Duplicate Resistant Locks

[jaconm]

I own a small 30ish room hotel. We currently have Schlauge locks on all doors but they're the figure 8 shaped cores which can be popped out.

We have had a serious problem lately of people making illegal duplicates of room keys and coming back and robbing people who stay in the rooms after them. We apprehended someone with copied keys a few months ago.

I am looking for a key system which can easily replace these Schlauge keys and is resistant to copying. Our local locksmith suggested Medeco replacement cores. He said they are less secure than some options but are cheaper.

Is it true that someone would have trouble getting copies of Medeco keys? How hard is it to bump or pick Medeco locks?

Thanks!

[somenewguy]

Welcome to the forum.

This question has a lot of answers, but without getting too deeply mired in the technical details, my opinion is:

-The standard Schlage keyway is probably one of the most encountered key blanks (along with Kwikset). It sounds like you may have some kind of interchangeable core system, but if these are the SC-1 keyway, that key can be copied anywhere

- If these are standard residential Schlage locks, just changing to another brand might help somewhat, only because these are SO common. There are unmanned, automated key cutting machines (they look like oversized vending machines or kiosks) out there that will cut Schlage keys all day long. There is even a service that will cut keys from a picture and mail them to you. Moving away from a standard pin-tumbler system alltogether will probably cut your problem down even more; the thieves might be apprehensive to find a locksmith and go there in person, plus the thieves may not understand or recognize what the new key system is. Many hardware stores without a real locksmith on hand can only copy common pin tumbler keys.

-What you want is not necessarily a high-security lock (though that would be nice), what you really need is called 'key control'. Key control is the attribute of a key and lock system that gauges how difficult it is to duplicate keys (strictly speaking, key control alone does not address how hard it is to pick/bump the lock or how 'strong' or resistant the lock is to drilling/cutting etc but you will typically find all of these go hand-in-hand with higher quality offerings). One way this can be effected is to have special keyways (if you take the tip of a key and point it at yourself and look at the edges of the key, you'll notice the wavy shape that is used to fit around complimentary-shaped metal protrusions in the lock's keyway called 'wards'. The size and shape of these wards and the complemetary cuts in the sides of the key defines the 'keyway') that are restricted. The level of restriction can vary:

-The keyway may be controlled by the lock/key manufacturer; duplicate keys can not be obtained without writing to the manufacturer and sending proof of ownership
-The keyway may be restricted; only authorized locksmiths have access to them
-The keyway may be one that only one certain locksmith owns blanks for. You must go back to this locksmith to get replacement keys if any are lost or damaged. This can be a problem since that locksmith then has no competition, and if s/he goes out of business, you may have a problem maintaining the system; but on the other hand creating a relationship with a local locksmith has its advantages, too.
- The keyway may be regionally assigned
- There may be patent protection on the keyway such that the manufacturer can sue anyone who tries to make generic blanks available (at least until the patent runs out), helping to ensure that nobody could get copies of the keys in your system.
-etc

-You asked about bump and pick resistance, but it sounds like your real problem is key control. However, there are lock systems that offer both key control and some level of bump and pick resistance. Medeco is one of them. I am not sure which Schlage product you currently have, but I recently stayed in a bed & breakfast that used SC-1 keys with standard residential grade locks. I didn't attempt to mess with them, but these locks are probably one of the easiest to bump, and the one for which even the most simple of beginner bump key sets is going to include.

-Some Medeco offerings can provide good key control, where you must present a special card and ID in order to get keys duplicated. This will stop your customers from just going out to Home Depot and getting copies made. Yes, it's technically possible for a very skilled person to still make their own copies of the key, but in your case, I would expect a 100% reduction in key coping if you went to a restricted Medeco keyway. As an added bonus, it is exceedingly difficult to bump or pick Medeco locks. There are relatively few people in the world who can pick open a Medeco lock; I can all but guarantee the low-level thieves
you are dealing with can not.

-There are also electronic systems as I am sure you are aware, the keys become useless after the predetermined checkout time...

[GrzyWhop33]

-There are also electronic systems as I am sure you are aware, the keys become useless after the predetermined checkout time...

I read somewhere in this vast forum about electronic locks on hotels. Has the vulnerability in bypassing them been corrected?

[somenewguy]

There was a widely publicized vulnerability on Onity systems that allowed an attacker to plug in a device to a port on the bottom of the lock and open the lock. The manufacturer has made some changes, but there are arguments over who has to pay for them. There have been other vulnerabilities in other electronic locking systems such as mag stripe, key pad, and RFID, but compared to copying a Schlage key at the hardware store, I think any of the currently available electronic systems would help this business owner.

Update on the Onity saga: http://www.forbes.com/sites/andygreenberg/2013/05/15/hotel-lock-hack-still-being-used-in-burglaries-months-after-lock-firms-fix/

[jaconm]

The doors all have Best style cores, but are set up with Schlage keys currently.

The self service kiosks are interesting to mention. We have key chains permanently attached to the key with the name and picture of the hotel on it (obviously without the room number.) 20 Years ago I took these into a few stores and tried getting copies and they were all unwilling to copy them with the hotel logos all over it. If they can do it themselves then this means nothing now.

Picking doesn't concern me because it takes some skill, however lock bumping does concern me slightly because they make it look so easy on YouTube.

My locksmith wants me to go with the Abloy Protec2 system. I am only interested because we market ourselves as a very high end modern hotel. I actually think handing a guest one of those curious looking keys would fit well with the experience we're trying to provide. Have you ever heard of ProTec2? How does it compare?

[somenewguy]

Sorry for double post; can't edit above post:


Ah ha, so if you already have Best type (SFIC; Small Format Interchangeable Core) locks, then you can very easily just swap out cores (assuming the locksets on the door are of high enough quality that they are not also a security concern). There are SFIC cores available with many different keyways.

On marked keys: It is an age-old issue with locksmiths as to what to do with 'do not duplicate' keys. Some locksmiths will duplicate keys with a 'do not duplicate' stamp and others won't. At hardware stores, there is even less scrutiny, and both locksmiths and hardware store employees are subject to 'social enginering' (having a good story that explains why you want to copy a key marked 'do not duplicate'). Some customers may even stick some tape over that mark or add a colored plastic key bow cover to hide it. As long as the key can fit in the key duplicator, these methods often work. With your keys, perhaps a standalone kiosk was used (the one I used did not require the key to be put into the machine all the way; so a key-chain could be left hanging out during the duplication process), or perhaps the criminals just put a piece of masking tape over your tag and handwrote in marker on it: "back door / grandma's house". There is also the small possibility that you are dealing with someone who owns their own key machine, but I don't think that's likely.

The Abloy Protec 2 is probably the best locking system you are going to find in terms of pick resistance; there are no verified picking attacks on this lock. There is no known bump-type attack for the Protec 2; it operates almost like a combination lock on a safe so, strictly speaking, pin-tumbler style bumping attacks can't work. The key can only be duplicated by an Abloy dealer, and there are custom key profiles you can get which are registered to a single dealer only. The costs and training involved with becoming an Abloy dealer make it unlikely that a locksmith is going to 'go rogue' and start copying your keys for criminals. More likely, you'll develop a close working relationship with your locksmith of choice, which will last a long time beyond the initial stage where you plan out the system and discuss the options. Such a locksmith will probably call you immediately if anyone comes in to their shop asking to duplicate your key. Unlike standard pin-tumbler systems, there is no 'keyway' per say in the Abloy disc-detainer system, but one or more disks in the pack are special 'profile' disks which are put there to match the key's shape.
These locks can be 'mastered' if you are interested in having one or more keys with a higher level of access.

Protec 2 also has an 'interactive' element; a ball bearing captured in the key that interacts with a mechanism in the lock. Without the ball bearing, the lock won't open, even if the key 'bitting' (the cuts on the key) are correct. This makes it impossible to take a 'casting' of the key and have it work in the lock.

Disc detainer type locks are not that popular in the US and so the keys will look modern and interesting to most consumers (in my opinion, at least). If the costs are acceptable, think Protec 2 would be an excellent choice for your application.

Protec 2 will solve your problem of easily picked/bumped locks and easily duplicatable keys. Your only remaining problem is lost keys (legitimately lost or otherwise). What's to prevent a customer from claiming they lost the key (assuming they don't mind paying the lost key fee)? Also, what if you somehow lose your door keys (assuming you don't keep copies in a vault somewhere - and even if you do, what do you do about the original key you lost? Even if the room number is not on it, someone who found it could just try every door). If the only keys that can get in the room are lost, the locks can't be picked open, even by a locksmith, so you are going to have to pay someone to drill out and replace the lock... The only solution to these kinds of problems is an electronic system...

[GWiens2001]

If you are dealing with an interchangeable core (IC) system, especially if it is Schlage, make sure whether it is SFIC (same format as BEST) or LFIC, which is more common for Schlage. Yes, Schlage makes both LFIC and SFIC. One will not fit in the other, so be sure before you order a bunch of lock cores.

The ABLOY Protec 2 is a great lock, and certainly looks modern. Very well made and for all intents and purposes, it is unpickable. Be sure you keep a copy somewhere safe. If you order from a place like Security Snobs, you can give them the lock key code and they can send you a replacement quickly. Be certain to keep the security key duplication card for each lock. Without it, you are hosed.

Gordon

[Squelchtone]

If he already has Schlage housings, might as well upgrade to Schlage Primus

[jeffmoss26]

Pictures of the lock would help. Schlage Everest SFIC are all restricted but they also make them in the open Best keyways.
Schlage LFIC are available in Classic, Everest, Primus, etc

[somenewguy]

Yes but if the OP is starting to get bitten by the lock bug, or wants to have a cool-looking key, Primus isn't going to do it for him. Nobody will notice the side cut bitting and the rest of it looks like a regular key. The bow even looks like an SC-1! Also, there may be some bumping attacks on Primus as reported by Deviant Ollam and Toool.

[GWiens2001]

Yes but if the OP is starting to get bitten by the lock bug, or wants to have a cool-looking key, Primus isn't going to do it for him. Nobody will notice the side cut bitting and the rest of it looks like a regular key. The bow even looks like an SC-1! Also, there may be some bumping attacks on Primus as reported by Deviant Ollam and Toool.

The ABLOY Protec can be bumped. Granted, bumping it requires repeated bumps with a 20 pound sledgehammer and does not require a bump key.

Gordon

[jaconm]

They are Best style SFIC cores as confirmed by the locksmith I am working with.

How greatly would the security suffer by having the place "maison keyed" using the Abloy Protec2 system? The locksmith mentioned that a risk of maison keying is that you reduce the combinations in your system by what opens the security doors. He also noted that the more advanced systems have a greater number of combinations and are affected less.

If people loose keys it's always been clear that they have to pay for replacement. We don't have much loss though. When we have had cases of lost keys we have replaced the cores ourselves with spare ones we keep on hand.

We'll have three key levels. A master that opens everything only to be checked out during shift by the cleaning staff, a staff master which will be issued to the full time staff needing global access to everything except the guest rooms, finally the individual room keys which will open the rooms and the security doors in front and back of the building. Each will come with a key loss policy.

[jeffmoss26]

Where are they getting these keys copied? Most hardware stores only stock the A keyway of Best blanks, unless they are going to a locksmith.

[cledry]

Personally I think the Abloy is overkill and expensive for cores and the inevitable lost keys. I would use one of the restricted Falcon keyways. The AML1 or AML2 etc will make it very difficult for anyone to make an unauthorized copy, they would need to mill a blank. The keys and cores aren't expensive. Can't bump what you don't have a blank for.

Yes they can be picked but they aren't easy because of the tolerances and keyway. Yes they can be drilled but so can other locks.

I believe in selling the customer what they need or want but nothing more.

[somenewguy]

Where are they getting these keys copied? Most hardware stores only stock the A keyway of Best blanks, unless they are going to a locksmith.

It sounded like they're using a Best IC system but the cores are Schlage.