Skip to content(if available)orjump to list(if available)

10M people watched a YouTuber shim a lock; the lock company sued him – bad idea

jwr

If you don't know him already, I highly recommend videos by LockPickingLawyer — he routinely destroys bogus claims of various companies within seconds. It's quite entertaining to see how little security you actually get from most locks.

I wonder if anybody tried suing him…

ErroneousBosh

> he routinely destroys bogus claims of various companies within seconds

I watched his video on high-security shipping container locks. Jeez, two minutes long? They must be tough!

No, it was two minutes long because he bypassed ten of them, one after the other.

OkayPhysicist

LPL owns Covert Instruments, who employs McNally, the YouTuber who got sued in this case. Probably not a coincidence that Covert Instruments wasn't named in the lawsuit.

jonhohle

I wonder if McNally knows a lawyer familiar with lock picking ;-)

slenk

Oh sweet never knew there was a connection between LPL and McNally - I just notice they always cut their shims from cans the same way

SAI_Peregrinus

There aren't that many ways to cut a shim from a can that work and don't take excessive effort. It's a rounded hook shape, with a handle piece trimmed so you don't cut yourself.

jihadjihad

LPL is a crown jewel of YouTube. His April Fools' Day videos are hilarious, too, like the one where he gets into his wife's beaver [0] (SFW).

0: https://www.youtube.com/watch?v=TRozAbaKs9M

jasoncartwright

LPL is superb. He inspired me to get a lock pick kit and a few simple padlocks - a cheap and fun hobby during COVID lockdowns.

sillysaurusx

Ditto. I was even able to put my lock picking skills to use one fine summer day when the dog park was locked due to "rain from yesterday" even though the grass and everything was clearly fine. We had a lovely time running around as a family, along with a couple other families, for about an hour before the groundskeeper came and shooed us away.

sambeau

Thritto.

RHSeeger

When we moved last time, our "financials" filing cabinet accidentally got locked (one of the ones with button lock) and I wound up having to pick it. The ability, even at a basic level, comes in handy more often then you would expect.

diego898

Thinking of doing the same! Which kit did you order? I see a FNG, FNG+ Bundle, and "Learn lockpicking bundle". 3rd one seems the most likely candidate. Any tips you can share? Thanks!

jamie_ca

I got the Learn Lockpicking bundle a few years back, it's a solid customizable lock - six slots, a few different pin styles, and the springs to make it work. I got practiced enough to get a 3-pin opened, but I'm definitely out of practice now.

embedding-shape

I did the same (also during COVID, after doing it for a bit in my youth). I haven't tried Covert Instruments gear, I bought some other pack from China, but whatever pack you can find with the basics (and maybe some variety so you can try different techniques) plus a training padlock so you can see what's going on inside, and it'll be a walk in the park.

Y_Y

Start with a cheap kit from e.g. Amazon which includes a couple of perspex locks so you can see what you're doing. Get a real set of picks for real money once you graduate from that.

yoz-y

I’ve got a German practice lock and boy was that a hard wake up call. That thing was so hard to pick that I gave up. (The keyhole is really slim)

My bad though, LPL did warn about this.

hdgvhicv

If a lock takes more than 20 seconds to break it’s basically Fort Knox

tshaddox

No one would be surprised if you showed that you could cut a hole in pretty much any normal door given the right cutting tool. Yet people seem to act surprised and betrayed to learn that a normal lock can be picked or broken given the right tool.

kstrauser

And that's fair and reasonable. Of course you can cut a hole in a door. Everyone capable of forming thoughts on the subject has seen someone use a saw at some point in their life. However, locks greatly exaggerate their abilities, to the point you can forgive someone for believing that they actually mean them.

I just now went to masterlock.com, clicked HOME & PERSONAL > View All Products, and picked the very first product[0]. It says:

> The 4-pin cylinder prevents picking and the dual locking levers provide resistance against prying and hammering.

The very first thing it says is that it prevents picking. To someone who isn't familiar with LPL, and who doesn't want to have someone pick their lock, this seems like a great product. It prevents picking! And it must, because otherwise it would be illegal to say that, right? But alas, it does not, in fact, prevent picking.

Compare that to a random product page for a household front door[1] that says "Steel security plate in the frame helps to resist forced entry" and "Reinforced lock area provides strength and security for door hardware", which indicates that this might be a strong door, but doesn't claim that it "prevents someone kicking it in". It helps to resist forced entry, but doesn't say that it prevents it.

[0]https://www.masterlock.com/products/product/130D

[1]https://www.homedepot.com/p/Masonite-36-in-x-80-in-Premium-6...

mananaysiempre

> No one would be surprised if you showed that you could cut a hole in pretty much any normal door

The definition of “normal” varies by region. In European cities, it means a pretty heavy door of multiple layers of steel (and pretty unpleasant stuff in the middle) that would probably take 15 minutes of deafeningly loud cutting with a circular saw. I understand the standard for US suburbs is much lower (as it might as well be, given windows exist and the walls aren’t all that sturdy either).

MattSayar

It's like we forget rocks can easily go through windows.

henry2023

In this case, the right tool is an empty can and scissors

azinman2

Are there any that are truly secure?

Tuna-Fish

Nothing is secure against an oxyacetylene torch.

But if that's not the threat you are trying to protect against, there are locks that are sufficiently secure that picking or other "low-impact" defeat attempts are considered pretty much pointless. Abloy protec2 comes to mind.

showerst

Not in the sense of "can't be opened without the key".

Good locks buy you two things: Deterrence (maybe), and a set minimum of time and noise requirements to bypass them. If your lock reputably takes 3 minutes to pick or a Ramset gun to blast them open, make sure your guard comes by every two minutes, and otherwise stays in earshot.

dragontamer

Secure against what? You might be surprised at what a wench and a truck can pull / destroy. If that fails, there are shotguns and also explosives, jackhammers and the like.

There are always assumptions built into lock design. A simple lock is very secure if a fence is jumpable, most people will jump the fence rather than mess with a lock.

Even a complex lock will never be secure for national secrets (like nuclear missiles), you need to just assign guards. Locks exist but are basically a formality (IIRC, many tanks and airplanes are left unlocked because all the security posture is with the military and the lock itself is too much of a hassle for logistics).

------

Fort Knox itself was designed to be safe from Nazi invasion. If the Nazis invaded New York City, they won't find any of the governments gold. The 'lock' in this case is the miles and miles of geography the Nazis would have to navigate before reaching Fort Knox.

BurningFrog

Certainly not at reasonable prices!

__loam

There's a few that are pretty good but at a certain point you can just grind off the shackle or blow the door off its hinges.

lawn

Any lock can be forced through given the right tools and enough time.

You need to be more specific with what "truly secure" means.

koolba

> It's quite entertaining to see how little security you actually get from most locks.

Physical locks are for honest people. They signify that something is not meant to be accessed and at best slow down someone actively trying to access the other side of the lock.

mrweasel

I recall either "The lock picking lawyer" or McNally explains that only in 3% of cases are locks picked during a burglary. In all other cases windows or doors are simply forced open. So at best locks are meant to prevent of crimes of opportunities.

ErroneousBosh

You know those super secure double-glazed front doors, with the kind of hook things that engage when you push the handle up?

You can spudger one of the glass units out and back in from the outside, without leaving a mark.

They look better than they are.

BolexNOLA

Yeah my understanding of burgling is it’s all about speed. One of the best deterrents you can have is I think called “laminate glass,”that doesn’t shatter into a bunch of pieces when it’s hit. It has a tendency to hold together so they have to spend precious seconds knocking out more of it which almost always makes them run away rather than risk it.

If I can go out on a limb here, I also think I recall that they have very specific things they look for. For instance they will often run straight for the master bedroom and start pulling out drawers/checking closets because people tend to keep jewelry in there. They want small items.

Anything that slows them down tends to deter them even if they make an initial attempt

amarant

They're also effective against incompetent thieves. Anecdotally that's a pretty high percentage of thieves you'll ward off that way.

svachalek

Exactly. There's a lot of strongly worded stuff in here about how easy locks are to defeat, but that's only against someone who's practiced the art, which is a very small percentage of the population. And in my experience they're mostly honest people interested in the technical challenge, rather than criminal exploitation. A typical modern lock is going to massively slow down or outright stop nearly everyone who comes up against it.

FridayoLeary

Don't know why you are being downvoted because it's true. Lots of people wouldn't try to break past a lock but if you leave a door open many people would fall for the temptation.

Kye

Opening a padlock by hitting it with another padlock has to be one of my favorite bits.

danudey

"This is a Master Lock XYZ. It can be opened with a Master Lock XYZ."

null

[deleted]

Y_Y

Same solid principle as homeopathy

ProllyInfamous

Back in 2007, I published the first YouTube bypass of the Master Lock #175 (very common 4-digit code lock), using a paperclip.

After the video reached 1.5M views (over a couple years), the video was eventually demonetized (no official reason given). I suspect there was a similarly-frivolous DMCA / claim, but at that point in my life I didn't have any money (was worth negative) so I just accepted YouTube's ruling.

Eventually shut down the account, not wanting to help thieves bypass one of the most-common utility locks around — but definitely am in a position now where I understand that videos like mine and McNally's force manufacturers to actually improve their locks' securities/mechanisms.

It is lovely now to see that the tolerances on the #175 have been tightened enough that a paperclip no longer defeats the lock (at least non-destructively); but thin high-tensile picks still do the trick (of bypassing the lock) via the exact same mechanism.

Locks keep honest people honest, but to claim Master's products high security is inherently dishonest (e.g. in their advertising). Thievery is about ease of opportunity; if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).

mothballed

Actual thieves don't give a shit to learn lock picking, they can use a fine toothed sawzall or oxy-acetylene torch and defeat any lock just as fast without having to youtube the particular brand.

WalterBright

I used to rent a storage unit. I lost the key to it, and went to the manager. He came back to the unit with a small battery powered grinder. Cut the padlock's loop through in a few seconds.

Most locks are only good if the attacker doesn't have any tools.

RajT88

I bought a giant pair of bolt cutters a while back for a use case other than bolt cutting (shark fishing; cut the big hook instead of putting your hand near the mouth).

I never caught any big sharks like I thought, but now my wife runs a restaurant and occasionally employees just don't show up to work and leave things in their lockers. Once in a while it's clear it's to be annoying (locking supplies in their locker).

Never met a padlock or combination lock I couldn't shear through easily. Totally has paid for itself.

bombcar

For surprise of tool used the saw vs safe are the best:

https://youtu.be/2guvwQvElA8

The main thing locks do is make it noisy to get in.

LorenPechtel

Aha, a legitimate use for those things!

Saw the same, except it was bolt cutters.

burkaman

That is a subset of thieves. There are still plenty of situations where it is beneficial to have a lock that can't be opened in 5 seconds with a paperclip, like a school or gym locker room for example. Nobody is bringing a sawzall into the gym while it's open.

Similarly, I know the lock on my front door is not going to stop anyone who really wants to get inside, but it does stop drunk people or bored kids from wandering in because it's easy.

jrnng

> Nobody is bringing a sawzall into the gym while it's open.

They are bringing in bolt cutters to locker rooms. The locker metal loop that the lock threads through is easier to cut than the lock. I've first hand seen lockers destroyed to remove the lock. Not while the break in is happening but it's easy piece the crime scene back together to understand their tools.

Manual bolt cutters are almost silent except for the "thunk" when it breaks the metal, and there are even battery operated bolt cutters that are quick and compact.

Macha

> like a school or gym locker room for example

We broke into our own lockers the whole time with metal rulers back when I was in school because of forgotten keys or just because it was quicker opening them that way than actually unlocking and relocking them. (And of course the more students did this, the more worn the metal became and made it even easier the next time)

throwway120385

Yeah as long as we don't have unrealistic expectations from our $30 deadbolts and our $5 combo locks it's fine. But people sometimes buy the cheap thing and expect it to perform as well as a really expensive thing.

Ekaros

It is actually surprising just how little brute force many semi-decent padlocks can handle. A decent mallet and some force concentrator and I think good amount of them will fail.

ortusdux

I just need to be able to show the insurance company a police report and obvious tampering. On video, someone using an aluminum shim looks the same as someone using a key, and any evidence would require some decent forensics. Same goes for skilled lockpicking and bump-keying. Ideally, the weakest link should be the door, the hinges, the shackle, etc.

everforward

I don't think there's much of a point. If the thief came prepared with tools and is willing to make a lot of noise, there's not a ton that can be done.

Without even exotic tools, what are the odds the door the lock is attached to will withstand a crowbar? Or the same mallet and force concentrator applied to the door/hinges/where the lock attaches?

Johnny555

But usually the thing that's locked up can survive even less brute force than the lock -- a storage unit near mine was broken into, and the unit owner (who was there with the police) said the thieves just pried off the storage unit lock, the sheet metal door literally tore and the entire locking mechanism came out.

This was an outdoor unit, the thieves came in over the fence (the barbed wire on the fence didn't slow them), and left the same way. If I had anything valuable, I'd keep it in an indoor unit where at least there's a locked door in the way.

jorvi

Padlocks can be snapped open by angling two wrenches: https://youtu.be/dBSSA5ot0tA

This even works with bigger padlocks, you just need two really big wrenches and a buddy to help you.

Phui3ferubus

There are diminishing returns. Just look at bike locks. Anything higher than trash tier, and the issue is finding a dedicated bike stand, since anything else will get destroyed by the grinder faster than the lock.

butlike

but then it's obvious the locked thing in question had been defiled. To exfiltrate without detection is the real skill

MisterTea

A battery powered angle grinder with a zip wheel is the best lock picking tool out there. Hell, a cordless Dremel with a zip wheel might do it.

slenk

No one is doing that in a nice residential neighborhood

zie

That's when people can get away with it in broad daylight :) Because everyone thinks like you.

polygot

It’s much more difficult to tell if someone bypassed the lock if they picked it (and relocked it), as opposed to cutting it off completely

vkou

Which is relevant when you're defending against Ocean's 11 or the Mossad, but for the other 99.999% of us, the lock is there to keep a bored teenager or a meth junkie out.

Or, more realistically, to convince an insurer that we've made a token effort to keep them out.

b00ty4breakfast

most thieves don't even go that far. they find stuff that isn't locked or they kick in the door.

null

[deleted]

rdtsc

> On July 7, the company dismissed the lawsuit against McNally instead.

> Proven also made a highly unusual request: Would the judge please seal almost the entire court record—including the request to seal?

Tough at first then running away with the tail between their legs. Typical bullying behavior.

> but Proven complained about a “pattern of intimidation and harassment by individuals influenced by Defendant McNally’s content.”

They have to know it's generated by their own lawsuit and how they approached it, right? They can't be that oblivious to turn around and say "Judge, look at all the craziness this generated, we just have to seal the records!". It's like an ice-cream cone that licks itself.

> the case became a classic example of the Streisand Effect, in which the attempt to censor information can instead call attention to it.

A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

embedding-shape

> A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

I'm just guessing based on the contents of the article, but it sounds like a typical "hard-fist founder-run company" so good luck convincing the founder to not sit on social media and argue their points.

jimbokun

> Under questioning, however, one of Proven’s employees admitted that he had been able to duplicate McNally’s technique, leading to the question from McNally’s lawyer: “When you did it yourself, did it occur to you for one moment that maybe the best thing to do, instead of file a lawsuit, was to fix [the lock]?”

Sometimes a single question tells you how the entire case is going to go.

tuetuopay

The most absurd thing is the original video response from the company was good, and with a very compelling argument: their customers never saw shimming in the field. Their user base don't need shimming resistance: security needs to be adequate, not perfect. And they follow-up by presenting options about people requiring the lock to be shim-proof.

Granted, in this day and age, it's a disgrace to still make locks that can be shimmed. Especially when the shim-proof alternatives they show just have an additional notch to catch the shim.

mothballed

This guy shims a $100+ lock in 10 seconds with a liquid death can, all without speaking in the video, just replays and then destroyed their claims and GTFO. Absolutely masterful.

null

[deleted]

c420

https://youtu.be/qL_MeobAp5s?t=1487

For those interested in the actual case, here's some deeper coverage of this bruhaha including how Lee may have perjured himself during deposition.

hinkley

That guy sure isn’t in a hurry to get anywhere. Good one to watch at 1.25x speed.

shagie

Long (often an hour long) with significant snark videos going over the filings: https://www.youtube.com/@RunkleOfTheBailey/search?query=Prov...

robotnikman

I wonder how many stories like this are caused simply because a corporate lawyer is looking for some work to do, and maybe to meet some kind of internal KPI.

pcaharrier

Former in-house lawyer here and in my experience the answer is something like "probably less than you think." The job of the lawyer is to advise the client and (within the bounds of ethical rules) advocate for their position, not to come up what the company's position should be.

robotnikman

Interesting, thanks for the insight!

null

[deleted]

pcthrowaway

Lock-makers should start including RFID and a software key checking mechanism, then sharing the key would be illegal

lexszero_

Here in Finland mechanical locks with electronic keying are pretty common in some places. Some of them like iLOQ or Abloy eCLIQ are actually pretty clever: electrical bits of the lock are powered from mechanical action of inserting and turning the key, so you don't have to worry about batteries. In theory, they promise significant cost savings in scenarios like rental apartment buildings where tenants move in and out, need access to common areas, lose keys, etc, without compromising security or having to replace or recode locks - they just give you a generic key, click some buttons in the admin panel, and your key could be provisioned accordingly once you first enter the building and interact with one of the "smarter" locks that are externally powered and networked to the mothership.

In practice, in addition to the usual bugs you would expect from a software-based system managed and maintained by a plethora of organizations and contractors, they tend to become very annoying as parts wear out, so you have to fiddle with the key reinserting it repeatedly trying to find just the right angle so it will make a good contact to be recognized by the lock (for example the iLOQ system by my landlord communicates over a thin contact strip molded into the key opposite of the cutting and separated from the rest of the key with a thin layer of plastic).

dcan

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

foofoo12

That's an illegal number mate. Straight to the slammer!

(for those missing out: https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...)

butlike

plz stop! my hddvds...

nomel

Could you make access illegal using the DMCA, by putting some copyrighted content inside, with the physical key also being the license key?

ranger_danger

> sharing the key would be illegal

How so? And what region are you referring to? There are many countries in the world with vastly different laws.

butlike

I don't really "get" locks. If you want something to be closed forever, seal it shut. If it should be opened and closed, leave a hinge. If it should only be open and closed by a select few, leave it in a trusted environment

Don't you live in a good neighborhood?

avhon1

I've lived in a fair few places, but I've never lived in a place where an unlocked bicycle wouldn't be stolen. I'll keep using locks, thank you very much.

hereme888

A trusted environment, even in a "good neighborhood", requires a lock at least to the front door of your house, or gate, or w/e.

But where will you park your car when you go to work? You have to lock it.

embedding-shape

> A trusted environment, even in a "good neighborhood", requires a lock at least to the front door of your house, or gate, or w/e.

I don't think that's a trusted environment or "good neighborhood". But then I basically use "can leave front door unlocked with zero worries" as the threshold for "trusted environment".

But those environments and neighborhoods definitively exists today across the world, although they're probably becoming less and less common.