Why don't locksmiths design locks?

[bluestar]

Whether locks are designed by engineers, locksmiths or hobbyists, accountants will still have the final say about what gets produced and how it will be produced... Potentially great features will be left on the drafting room floor simply because they cost too much to implement.

So really they are compromising our security for finacial reasons?

If the above were true, then they could produce a lock that is absolutely invincible if they really wanted to?

No, if man put it together then someone can defeat it. I mean.... we are cloning sheep these days.

I'm pretty sure in this day and age of 'cloning sheep' (cloning an animal that looks identical to the next anyway is a bit pointless really) that we can come up with a lock that is not defeatable unless the correct key is used.

Well, keep in mind that we see locks from the perspective of a lockpicker. But a company manufacturing locks has to be profitable. At best, the company seek long-time growth by binding customers through quality and high-tech locks, in the worst case, it's just maximizing its earnings. Anyway, there are many good locks that are nearly impossible to pick, and I suppose the market share for "better than nearly impossible to pick" locks is too small for many companies.

[bluestar]

Oops, I hit "submit" when wanting a preview.

What I wanted to add, developing a high-security lock is a bigger risk than developing some standard low-price lock. While the latter are sold in big numbers, the market for high security locks is way smaller (which is not suprising considering a cost factor of 10-30 comparing stanrad GMK systems and high security GMK systems).

Additionally, many locks and locking systems are bought by corporate purchasers who look for a cheap locking system and who are not very familiar with security an risk management. So the market demands cheap locking systems, the industry delivers. On the private market it is similar - most people just want to buy "a lock" or "a door lock" without having extended knowledge about the different systems on the market and the different security levels offered.

[Grey_Wolfe]

Whether locks are designed by engineers, locksmiths or hobbyists, accountants will still have the final say about what gets produced and how it will be produced... Potentially great features will be left on the drafting room floor simply because they cost too much to implement.

So really they are compromising our security for finacial reasons?

If the above were true, then they could produce a lock that is absolutely invincible if they really wanted to?

No, if man put it together then someone can defeat it. I mean.... we are cloning sheep these days.

Wait? Man made sheep? When did this happen? I remember the clones, but I was pretty sure someone else put sheep together, as it were. lol, jk

Using hackers to make something hack proof is just common sense. But unfortunately, not many companies want the help of the people that outsmarted them. Then again, maybe their all out there reading these forums and actually using the info.

I doubt it. lol

[bluestar]

Using hackers to make something hack proof is just common sense.

Maybe common sense, but maybe not the smartest move: "The Six Dumbest Ideas in Computer Security", idea #4.

But unfortunately, not many companies want the help of the people that outsmarted them. Then again, maybe their all out there reading these forums and actually using the info.

To cite a line from Supertramp "Some they do and some they don't and some you just can't tell"... Personally, I doubt that there are many lock-making companies reading forums like this one, cause it is a lot to read (=lots of time) vs little information on your particular lock. There is even less if you're just interested in selling locks (not making goot locks, just selling whatever crap people will buy) - then the information is only a problem if it's in the newspaper or on TV.

[ObiWonShinobi]

Know of any lock companies that will take one of their locks and
custom build you one to YOUR OWN SPECs??

[Raccoon]

Yes. They all will. But only if you order a minimum of 10,000 (or 100,000 or some other power of 10) pieces.

[mh]

Know of any lock companies that will take one of their locks and
custom build you one to YOUR OWN SPECs??

Try http://www.emachineshop.com/

mh

[Topher]

All i Know is that lock company are very very very hesitant to give away there technical specifications. I am a mechanical engineering student, one subject I am doing is about creating a 3D model (using Autodesk Inventor for those interested)

The subject has to do with actually making the model, rather then the design so we were encouraged to use an existing design and just make it 3D. So I thought hey a lock would be awesome! tried to find information but no lock smith/lock manufacturing company i spoke to would help me out and give me dimensions, Tolerances, surface finishes, materials of each of the separate parts involved (yes i know that pins are different, but just the basic stuff, so i can adjust)

So because of that I have just decided to make my own lock, just using rough information I can measure my self.

While i was looking around, I found that several of the places who manufacture locks, get there designs outsourced to various engineering firms, just like a building company would do as a form to save money. Which in my opinion is pretty odd, yes it saves money but you think the experience you have in house would be far more valuable, with collaboration from locksmiths, engineering and other people who would be involved in the design aspects of a new product.

[Minion]

Using hackers to make something hack proof is just common sense.

Maybe common sense, but maybe not the smartest move: "The Six Dumbest Ideas in Computer Security", idea #4.

I have to disagree with his #4 entirely. A wise man learns from his mistakes. A wiser man learns from other people's mistakes.

Researching security involves creativity; sometimes creativity is inspired and guided by the follies of past security measures.

In other words, if you know what not to do, you're more likely to do what should be done.

[Servalite6354]

Using hackers to make something hack proof is just common sense.

Maybe common sense, but maybe not the smartest move: "The Six Dumbest Ideas in Computer Security", idea #4.

I have to disagree with his #4 entirely. A wise man learns from his mistakes. A wiser man learns from other people's mistakes.

Researching security involves creativity; sometimes creativity is inspired and guided by the follies of past security measures.

In other words, if you know what not to do, you're more likely to do what should be done.

I agree. With you that is, not the writer of that article. His last point in #4 is the hope that hacking loses its coolness in the next ten years. I don't see that ever happening. As long as something is able to be hacked, there will be people who do so, for personal gain, with malicious intent, or for just plain entertainment.

[TOWCH]

Snowboy:

Lock manufacturers make their products catering to the needs of their target audience. The low security locks primary selling feature is low price, and the cost to security ratio goes up from there. There are very expensive locks made for the "not even 1000 ninjas" market.

Every person is responsible for their own security, and true security can't be bought for $19.99 at home depot. Nobody would bother making such a secure lock at such a cheap price because it wouldn't be able to compete.

For the audience of the $19.99 home improvement special it would be like putting a "Type R" sticker on a Hyundai. They're living in a house of swiss cheese with locks being the lease of their problems.

Locks can address specific threats, and it may even be possible to create an "unbeatable lock." There are many safe locks that seemingly have no ready means of being picked, decoded, or manipulated. For these locks, things like dial security and drill resistance suddenly become the weakest link in the chain.

The quest for an "unbeatable lock" is one of my favorite parts about locksmithing. Trying to make a lock more impressioning resistant(ect...) is just more fun than the wet blanket reality of the more pressing need for bypass resistant latches.

[TOWCH]

All i Know is that lock company are very very very hesitant to give away there technical specifications. I am a mechanical engineering student, one subject I am doing is about creating a 3D model (using Autodesk Inventor for those interested)

The subject has to do with actually making the model, rather then the design so we were encouraged to use an existing design and just make it 3D. So I thought hey a lock would be awesome! tried to find information but no lock smith/lock manufacturing company i spoke to would help me out and give me dimensions, Tolerances, surface finishes, materials of each of the separate parts involved (yes i know that pins are different, but just the basic stuff, so i can adjust)

So because of that I have just decided to make my own lock, just using rough information I can measure my self.

While i was looking around, I found that several of the places who manufacture locks, get there designs outsourced to various engineering firms, just like a building company would do as a form to save money. Which in my opinion is pretty odd, yes it saves money but you think the experience you have in house would be far more valuable, with collaboration from locksmiths, engineering and other people who would be involved in the design aspects of a new product.

Some code cutting machines use card stock inserts with the key tolerances printed on them.

I say: Just make it up.

EX:Make the out of line tolerance on the pin stack holes +or- .0005; the hole/pin diameter tolerance +or- .0005(making sure that there's a .0015 difference between the two); the pin lengths +or- .005, the plug/bible hole +or- .0005 (ditto).

You don't have to make a prototype so no worries. Don't go beyond .000X or the teacher may use you as an example of why machinists will at QC specs writers.

Grab a micrometer and 2 disassembled same brand locks and see for yourself.

Your teacher probably won't bust you for industry technical accuracy.

[bluestar]

I have to disagree with his #4 entirely. A wise man learns from his mistakes. A wiser man learns from other people's mistakes.

Researching security involves creativity; sometimes creativity is inspired and guided by the follies of past security measures.

In other words, if you know what not to do, you're more likely to do what should be done.

Well, I'd like to disagree If you know what not to do, you're far away from knowing what should be done.

Take, for example, securing a house. You hire a burglar, whose standard method is smashing windows. So you install bullet-proof windows. As this ist the "state-of-the-art"-attack, 99 other hackers tell you that it's secure. Then you meet the guy who breaks open doors. So you secure your door... etc. This may go on and on for years, and still your front-door lock may be vulnerable to bumping.

Bumping brings me to an even better example - take locks. Some locks were designed really well and were immune to bumping long before the method made the news. Those who just react to threats are just rolling out locks that are claimed to be bump-proof. The old locks, however, are still vulnerable.

It could be a nice "add-on" to have a hacker (or, in the case of designing locks, a lockpicker) give his thoughts from a different point of view, but if you desing security locks this way, because you will always be one step behind the attacks (the step you need to implement countermeasures). Additionally, you can patch software (which almost everyone does at least a few couple of times a year), but it will be very expensive to buy a new high security lock a few couple of times a year.

Of course the designers should know about the methods of the criminals - but to design locks this way will almost certainly not lead to a secure product.

Designing locks needs different skills than circumventing locks.

Greetings
bluestar

[gotta]

I have a locksmith aquaintence that has worked for several leading lock manufacturers. Master and Medeco just to name a few. He does this on a consulting basis. His approach is a mixture of stopping the bad guys, having the product be practical and marketable, and thinking of new products. He does a lot of product testing as well. He's the first one to admit that a lot of his ideas are really lame. He has however, made a permanant mark in the industry.

[Lauren]

I find great satisfaction on discovering new ways to defeat locks that enter the market place. I have to agree that marketing ultimately determines what gets made. For example, I designed some probes that defeat Kwikset's "Smart Key" locks. SO WHAT!! Black and Decker made the lock so cheap, that no locksmith would even care to mess with it. It's often cheaper to drill the cylinder out and sell the customer a new lock, then to try and preserve it. Now, I'm sure marketing had something to do with that. Often the art of locksmithing has come down to the time, skill and the old mighting dollar. Should I drill or should I pick or decode? It's all about MARKETING!!!