Brackets a couple months ago as I'm on a contract that requires me to work on a client's hardware rather than my own. Killer feature for me has been the inline CSS editing from html. Particularly as I'm stuck using a single monitor atm, this is nice as it lets me keep my css generally hidden instead of concurrently displayed as I often do in other editors.

Dig it. The "Export to twitter list" functionality in particular. Being able to not only sift through everything, but curate for the future is exactly what I want. Good stuff.

A: He implies it was previously impossible in the article with this line:

"As a result, all anyone needs to open many locks previously considered “unbumpable” ..."

B: He asked someone to tell him how it could have been bumped prior to this application.

C: I described, in my scenario, the purchase of a 1 Euro blank from someone who runs the machine, which is actually /less/ than the Shapeways scenario, which is otherwise the same - you don't purchase the equipment, you purchase the product the equipment makes.