September 17, 2004

O-Pen-ing Your Kryptonite Lock

Freedom To Tinker is joining in the discussion on the ease of o-pen-ing Kryptonite bicycle locks that use cylindrical keys.

Apparently there is some question of how long this has been known. Reasonable proof of this being known for a while might be this Usenet message, found in Google Groups, which dates from December 1992.

Quoting from it also makes clear a second point - "... ANY lock with a cylindrical key of that style can be picked in seconds with the plastic cap from a cheap ballpoint pen..." - which still holds true. A thorough reading of the original bikeforum thread finds people reproducing this trick on many similar locks, not just those of Kryptonite. So, in that regard, Ed Felten's description of Kryptonite's claim as 'safest thing around' is a relative claim, which might still be true. Additional pointers in the bikeforum also lead out to lockpicking forums, where the idea that locks are unbreakable generates a really good chuckle.

It is worth keeping in mind that a bike lock has to satisfy other parameters besides those of security. It has to be of moderate weight, since it will be carried everywhere. It needs to be small -- some riders like small locks that they can carry in their pocket. It needs to be easy to manufacture, since bicycle locks can't really be super-expensive for most of the market. It also has to be resistant to jamming due to weather and dirt, both of which many riders encounter regularly. A "false negative" -- that is, unable to unlock your OWN jammed lock -- may be just as bad in the short term as a stolen bike.

If you read through Kryptonite's reports of street toughness, it is clear that most attacks on bicycle locks targetted the lock frame, not the actual key mechanism. Kryptonite appears to build very robust frames, but may have been a little blind to just how easy it had become to pick the cylinder-style locking mechanisms. As a reminder, we can go all the way back to the original Usenet posting, and look at the reply.

"Sure, with enough skill. Having tried my hand at picking cylinder locks, I can attest that even with the proper tools it requires skill and practice far beyond what most thieves will bother to invest. The handful of "specialists" who can do this trick I don't worry about."

This points out the real breakthrough this time. This technique is not just possible for the expert, it is relatively easy for the novice.

Although it is easy to take Kryptonite to task for not disclosing the real security level of their locks (which they may have not known), it is important to note that no bike lock company is disclosing such details. When it comes down to weighing the relative merits of which lock to buy, Kryptonite's anti-theft insurance policy is going to be a critical part of your protection.