Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to open a safe

github.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: How to open a safe

#51

Post by mnd999 »

Enginerrrd wrote: post #41
more_corn wrote: post #13

Earlier quoted context omitted.

Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.

>Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are. I think you misunderstand the threat model and/or use case. Most of the time I don't think anyone expects locks to do anything except keep honest people honest and dissuade the lowest level of opportunistic attacks. A sledge hammer is cheap. It can open just about any door. The difference between a cheap door and…

A sledge hammer is not subtle. Someone breaking a door with a sledgehammer is very obviously breaking a door. It’s also very obvious in the aftermath that the door has been opened.

Re: How to open a safe

#52

Post by IshKebab »

jaywalk wrote: post #39
danielh wrote: post #12

Earlier quoted context omitted.

The vulnerability is not in the front panel. It‘s the panel on the inside that accepts a code reset command without valid authentication.

It's a vulnerability in the inside panel that was covered up by requiring the front panel to do more than it should. If the front panel were just a dumb I/O device, the inside panel could not have this specific vulnerability.

No that's still wrong. The inside panel is the only thing doing any validation. The front panel more or less is dumb IO.

The vulnerability really is in the inside panel and changing the outside panel to just be a keypad wouldn't have prevented the mistake.

Re: How to open a safe

#53

Post by ramses0 »

Enginerrrd wrote: post #41
more_corn wrote: post #13

Earlier quoted context omitted.

Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.

>Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are. I think you misunderstand the threat model and/or use case. Most of the time I don't think anyone expects locks to do anything except keep honest people honest and dissuade the lowest level of opportunistic attacks. A sledge hammer is cheap. It can open just about any door. The difference between a cheap door and…

A lock is a delaying device.

A lock is (should be) tamper-evident.

All locks can (probably) be bypassed (eg: sledgehammer), but it’s best if it is visible that tampering has occurred.

Re: How to open a safe

#55

Post by someweirdperson »

azalemeth wrote: post #10
lbriner wrote: post #2

I would really hope that people who make security tools would have the best-of-breed electronic engineers but clearly not. The crack was pretty rudimentary and would take an experienced electronics test technician about an hour by the looks of it. "No response". Understandable when you don't have any way to easily put it right, although I suppose they could have at least asked OP to keep it a secret until they could…

I mean, to be fair this is the sort of safe you find in a hotel room where it's expected that the staff have access to it. It's decidedly _not_ a high-threat environment secure item.

As a kid on family vacation we had a hotel room with a safe. Turned out to be usable as a toy for my brother and me. One of us setting a code, the other trying to guess it. Until the one of us setting it failed to remeber it.

Turned out the hotel had no problem opening it at all.

Re: How to open a safe

#56

Post by giantg2 »

johannes1234321 wrote: post #45
giantg2 wrote: post #24

Earlier quoted context omitted.

Wouldn't that be a bad example? That they could still snip the better locks seems like they're not really better. In general, you would want a lock that they would need a special tool that they didn't bring. For example, maybe the thief could have cut(saw) the higher end locks, but they only brought bolt cutters because they're faster and work on 90% of the locks.

Not necessarily. The attack has to be expensive enough (in time, noise, ....) To be discouraging for making the attacker go elsewhere or not attacking at all.

My point was that the example give involved "better" locks that were just as vulnerable as the cheaper ones.

Re: How to open a safe

#57

Post by giantg2 »

kube-system wrote: post #43
giantg2 wrote: post #35

Earlier quoted context omitted.

Is Liberty really high-end? I would have thought they were mid-grade. I think most places have options for mechanical or electronic. Granted the electronics on those should be considerably better than the ones in the article, at least from a simple access perspective of not pulling the keypad off from the outside.

They’re high end consumer-grade safes. Which in the world of commercial-grade security, is also known as “not a safe”. So, depending on your perspective, they’re either really good, or entirely unusable.

I would have thought things like ISM would be top quality consumer grade.

Re: How to open a safe

#58

Post by Ansil849 »

kube-system wrote: post #46
lbriner wrote: post #2

I would really hope that people who make security tools would have the best-of-breed electronic engineers but clearly not. The crack was pretty rudimentary and would take an experienced electronics test technician about an hour by the looks of it. "No response". Understandable when you don't have any way to easily put it right, although I suppose they could have at least asked OP to keep it a secret until they could…

These are really just fire safes. They’re made to protect important documents from being destroyed in the amount of time it takes a fire truck to put your house fire out. The lock is mostly to keep kids or guests out. The biggest security vulnerability in these “safes” is not the lock. It’s that a thief can simply pick it up and walk away with it.

All this. I feel like people are not understanding that this is not meant to be a secure safe or even a deterrent. It is a home safe designed to keep valuables minimally safe from an average fire, with a side benefit of also preventing a toddler from swallowing your pearls. That's it.

Re: How to open a safe

#59

Post by aerostable_slug »

vorpalhex wrote: post #37
giantg2 wrote: post #25

To be honest, I would go with a manual dial/lock/safe/etc. I don't trust most mass produced electronic physical security stuff (consumer grade or affordable stuff anyways). The non-electronic stuff is still vulnerable, but it's not this fast to attack.

+ Means + Motive + Opportunity You want your thing to be very safe? Forget the safe, throw it in the ocean encased in a cement block. Very secure, will not be retrieved. Note - I said ocean, not a lake. Biometric and pin pad locks are quick. Less secure sure but quick. If an attacker has the triangle of means (tools, knowledge), motive and opportunity (physical access) then any lock can be defeated if only because yo…

> will not be retrieved

My friend Victor would disagree. Of course, finding the block would be much harder than going down in DSV Limiting Factor to get it.

Re: How to open a safe

#60

Post by aerostable_slug »

giantg2 wrote: post #57
kube-system wrote: post #43

Earlier quoted context omitted.

They’re high end consumer-grade safes. Which in the world of commercial-grade security, is also known as “not a safe”. So, depending on your perspective, they’re either really good, or entirely unusable.

I would have thought things like ISM would be top quality consumer grade.

They are, but they are far more expensive than mainstream consumer gun "safes" and very heavy.

A buddy of mine's dad dealt in wholesale jewelry and my friend inherited one of his dad's safes (I don't recall the brand offhand). It's over 5,000 pounds, has a tempered glass relocking plate in the door to defeat drills, etc. It is far beyond what almost any gun owner would go for. If something were to somehow fire the relockers, it would be an expensive proposition to get into the safe afterwards.

Post reply on HN