Click to view our Accessibility Statement or contact us with accessibility-related questions
Showing 1 of 11 conversations about:
Bobraz
2631
Oct 5, 2019
bookmark_border
I really don’t understand « the world of lockpicking » as a hobby, and I’m a pretty liberal guy with several hobbies under the belt. I guess this is seen as elaborate puzzles? But to be honest, it’s also a way for would-be thieves to train, right?
metis
199
Oct 6, 2019
bookmark_border
Bobrazno, lockpicking is really a lousy way to gain unauthorized entry. bypass is much easier.
think of it as any other sort of mundane study that can improve other aspects of your mind. It's kinda like knitting, sure you can get a cool one of a kind sock, but it'll take you dozens of hours of fine motor skills to do so, when you could probably buy a similar really nice pair for $30.
it's also a great study of security theory and way to gain better understanding of the world around us.
e.g. it's taught me that a kit like this is overpriced for folks who are gullible enough to pay too much to carry a pocket knife they'll never use.
Bobraz
2631
Dec 14, 2019
bookmark_border
metisI can rally behind the knitting comparison for gaining motor skills; I get it that it's really a manual mad skillz challenge, but it won't give you insight in security theory. I know, I work in cyber security, let me tell you, that gives you insight into security theory!
(Edited)
metis
199
Dec 16, 2019
bookmark_border
Bobraz@Bobraz, since you apparently don't practice locksport, it's understandable that you wouldn't understand how it might apply. I'm not too far into network security, so I'm not the best person to assess what higher levels of it might be a good analogue for. I know just enough about it to torment my IT department to help them manage interactions and permissions with the design technology I wrangle, and have been hanging out with infosec and physical security folks while picking locks for a couple of decades.
Locks aren't necessarily quite as simple as they seem, and locksport isn't just simple picking of common locks, just like knitting isn't just pretty colored socks, but can be some amazing cabled sweaters or sculptural Cthulu ball gowns.
Methods of picking master keyed SFIC locks to their control core are a pretty great physical analogy to bypassing multiple levels of interconnected physical or network security. Any one piece of the puzzle won't get you access, and could render the lock inoperable (and the intrusion detected, or just the system broken) but using the right tools and patience it's not too difficult. Using the locks own interconnected security "features" against each other will get you full root access (you can not only access the room, but entirely rebuild the lock so that you always have access, but the user and admin keys will still work as normal), instead of the basic single user permissions that can't change anything. That's well beyond the stuff in this overpriced kit, but not out of the realm of most hobbiests if they're willing to spend another ~$15 on specific tools or some time to make it themselves. Similarly, understanding that a lock itself is rarely the easiest way to gain access is not dissimilar to understanding that port scanning can help you find unsecured entry methods. Brute forcing one password isn't usually the easiest way in (but can be).
In more practical terms, huge parts of red team security practice come out of locksport and locksmithing or have been studied in locksport as security issues to be assessed, expanded on and dealt with. There's a reason that there are a lot of talks on lock picking at DefCon and Black Hat.
RSBDeprecated
7
Mar 27, 2020
bookmark_border
Bobraz@Bobraz Then maybe putting it into your world would help, we should all be using WEP because only criminals would try to crack it, only criminals are into cryptography. Do you have something to hide? Why do you, a civilian need end to end encryption unless you are hiding something, why would you need to peer review the claims made by the people selling encryption software
(Edited)
mdeous
230
Dec 6, 2020
bookmark_border
BobrazIt's actually surprising that you work in cybersecurity but don't see the appeal of lockpicking. A lot (A LOT) of people in the cybersecurity industry are into lockpicking, because it's very similar to compromising your target during a pentest or getting a flag during a CTF, you basically have to understand your target and how it works/behaves to be able to get around the security mechanisms in place and get in. It's really all about having fun undestanding how something really works and getting good at bypassing it. That's why almost every cybersecurity conference has its lockpicking booth, and some of them even organize lockpicking challenges as part of the con (that's how I got into lockpicking ^^), because locksport is very very very similar to cyber security challenges.
Why do security challenges websites exist? Aren't they the best way for cyber criminals to train their skills? That's exactly the same here.
Bobraz
2631
Dec 6, 2020
bookmark_border
mdeousI understand your point and can rally behind the argument. But what about the people not working in cyber? I'm sure they're the bulk of people buying these.
As a result these products look, to the uninitiated, like thief training tools. I'm not saying it is the case, I'm saying the vibes are really weird to anyone looking at this "hobby" from the outside.
mdeous
230
Dec 6, 2020
bookmark_border
BobrazI wasn't implying that most of the people buying these work in cybersecurity, but more that they can appeal to plenty of different people. I'll keep the comparison with infosec challenges, a lot of people like those even though they don't work in cybersecurity or aren't criminals, just because they think it's fun and challenging. I think it's the same with lockpicking.
Bobraz
2631
Dec 6, 2020
bookmark_border
mdeousYes agreed!
But I hope you'll agree with me that to anyone who doesn't know much about this "hobby", it looks totally like something to train less honest people.
If you don't agree with my statement, I'll say you're not being totally intellectually honest with me 😉
RSBDeprecated
7
Dec 7, 2020
bookmark_border
mdeousI find its fun if you treat them like small puzzles. It's a combination of a dexterity test, 3d projection and visualization, and general problem solving. I don't know a lot of criminals that use lockpicks, most of them don't mind the destructive entry path (ie drill out the lock or using bolt cutters to cut through the shackles)
Drop Refurbished
Like-new products you can trustDrop Rewards
Get $5 for every 500 points you earn! Learn more
Drop Keyboard Club
Become a member and expand your keycap collectionCollaborate With Us
For Brands & DesignersFollow Drop