Medeco m3 2013

[Thebouque]

hi

I bought a medeco m3 for residential use a few days ago. The locksmith told me that securitywise it was very similar to an abloy protec, virtually unpickable and unbumpable, but the repairs would be cheaper or easier so I went with the medeco.

However, I keep reading about people who bumped the medeco m3 with keys made out of credit cards, or who pick it using a paper clip to compromise the sidebar. I also read that medeco fixed some of their issues but what has been done remains unclear to me.

I called the locksmith and he told me that my medeco was a new lock from the 2013 line, so I assume that it has the improvements. Did I make a mistake to go with the medeco? Am I actually vulnerable to lock picking and bumping (especially with all those tutorials on youtube)? What improvements were brought to the medeco m3 between 2008 and now?

NB: I already have a door jamb reinforcer and the access to my windows and balcony is extremely hard since I live on the 1st floor (the main lobby is big so I'm at about 15 ft from the ground).

Thanks a lot

[GordonAlexander]

As far as I know no one has picked a Medeco M3 under controlled circumstances. I have seen videos of guys picking them, but they are their own personal cylinders and they don't show the lock in extreme detail before or after their feats(always bad camera quality or forced perspective angles) I'm not diminishing the skills of these men, but I am skeptical as to the authenticity to their claims. I have requested better videos to no avail. Again, that doesn't mean they can't pick these locks, but they don't convince many locksmiths with their shoddy camera work. I have suggested simply having a friend film the picking in an unedited, professional manner. I think medeco offers $50,000 to the person that can prove they can pick their locks. I have no idea why these gentlemen wouldn't accept that challenge, so that is the main factor in my skepticism. I may be wrong but I think the Medeco challenge still stands. Who in their right mind wouldn't accept 50 grand to prove what they claim they do easily?

As far as bumping, I have seen the video of Marc Tobias bumping a M3 cylinder with a card, but I think that card was created from the actual operating key. It was more a cautionary example of key control rather than exhibiting the cylinder's security. I am a locksmith and I use Medeco M3 on my own home, and many members of my family use them. I am very confident in the security of the locks. They are well made and I have never seen someone pick an M3 in person.

Open in 30 seconds is a book and video that claims to be able to open a M3 in seconds. I don't own the book but I have seen the presentation of it at a Defcon conference. The authors seem to be very interested in bad mouthing the practices of Medeco, and they more than once mention the desire to be hired by medeco as 'consultants'. They do say the lock is a great lock, but I question their motives at claiming they can perform the procedure of 'opening in 30 seconds', because they don't actually do it in the presentation.(I watched most of it, perhaps I missed it) They do show an edited version of a video where a gentleman opens a cylinder in his lockshop. But again, they don't show the lock's inner workings before or after the feat.

I use M3 and I am 100% comfortable with it. I also take advantage of a monitored alarm, and several dogs.

[MacGyver101]

As far as I know no one has picked a Medeco M3 under controlled circumstances.

No: you just doubt the circumstances in which people have demonstrated picking a Medeco M3, which is different. (And I've heard many older locksmiths raise the claim that "Medeco will pay $50,000 to anyone who can pick their locks", but I've seen no evidence of that actually being a curren offer?)

The only difference between a M3 and a Classic or Biaxial cylinder, from a picking standpoint, is the slider on the side -- and it can be bypassed in the same way, with the same paperclip on each of the four M3 cylinders I own (and they all came from different sources, with different sliders).

My understanding is that the major recent change was the Medeco changed their codebook, which allows for some greater variance in keying (which makes the bumpkey attack harder for cylinders that actually make use of the new combinations)... but that doesn't effect picking.

Does the "2013" lineup include ARX pins? (I'm not actually sure?)

[Thebouque]

Thanks for your replies. I think ARXs are designed for commercial use mostly.

[MBI]

I have seen videos of guys picking them, but they are their own personal cylinders and they don't show the lock in extreme detail before or after their feats(always bad camera quality or forced perspective angles) I'm not diminishing the skills of these men, but I am skeptical as to the authenticity to their claims.

Your skepticism doesn't change the fact that some people can in fact do it. And there are uncut videos of people on youtube picking medecos, showing them completely tear down the lock afterwards to show it is unaltered. Your request for a better video was only made two days ago on this forum, so to suggest that the lack of a response is proof of their unpickability is just a tad impatient.

I think medeco offers $50,000 to the person that can prove they can pick their locks. I have no idea why these gentlemen wouldn't accept that challenge, so that is the main factor in my skepticism. I may be wrong but I think the Medeco challenge still stands. Who in their right mind wouldn't accept 50 grand to prove what they claim they do easily?

No. They once offered a lower sum, I believe it was ten thousand dollars. Someone did prove they could pick a factory supplied lock, in front of them, and did claim the prize. That was in the 80s as I recall, and after medeco paid it, they never offered the same prize again once it was proven they were pickable.

A member of this forum who goes by jkthecjer personally picked several factory pinned, unaltered medeco cylinders in front of Peter Field, the head of R&D for medeco in 2008 as a part of the public release of Jon's Medecoder tool. Medeco did not offer, nor did he ask for (or receive) any cash prize for being able to pick them.

Before information on the Medecoder was published, the factory was contacted to inform them of the vulnerability in the locks that the tool exploits. The factory met with the inventor, Jon King, and representatives of NDE Magazine and as a part of that, Jon picked several Medeco locks to prove the validity of the tool. The factory requested that they delay publication for six months to allow them time to resume production of ARX pins to close that security hole.

If you want more information on Medeco ARX pins, read NDE Magazine, issue #4. http://www.ndemag.com/
Basically, it is a series of improvements to medeco cylinders that were available to certain government clients starting in the 90s. There is also information on the Medecoder in issues 3 and 4 of NDE magazine. As for the current use of ARX pins, due to the publicized release of the Medecoder, all Medeco locks made since that time include a mix of ARX and non-ARX pins. At least according to the information that was given to me by Peter Field.

Medeco locks are high security. They are leaps and bounds better than getting an average household lock from a home improvement store. But to say they are as secure as an Abloy Protec, is just sales schpeal. The Medecoder does make it more convenient to rotate non-ARX medeco pins and assist picking Medeco cylinders. However, with practice it is possible to rotate the pins and fully pick Medeco cylinders with just a regular hook pick and a tension wrench. The same can't be said about the Abloy Protec.

[smokingman]

As long as it is a new model It is most likely safe from your average thief.
The older ones could be bypassed with an icepick and a cordless drill in a couple of minutes,
but they have rectified that issue .
Picking just takes too much time and skill for a thief to mess with trying ,
and most just don't have that kind of skill anyway.
It will probably take a good while for some new flaw to be found and exploited.

[Thebouque]

Thanks.

Does the m3 have any advantage over an abloy protect? They had both in store and the price difference was 20$. For some reason they said that they were equal and that the m3 was unpickable. Had I known, I would've gone with the protec. I have buyer's remorse big time, those locks are so expensive.

[Squelchtone]

Thanks.

Does the m3 have any advantage over an abloy protect? They had both in store and the price difference was 20$. For some reason they said that they were equal and that the m3 was unpickable. Had I known, I would've gone with the protec. I have buyer's remorse big time, those locks are so expensive.

It's the other way around, Abloy Protec is unpickable.

And to comment on the rest of this thread..

I wish old timey locksmiths would stop misleading the public with 1970's and 1980's rhetoric they bought into when they became Medeco dealers.

Its surprising to see someone here in 2013 with the same doubts that were presented back in 2006.

Squelchtone

[MBI]

Thanks.

Does the m3 have any advantage over an abloy protect? They had both in store and the price difference was 20$. For some reason they said that they were equal and that the m3 was unpickable. Had I known, I would've gone with the protec. I have buyer's remorse big time, those locks are so expensive.

Despite the flaws in the Medeco, don't be too hard on yourself over selecting the medeco over the Abloy. While I have no doubt as to the superiority of the Abloy Protec over Medeco locks from my years spent as a locksmith and participating in and helping run some lockpicking forums, I don't dislike Medeco locks. They are one of the few lock companies that have seemed to be willing to listen to input from lockpickers and have tried to use that input to improve their product. The Medeco locks produced today have been improved over the medeco locks from even as recently as five years ago.

Yes, I listed flaws in Medeco, HOWEVER, in my opinion they aren't "bad" locks. It's just that the reality falls short of the hype. It's still a dozen times better than any household locks you'll find at a hardware store. Yes, they can be picked, but realistically there are VERY few burglars in the world with the skill to pick them.

Look at it from a practical standpoint. Burglaries happen in large part, because someone wants what you have and they don't want to have to work for it. It takes WORK to learn to pick medeco locks, and practice to stay good at it. Even then, it takes time to pick them. A burglar spending even five mintues at your door, is probably going to generate some suspicion. Not to mention, they'll be keyed up on adrenaline and the longer they stay there picking, the more keyed up and jittery they'll get and the harder it'll be for them to pick it. They also have features that help them resist forced entry.

If I were you, I'd stop worrying about the lock you bought. It's a relatively difficult lock for someone to make an unauthorized key for it, compared to a normal household lock, it's not pick-proof but it does resist picking as well as forcible entry. At this point, the lock (regardless of whether you picked Abloy or Medeco) is NOT your weakest link. Spend your time, energy and money looking at things like door jamb armor to help keep it from being kicked in, maybe some security film to help keep a burglar from breaking your windows, and perhaps get an alarm system as GordonAlexander recommended. Security is like a chain, because it's usually the weakest link that gets broken. You've taken care of the lock, now go find the next weakest link in your chain.

[ARF-GEF]

I totally agree with MBI.

I think a key ability for a happy life is to convince yourself that decisions you can not change in retrospective had been the right one.
It sounds smart ass, I know, but the point is you shouldn't really worry about the medeco. We tend to be a bit lock-snob here, only the best is good enough for us. Maybe you have been better with the medeco, maybe you will never be broken into and then you can enjoy a decent lunch for that 20$.
It's not bad, some of us don't like it that much, and admittedly it has it's faults and there are much better locks to be had, but hey it's much better than most locks, it's usually pretty well made so you got yourself a decent lock.
Abloy has it's wekness as well, when it comes to locks there is usually no best solution it will always be a trade-off.
The danger of a bruglar picking the medeco on your door is negligible.
As MBI already said that lock should serve you fine.

[Thebouque]

Thanks a lot, I'm a member of many forums but I have never been greeted so nicely.
I'll try and stop to worry about it as the medeco is a solid lock and might even be overkill for most residential use anyway, even if it's not the best out there. I've already put a metal plate on all my door jambs, my backdoor has a medeco too (the same 1) and since I live in a building all the windows are out of reach.

[ARF-GEF]

I'm glad we made a good impression

[Evan]

A member of this forum who goes by jkthecjer personally picked several factory pinned, unaltered medeco cylinders in front of Peter Field, the head of R&D for medeco in 2008 as a part of the public release of Jon's Medecoder tool. Medeco did not offer, nor did he ask for (or receive) any cash prize for being able to pick them.

Before information on the Medecoder was published, the factory was contacted to inform them of the vulnerability in the locks that the tool exploits. The factory met with the inventor, Jon King, and representatives of NDE Magazine and as a part of that, Jon picked several Medeco locks to prove the validity of the tool. The factory requested that they delay publication for six months to allow them time to resume production of ARX pins to close that security hole.

Which is neither a new idea nor surprising, there were similar tools designed and patented during the 1970's...

~~ Evan

[MBI]

A member of this forum who goes by jkthecjer personally picked several factory pinned, unaltered medeco cylinders in front of Peter Field, the head of R&D for medeco in 2008 as a part of the public release of Jon's Medecoder tool. Medeco did not offer, nor did he ask for (or receive) any cash prize for being able to pick them.

Before information on the Medecoder was published, the factory was contacted to inform them of the vulnerability in the locks that the tool exploits. The factory met with the inventor, Jon King, and representatives of NDE Magazine and as a part of that, Jon picked several Medeco locks to prove the validity of the tool. The factory requested that they delay publication for six months to allow them time to resume production of ARX pins to close that security hole.

Which is neither a new idea nor surprising, there were similar tools designed and patented during the 1970's...

~~ Evan

Yep, try reading the NDE articles I linked above. They go into the history of Medeco flaws, tools designed to exploit them, and the actions Medeco took to combat them. I didn't think it was necessary to repost that entire history when it's laid out in the articles I linked for anyone who wanted to do further reading on the subject.

The tool you describe was made by Lock Technologies, if I remember the name correctly, and they lost a patent suit brought by Medeco so they had to stop production of that tool. Most of the tools were bought back and very few still exist in private hands. They'd be quite a collectors item in these circles if one turned up.

When there were no longer any currently manufactured tools to exploit that groove in the pin, Medeco eventually discontinued making the closed-groove pins that had been put into place to thwart that tool made in the 70s. It was cheaper to broach the groove (full length) instead of milling it (partial length). When a new (Falle) tool was introduced in the law enforcement/espionage arena in the 90s, they reintroduced the milled pins with a closed end on the groove, under the name ARX, for govt agencies who needed the extra protection. Since the tool was not publicly available, they didn't change the locks sold in the public and commercial sectors. When Jon was going to make his tool public, a tool that is so simple almost anyone could make one, they literally dusted off the old machines and reconditioned them to put the closed-groove pins back into production. Thats why they asked for a six month delay before the article was published, to give them enough time to get the machines running again and put new pins into all new locks being made.

At first, they still had a large stockpile of previously manufactured pins with full length grooves that could be exploited by the now defunct Lock Technologies tool from the 70s, the Falle tool from the 90s, and Jon's tool from 2008. So the locks sent out had a mixture of the previously made pins with open grooved, and the newer ARX-style pins. Once they ran out of the open groove pins, I don't know if they continued to use a mix of pins, or if they're all ARX now. I haven't checked any newly manufactured Medeco locks in a year or so.

I had thought this story was too long and boring to write it out here before, but here is the gist of it anyway since you seemed to want a more complete accounting of things.

[zeke79]

Wasn't one of the reasons they quit using arx pins due to the fact that the lock technologies tool being unable to work with biaxial? I might be wrong but that sticks out in my mind for some reason.