Schneier on Security

Clive Robinson • November 23, 2017 1:28 AM

@ Oh really?,

I’m going to go out on a limb and say Clive you have not picked a Medeco.

Apparently they’ve been used in the Whitehouse, which might have been a recomendation for a lot of people… But I suspect part of the reasoning was a PR one as they were “All American” and made in Salem “Witch” might be another plusss… point

But it does not take too much latteral thinking to realise that they don’t realy need security locks in the Whitehouse of a high calibre, unlike say prisons that tend to use quite different much more secure locks, as they play to an entirely different type of crook.

If you look back far enough on this blog you will find I pointed out that you should not carry your keys in a way they could be photographed. It supprised @Bruce our host at the time and quite a few other people.

But even high security prison locks fail for reasons I self developed myself when quite young. It was in later life I found out others had done so before me. It was when I was at college and actually spoke to one of the few British escapees from Colditz Castle during WWII, he got quite chatty when we got down to the “brass tacks” of lock picking and hand key making.

The reason he got chatty is simple as I’ve mentioned here a few times, I’ve cut security keys by eye since I was quite young (long before I’d left school). Thus he knew that I knew what I was talking about even though I was self taught (a skill that used to be highly prized still back in the 1970s unlike today).

Whilst it was fairly easy to get hold of key blanks from locksmiths even though they would not cut a key with a security number, the blanks were quite expensive. With access to a shop for model makers you could buy various gauges of brass “wire, tube, shim, plate and bar” much more cheaply and with no questions asked or suspicions raised. Which when you are working on “pocket money” is important. Effectively the price of one blank key would get you enough brass that you could then cut up into fifty of your own blank parts. The worst bit was silver solder them together to make the blank a solid skeleton key.

The secret about cutting keys by eye was knowing not the exact depth of cut needed but the relative cut depth pattern. Which is what lock manufacturers work by. They are almost always in fixed increments as that makes inventory, lock/key duplication, etc much easier thus reducing costs appreciably.

Also if you were making your own skeleton blanks you did not have to worry about “depth stops” or exact key thickness etc, that puts wriggle room firmly on your side in the game as long as you have “the touch” to “feel” the key in fluidly.

So I know when a lock is secure in of it’s self which most cylinder locks are not and more importantly when the alleged security comes from something that you can easily by pass such as locksmiths not cutting numbered or other labled as secure keys, but will sell you the blanks.

Any way as it happens you can let some one else tell you the same principles but done in a different way,

https://www.wired.com/2008/08/medeco-locks-cr/

If you want a slightly more secure cylinder lock that’s reasonably priced where the photographing of the key won’t work in the same way try looking at some of the more interesting Kaba mechanical locks.

Rather than use the normal serated edge keys Kaba have a key with variable depth pits in the faces of the key, and some have tiny bar magnets inserted. As a result the key is much less likely to break with weather warped doors and frames.

But remember cylinder locks are normally just mechanical and worse they are designed for “ease of use” thus they can be picked by the simple use of forces as the laws of nature alow,

https://www.mctyrelock.com/Key%20Bumping.html

Oh and the footnote is true you can bump a Medeco lock and you can buy a bump key kit for them from various specialists and it only takes half an hour or so of practicing to be relatively profficient with them.

So by now you should have guessed the answer to your question depending on what you mean by “picked”. So yes I’ve “lock-picked” a Medeco lock, but no I haven’t “picked” Medeco locks for use as the price benift ratio is wrong.

Clive Robinson • November 23, 2017 8:07 AM

@ Oh realy,

A simple video demonstration should be feasible enough then and only take you a few seconds.

That tells me two things,

1, You’ve never made a video of broadcast quality in your life.

2, You have ulteria motives as there are already videos out there demonstrating Medeco looks failing.

…

Clive Robinson • November 23, 2017 8:47 PM

@ Oh Realy,

The point isn’t to drag you at all Clive, the point is if you haven’t done it yourself then you haven’t. There’s no shame in saying so.

But I’ve already told you I have, how and about how long it took to get it to be a fluid motion.

In general there are three sorts of people that pick locks sight unseen,

1, Locksmiths.
2, Those doing so covertly
3, Hobbyists.

Of the three only those doing it covertly need to be quick, quiet and fluid, though most hobbyists would like to do so. It used to be the case that a locksmith as part of his training and quallification was required to pick or impression two “standard locks” and they had an hour. But that skill appears dead these days as many who call themselves locksmiths just drill the lock out or use a slide hammer.

As for those who “demonstrate” well there are a couple of types and in general they do it for money either directly as a show piece or indirectly as part of getting a contract etc.

It’s interesting that you say,

take a thin piece of metal and a small pick and crack

That’s an odd way to say it. You normally talk of a pick and lever or wrench for picking a lock and a thin piece of metal as a “shim” or filed key as a “blank” for impressioning.

Oh by the way if you had read back on this blog you would have found quite a few comments from me about locks. In part because I used to design locks back last century admittedly they were mainly electronic in nature (used a standard ABA mag strip card but double the bpi for the key). But as we had to replace existing furniture there was quite a bit of mechanical design as well to connect back to the latch.

But, I first got interested in opening locks when I was around seven or eight and locks were a lot different back then. I looked on it as a challenge, not for crime. At school I used to unlock bike locks and swap them onto another bike as a practical joke. On the odd occasion I and a friend when in higher education would swap door locks on office doors. It was a little more skilled and less messy than “walling an office”[1].

But with age you get various maladies some of which rob you of your touch and fine motor skills. So whilst I can still pick 5 or 7 pin cylinder locks and five lever mortice locks I mainly use “bump tools” for cylinders. Because they have the advantage that you can not only demonstrate but also get audience participation, which tends to get the point home rather better than just using a pick and lever or pick gun.

[1] Apparently “walling an office” was a prank started in the US in the 1960’s when plaster board or dry wall was starting to get commonly available. What you would do is fix dry wall over a door, so it is flush with the wall and paint it etc so it looked just like the wall. Then put a notice board or similar on it. You would do this over a weekend or similar so that when the occupant came to work after a few days away they could not find the door to their office. I’ve been told it happens but have never seen it done as a prank, or met someone who had seen it first hand. But my friend and I tried it out at his house one weekend to see if it could be done for real and the answer is yes it can. You make up a friction fit frame and wedge it in with cross members, you then attach plaster board to it that is flush with the wall, but we had to take the door furniture off to do it because the handle stuck out to far, so I’m guessing if it is done as a prank it’s only in older buildings where the doors are sufficiently “set back”.