Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to open a safe

github.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: How to open a safe

#41

Post by Enginerrrd »

more_corn wrote: post #13
tristor wrote: post #5

I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.

Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.

>Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.

I think you misunderstand the threat model and/or use case. Most of the time I don't think anyone expects locks to do anything except keep honest people honest and dissuade the lowest level of opportunistic attacks.

A sledge hammer is cheap. It can open just about any door. The difference between a cheap door and hardware and a high end security door might be ~5 minutes of hammer time. (Nothing can stop hammer time). Nothing will stop someone with time and tools.

But if that threat model were a concern, we'd see a lot more bars on ground-level windows and the like. No one cares. Because 99.99% of the time, it's not going to be a problem.

Now, there are definitely use cases out there where it makes a big difference and people want the security. But MOST of the time, people aren't trying to stop or slow down someone with bolt cutters, a bump key, or shim.

Re: How to open a safe

#42

Post by stavros »

tgsovlerkhgsel wrote: post #32
olivierduval wrote: post #19

Actually the problem here is that it's possible to reinit the PIN when the safe is still closed... so the trick to open the safe is to reinit the PIN then send the new PIN The second problem is the possibility to open the PINpad from the outside with the safe closed. It seem to me that those two problems could easily be fixed by the manufacturer... and I can't understand that they just didn't do it right upfront

The second one is very hard to avoid. The safe could of course have some form of tamper detection/response, but other than that, you can't put the PIN pad in a safe, so a determined attacker will be able to open it (using tools/force if necessary).

You can't put the PIN pad inside, but you can put the screw inside.

Re: How to open a safe

#43

Post by kube-system »

giantg2 wrote: post #35
TedDoesntTalk wrote: post #30

Earlier quoted context omitted.

In large, high-end gun safes like Liberty, it is difficult to find them with mechanical locks anymore. They just don't make them.

Is Liberty really high-end? I would have thought they were mid-grade. I think most places have options for mechanical or electronic. Granted the electronics on those should be considerably better than the ones in the article, at least from a simple access perspective of not pulling the keypad off from the outside.

They’re high end consumer-grade safes. Which in the world of commercial-grade security, is also known as “not a safe”.

So, depending on your perspective, they’re either really good, or entirely unusable.

Re: How to open a safe

#45

Post by johannes1234321 »

giantg2 wrote: post #24
reidjs wrote: post #17

Earlier quoted context omitted.

The more hassle involved with breaking the lock the harder it is to be steal, that makes sense. Don't forget about security by obscurity, though. Let's say a criminal with a bolt cutter finds their way to an unattended gym locker room and they can only have time to snip one or two locks. The majority of the lockers have generic Master Locks, a few have some exotic "ultra-secure" locks on them. Do they randomly snip a…

Wouldn't that be a bad example? That they could still snip the better locks seems like they're not really better. In general, you would want a lock that they would need a special tool that they didn't bring. For example, maybe the thief could have cut(saw) the higher end locks, but they only brought bolt cutters because they're faster and work on 90% of the locks.

Not necessarily. The attack has to be expensive enough (in time, noise, ....) To be discouraging for making the attacker go elsewhere or not attacking at all.

Re: How to open a safe

#46

Post by kube-system »

lbriner wrote: post #2

I would really hope that people who make security tools would have the best-of-breed electronic engineers but clearly not. The crack was pretty rudimentary and would take an experienced electronics test technician about an hour by the looks of it. "No response". Understandable when you don't have any way to easily put it right, although I suppose they could have at least asked OP to keep it a secret until they could…

These are really just fire safes. They’re made to protect important documents from being destroyed in the amount of time it takes a fire truck to put your house fire out. The lock is mostly to keep kids or guests out.

The biggest security vulnerability in these “safes” is not the lock. It’s that a thief can simply pick it up and walk away with it.

Re: How to open a safe

#47

Post by kube-system »

malnourish wrote: post #21

Is there any chance that this vulnerability was created intentionally for e.g. law enforcement access? One could imagine that the manufacturer would provide LEO a similar device and instructions. Not that it would in any way excuse it.

Law enforcement doesn’t need a vulnerability to open a safe. Once they have a warrant they can just call a locksmith to drill it open, etc. Any vulnerability would only by helping the locksmith or the owner of the safe, at that point.

Re: How to open a safe

#48

Post by Animats »

tristor wrote: post #5

I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.

Ah, someone who watches Lock Picking Lawyer videos.
Post reply on HN