LockPickingLawyer
5 HN recommenders · recommended in 4 months, 2021–2022
10:35 · 14M views · May 31, 2021
The Lock Picking Lawyer tests the supposedly unpickable lock designs built by the Stuff Made Here channel. He looks for bypasses and weaknesses in the novel anti-picking mechanisms.
HN points to it in lock-security threads as a good example of engineering meeting real-world exploitation, where flaws unrelated to the headline mechanism get found.
8 comments from Hacker News
The interaction of engineering and "use" by the Lock Picking Lawyer ( this video ) was fascinating - "use" here really meaning "exploiting". It's a problem many here are aware of, either by over-engineering things intended for use by non-engineers, or designing things to be used by customers when the designer isn't intimately familiar with the use. In this case it was sort of somewhere in between. I'm currently an operator of heavy machinery in a factory making tools for the wafer industry, although my main career is in software development. I'm actively working with the tools and software used to get a better understanding of the disconnect between engineering and operations. It's been a great way to consider how to improve tools in ways that aren't just "better" from a software/engineering standpoint. Also, holy cow. I've watched all of your videos multiple times. You are truly an inspiration. Thank you, and apologies for the fanboying.
On the topic of "novel, non-pin-tumbler mechanisms": I can recommend the videos by Stuff Made Here [1][2], where he designs two novel anti-picking lock mechanisms, and the related video [3] where LockPickingLawyer tries to pick and bypass them. Together they give a whole new understanding of lock design and picking methods. [1] [LINK] [2] [LINK] [3] this video
Since this has generated some discussion on locks and picking, there's been some interesting developments on "unpickable locks" that sidestep the tolerance problem by decoupling setting the pins from testing them. I.e. pins are tested all at once after they are physically decoupled from the key & keyway, eliminating state space reduction attacks (aka picking one pin at a time) leaving only brute force. One such effort features locks made by Stuff Made Here sent to Lock Picking Lawyer. According to LPL the locks are theoretically sound and he did not attempt to pick them, but these particular implementations had a couple (easily fixable) bypasses. Made for interesting videos on both sides: Stuff Made Here describes the design in detail: TWO Unpickable (?) Locks for Lock Picking Lawyer! - [LINK] Lock Picking Lawyer reviews them and performs some bypasses: [1299] Unpickable Locks From Stuff Made Here - this video
For others who might not have seen it, here's what the Lockpicking Lawyer had to say about that. He picked a lock with the same concept by swighton (Stuff Made Here), but exploited a flaw that had nothing to do with the mechanism. this video I think one problem here is that the more complicated you make a locking mechanism, the more you suffer by increasing the attack surface with other potential flaws or just the lock being physically weaker (i.e. smashable). Kinda like how the most advanced cryptography is usually broken because someone made an error in the complexity of implementing it.
This looks very similar to the design[0] by Stuff Made Here (and collaborative hardening [1] suggestions by Lock Picking Lawyer)…an excellent set of videos. [LINK] this video