General Cycling Discussion - Your brand new bicycle u-lock is not safe!

Here Are The Flaws In Kryptonite's Proposed Upgrade/recall:

Kryptonite Needs To Do A Complete Recall, And Must Be Free To The Lockowners.

Imagine The Following Scenarios:

News Flash, You Have An Anti-virus Software, Claimed To 100% Safe. Now Hackers Have Found A Way In To The Versions Bought Within The Last Two Years, So The Software Company Then Suggests A New Patch Would Be Issued, Only To Those Who Bought It Within The Last Two Years.

Imagine How Kryptonite Would React If They Bought These Anti-virus Software Three Years Ago, And Not Elegible For The Upgrade/rebate Due To The Time Cut-off. I Am Sure That They Will Continue To Use That Anti-virus Software And Feel Very Safe With Their Corporate It Environment. It Is 100% Safe? Right?



Discount/coupon On The Lock Upgrade As A Fix To The Design Flaw Is Equivalent Of Paying For Security Patch #2, Automobile's Engine Failure Due To Design Flaw, You Car Can Not Move, But You Still Have To Pay The Carmaker Money To Have The Engine Replaced + Labors. Btw, If You Got Your Software Or Car Over Two Years Ago, And Forgot To Register, You Are Completely On Your Own, 'cause The Car Makeer Does Not Care Whether Your Car Would Come To Sudden Stop Driving On The Highway.

Kryptonite Needs To Make The Upgrade/recall Completely Free To All U-lock Owners, Regardless Of Registration And Purchase Dates. This Is The Failed Suv Tire Of Bikelocks That Could Only Be Partially Remediated By Free Downloads Of 90mb Security Patches. Imagine If Microsoft Wanted To Issue Security Patch #2 For Xp, And Said, Well, Let's Give A Rebate So Anyone That Has Xp, So That They Could Buy A New Copy At Some Discount? If Microsoft Is A Monopoly, That Might Have To Be The Only Solution. But Since They Are Not Completely There Yet, So The Security Patch Was Free. Now Kryptonite Wanted To Just Give A Discount For Future Purchase? Think About It.

We Buy Their Locks To Secure Our Bikes, So It Is Main Objective Is To Make Sure That Our Bikes Are Safe From Thieves. If Their Locks Are So Easily Picked Open, They Failed Their Objective. They Made Announcements Only After Intense Pressure Created By Kowing That Many People Have Viewed The Video And Would Know How To Open The Locks Without Keys. Yet They Might Just Allow Discount/coupon For Only Recent Two Year Purchases. Remember That They Did Not Know Such Way Of Picking The Lock Open Themselves. So The Discount/coupon Method Just Won't Cut It. By Issuing Such "fix", Kryptonite Is Essentially Saying That Those Customers Who Bought The Older Locks Should Not Be Treated The Same Way As The Recent Customers. Because Their Good Name Was Only Built In The Last Two Years. The Old Customers Do Not Matter As They Never Refer Any Of The Ones That Bought A Kryptonite To Buy A Kryptonite At The First Place.

If You Had Purchased A Kryptonite Lock More Than Two Years Ago, Would You Still Say, Well, Since Kryptonite Has Not Given A Rebate/free Recall For My Lock, Thus Those Older Locks Must Be Safe And They Would Protect My Bike. You Would Then Continue To Use The Older Lock, Until You Watch A New Video That Would Show How To Use Another Modified Tool To Pick It Open. And Now, You Might Have Come To Realized That The Lock Is Not That Safe Anymore, But Your Bike Has Already Beens Stolen.

That Is The Consequence Of Kryptonite's Proposed Solution.

Kyrpto doesn't owe you anything. They never said locks can't be picked. 2yr old lock is NOT equal in value to new lock. They are going way beyond what they have to. It's a good business decision, to maintain leadership in bike lock market. And good for their customers very generous. Are any other makers of round key locks doing this!? They all are vunerable, it's not krypto's fault.

Wow. That bikebiz.co.uk article seems to spin it like we're overreacting. Like, "duh, we've known about this since 92, and you're point is?"

What jerks.

You know, nolageek, you're right, that is how it sounded, so I changed it. I was trying to point out this is an issue security folks must have known about since at least 1992, and probably much earlier because other magazines had previously alluded to "easy techniques, not complex lock-picks" but decided not to publicise the actual method.

So, for my clumsy original wording, I apologise.

Here's the revised article: http://www.bikebiz.co.uk/daily-news/article.php?id=4637

As per Joe's request I also took down the original posting and replaced it with http://www.bikeforums.net. I'm also gonna PayPal him some cash. Extra bandwidth hurts.

Are posters here over-reacting? No, it's a serious issue and that's why I've devoted three stories to it so far, and will no doubt run more. Just like exploding tyres/faulty Intel chips/Dansani's flopped introduction to the UK, this issue will become a set topic in business schools: 'How to fire fight in the internet age.'

And I noticed somebody said an earlier link posted was to the trade-only section of my site. Here's the article in question, with the right, public-access link:

http://www.bikebiz.co.uk/daily-news/article.php?id=4645

So will anything metal including a U-lock

Not if the ductile-brittle transition point's out of the range of freon or liquid nitrogen.

Is this going to be in the form of a rebate check?

Thinking about it, it strikes me that this is highly likely because *they* are the ones who maintain the database of key registration. They stated that you will have to have a registered key and antitheft protection. I was never sent a certificate declaring that I had sent in the paperwork. I just assumed that if I lost a key, I would call or write them and tell them my name and that they would look up which key I own. So at the local bicycle store if I were to decide to actually pay them for a discounted new bottom bar for 5 year old lock (which is working perfectly well. Metal objects shouldn't wear as fast as clothing), how would I demonstrate to them that I have key registration. They don't have a credit card type system where they can instantly figure it out, and they aren't going to phone in on the spot to confirm.

So I bet they'll take all my money, and then promise to send a rebate check when they get around to it if they decide that I sent in the key registration.

Not if the ductile-brittle transition point's out of the range of freon or liquid nitrogen.

I stand corrected, thanks. Any idea of locks that pass this test? 'Cos a can of freon and a hammer are easier for an organised bike thief to carry than a hydraulic jack or a disc cutter / grinder.

Cheers,
RW

Indeed, the best things in life are either free (or not expensive) :)

I remember how I was standing in the shop and deciding which one to buy, Kryptonite or some other. Finally, I bought the cheap, but tough looking generic lock. I still use it.

Hey, if you've done this as quickly as it seems you have, give me a hint.

I bought a bike a moving salem but the seller had left a u-lock locked impeding the rear wheel. She said she'd drop by with the key later and the bike was a great deal. But she didn't and when I went back the next day, she'd moved.

I've spent way more than 30 seconds trying this technique without getting close to opening it. I'm using a BIC opaque plastic barrel pen? All I've managed to do is ham up two pens.

Let me know please.

2yr old lock is NOT equal in value to new lock.

Um, why not? A lock isn't like a car or computer -- it won't depreciate as long as you
take good care of it. Sure, it might get some scratches, but nobody gives a sh*t about
that.

I guess we'll just have to wait and see what rebate will be offered, but if it is anything
less than, say, 80% then this Kryptonite customer is going to be royally pissed.

In most states / cities, you would end up in jail for possession of burglary tools. Be careful ... kinda like a gun - not illegal to sell, but you need to be careful where you go with it and how you use it.


I hope they're ready to arrest millions of bic owners around the world, then, since a bic pen is all it takes to break into our locks! :)

Koffee

Okay, pen body count is increasing rapidly. Lock is laughing at me louder every minute. For those of you that were successfull. Let me know what pen model you are using, so I can stop sacrificing civilians.

Could this be a ploy by BIC to increase their sales this month? ROFL

I have considered buying one of these locks and I am glad to get the "heads up" on this problem. THANKS!

Kyrpto doesn't owe you anything. They never said locks can't be picked. 2yr old lock is NOT equal in value to new lock. They are going way beyond what they have to. It's a good business decision, to maintain leadership in bike lock market. And good for their customers very generous. Are any other makers of round key locks doing this!? They all are vunerable, it's not krypto's fault.

If it's the exact same lock, it may not be equal in "value" since the vinyl is tore up, but it is an "equal" lock. I think that's what his point was. Well made locks don't jsut crap out after a couple of years, a good lock can survive decades. As far as two years, they get no kudos on me for that....saying "you should be grateful tehy are even doing something" mereley shows how little we expect. They should be doing this for all vulnerable locks in the past 12 years, since the first article came out. Yes there is a cost factor, so if they offered a very heavy discount it might work for some, but if I don't get a full exchange, I am going to a different brand and not going back...I spent way too much money on their product to have to re-buy it all over a little finance issue.....

...look at it this way, it was a statistical odds in my favor my $1000 mtb didnt get stolen using one of these things, now if it did, were tehy going to pay? never heard of their guarrantee ever working, so no....I would be out of $1000, for a design flaw THEY KNEW ABOUT. That is where my problem is....in the last two years there was probably no change in their lock design whatsoever.

My Craptonite is barely over two years old and I didn't regiester the key or whatever. I just (falsely) assumed, based on their reputation and that of the LBS that recomended it, that my $40 lock would do a better job of securing my bike than a piece of rope with a knot.
I refuse to USE any more Craptonite products, much less give Craptonite MORE money because of their poor design.
Too bad they have Ingersoll-Rand to prop them up.

I went to the Abus site. Couldnt find any info on prices or how to order. Anyone know any more info about Abus?

Also, I havent registered my key from my kryptolock. Can I do it now, so I can get my upgrade? Im gonna call them Monday anyway and get some answers from them.

And one more thing. I dont blame Kryp. Yes they said they have the best locks out there, but the design itself was not designed by them. Bikes and vending machines, etc. are now on the top 5 lists of a**hole theives who dont want to work their butts off to buy their own stuff.

Thanks.

Hey, I hate to try and spoil all the hate being poured here for Kryptonite. But...

THEY DON"T MAKE THE CYLINDRICAL LOCKS

Kryptonite buys those from Ace, that's why it says ACE in nice friendly letters on the center. Kryptonite makes the tempered U-bolt; the part that we're not having trouble with.

neither of mine say "ACE" in the center.

as far as getting aubs, yahoo is your friend, just be ready to drop about $100-300 on a good one. My only theory for the extreme cost might be importing tariffs or just grredy resellers, but Abus has always been hella expensive stateside.

I need a new lock more often than every 2 years. If you use it a lot in all weather it will crap out. The ACE is printed on the key, I don't know if it's on the lock.

Personally, I suspect that Kryptonite is now vulnerable to bankrupcy!
If people with locks younger than 2 years get a new one, they can consider themselves lucky... just imagine all the claims pouring in to have bikes refunded with lockmakers anti-theft protection guarantee!
(or have they ceased to do that?).
Does anyone know if my BikeGuard cylindrical-key locks are vulnerable to this as well? The diameter is too large for a normal ballpoint pen, so I haven't found anything to jam in there yet... if someone has managed to defeat those, it would save me the trouble.
Thanks all!

It doesn't need to be registered, just show reciept. If your old lock is as good as new, keep using it. Kryptonite didn't invent this pick nor did they popularize it, we did. Get a heavy chain or OnGuard if you hate K locks. I think K locks will remain the best, I'm getting new Kryptos! Sorry you aren't!

Hey, if you've done this as quickly as it seems you have, give me a hint.

I bought a bike a moving salem but the seller had left a u-lock locked impeding the rear wheel. She said she'd drop by with the key later and the bike was a great deal. But she didn't and when I went back the next day, she'd moved.

I've spent way more than 30 seconds trying this technique without getting close to opening it. I'm using a BIC opaque plastic barrel pen? All I've managed to do is ham up two pens.

Let me know please.
########################################

So, you bought a bike for a great deal with the back wheel locked up and now you can't find the person who sold it to you. Hmmmm...
Maybe you should take the bike to your local Police and see if they can help you with the lock

Only the old keys say ACE. They quit using ACE locks. The newer ones are cheaper and easier to bic.

Good U locks are nearly impossible to pick. "It is very hard for us to pick our own locks," says Kryptonite company representitive Neil MacDaid. Kryptonite has difficulty replacing lost keys to their U locks, and there are no master keys.

:mad: This statement was from an article on how to choose a bike lock on http://www.bicyclesource.com/bike/theft/choosing-a-lock.shtml. aaarrrrggghhhh!!!

I will not be fooled again. NO MORE KRYPTONITE for me! I've got two that need to be replaced and will NOT deal with a company that misleads consumers...

I've been trying to open my lock up using the Bic technique. I bought my lock in 2000 I believe, It's a Trek made by Kryptonite. I can't fit the end of the pen into theslot where the key goes. Maybe mine is one of the older one than can't be hacked.

Incidentally, I noticed this issue was a top of the front page story in the Portland Oregonian this morning:

http://www.oregonlive.com/news/oregonian/index.ssf?/base/front_page/1095508748276280.xml

I guess I do live in a bike crazed city.

I own but haven't used a U lock in over a decade. I may commute 5 days a week, but the bike always goes inside the building into a locked room (impossible for some, but worth asking for). No locks. On tour, I use a cable lock, but am never too far or too long away.

For those who suggest forming up a class action lawsuit I can only say that, having been a class member of several class actions, the settlements negotiated are usually worthless (get $5.00 off your next $300 purchase kind of worthless) and make money only for the lawyers. Kryptonite's announced program looks far better than ANY class action settlement for a defective product that I have seen.
Agreed. However, companies have much less incentive to live up to our expectations if they suspect no consequences for doing otherwise. Their program may *look* good now, but of course, I'll believe it when I see it. And if it is good, I'll give them the praise they deserve. In the meantime, they're not victims of uncontrollable circumstance: they were negligent and are indebted to me, and I won't let them think I'll easily forget. Those locks should have been fixed in 1992.

Some have suggested that Kryptonite be held unaccountable for the flaw, since they do not make the locking mechanism but instead buy them from another company. This is like saying that Enron executives wouldn't be guilty, since it was only their accountants who fudged the numbers. The buck stops somewhere, and that's always at the top.



Here Are The Flaws In Kryptonite's Proposed Upgrade/recall:
Easy on the capitalization there, foundation.

My keys also have no mention of ACE, all they have is the sides without a number have a "B" on them (i'm talking both keys of teh set here), and on the number side I have "Kryptonite" "NBA" "5xxx" where xxx are numbers I omitted since they ID my keys.

Ace or not, this was known for a while, and that's where the real concern is...what other problems with their products are there, and have those been fixed yet? This goes for all u-lock makers, not just kryptonite....we have to remeber though, they are the xerox of bike locks...when folks think bike lock here int eh states, they usually go for a kryptonite...that's why they are getting the brunt of the heat.

If it was europe, it would prolly be abus getting all the heat....different market.

Either way, I'm off to take a nice long ride into campbell ad get a on-guard from the local performance bike, since all teh shops near me almost exclusively sell kyptonite u-locks, and have NO ulocks without ace-style locking mechanisms.

Hi, all!!

I have a problem.

I have a Master Lock Pro Sport Resettable Combination U-Lock with Carrier Bracket.

Anyway, somehow my combination got reset while the lock was locked and I can't open it. I came across the article on how to open a bicycle lock with a ball point pen but that looks like it's for locks similar to mine but that have key locks instead of a combination lock.

Any idea how I can get this lock unlocked? Appreciate any help. E-mail me if you like.

Thanks!

Ed

if it's a combo lock with multiple rings, where each ring sets one number of the combo, just brute force it.

Start with 0000 and move up sequentially until it opens. If your moderately fast its about a combo every 4 seconds, that's 15 combos a minute, at that rate it's about 11 hours to try every single combo...given that's an awful long time. The faster way is to just take a drill with a cutting disc attatchment and just cut the lock open.

A faster way is if the bike is in a quiet place, listen to the lock closely aqnd see if you can hear anything click when you mess with the number rings. I used to be able to do this a long time ago. locks only slow someone down, but this style combo lock will only slow down those who try to be fast about it.

Agreed. However, companies have much less incentive to live up to our expectations if they suspect no consequences for doing otherwise. Their program may *look* good now, but of course, I'll believe it when I see it. And if it is good, I'll give them the praise they deserve. In the meantime, they're not victims of uncontrollable circumstance: they were negligent and are indebted to me, and I won't let them think I'll easily forget. Those locks should have been fixed in 1992.

From what I have read here, back in 1992 Kryptonite was using a different lock cylinder - probably an ACE II which seems much less susceptible to this attack. However, Kryptonite may very well have not known of the problem until this week. As far as what has been posted here, there were only a few mentions of the vulnerability way back. People seem to think that just because this was reported years ago that Kryptonite knew about it. Maybe they did, maybe they didn't. If they knew about it, it would have been almost trivial for them to have switched to a 5 pin flat key lock cylinder which would have provided more than enough pick resistance. Remember that thieves generally don't bother with subtle techniques like picking bike locks. Bolt cutters are quicker and surer. It would be stupid for Kryptonite to knowingly continue using a vulnerable cylinder for 12 years while keeping their fingers crossed that nobody finds out.

However, Kryptonite certainly has been suffering the consequences of the problem, even without a lawsuit. I was in an REI store today and there were no cylindrical key Kryptonites on the shelves. I suspect it's the same at about every bike shop in the US (maybe the world?). That's a lot of merchendise coming back for credit. Add to that the HUGE cost of replacing a large percentage of all the high end Ulocks and padlocks sold during the last two years, and the subsidized replacement of older locks and you have to believe that Kryptonite is trying to do the right thing to maintain their reputation. Keep in mind as well, that Kryptonite was about to introduce a new lock series using the flat keys. They doubtless expected a lot of bike owners who already have Kryptonite locks to upgrade to the new ones. That's not going to happen for a while since most of us are apparently getting free (or heavily discounted) locks.

if it's a combo lock with multiple rings, where each ring sets one number of the combo, just brute force it.

Start with 0000 and move up sequentially until it opens. If your moderately fast its about a combo every 4 seconds, that's 15 combos a minute, at that rate it's about 11 hours to try every single combo...given that's an awful long time. The faster way is to just take a drill with a cutting disc attatchment and just cut the lock open.

A faster way is if the bike is in a quiet place, listen to the lock closely aqnd see if you can hear anything click when you mess with the number rings. I used to be able to do this a long time ago. locks only slow someone down, but this style combo lock will only slow down those who try to be fast about it.

If you go the cutting disk route, make sure the bike's owner isn't around. I've never had a combo lock change while the lock was closed.

I guess that's why many commuters use 2 to 4 locks. If one fails for what ever reason you got backup.

as i was browsing threw the posts again today i saw how one person had bought a Multilock padlock and said that those keys are impossible to duplicate you are completely wrong. i myself and some of my co workers are used to making multi lock keys so much we can look at your key and tell by the key. of course its illeagle but it can happen multilock key codes consist of 5 lettercodes and 5 numbercodes letters for the outside cut and the number for the inside cut. dont get me wrong mutilocks are great but any1 who has worked in a hardware store can tell if there used to it.

(for new yorkers) byclicle habitat is a rip off even though some people who work their are cool they still rip you off if you walk 3 blocks u can get a american lock for 20 bucks at mott hardware

you all might be interested to know that the videos have been downloaded from my server (including redirects, where the link was to my server, but the video is being linked from bikeforums.net) well over half a million times this week!

and who knows how many times it's been downloaded from other mirrors...

What about the Kryptonite U-lock with a key entry on one end of the straight tube bar? Mine is covered with yellow rubber/plastic and has a tubular key with a Kryptonite (R) mark - the diameter is larger than BIC pen - no way to push a pen up?

greetings all, just joined up (finally)

i thought i would reply to "pen opening a lock" post.

i have 6 different ulocks, all of them are the mini U locks that motorcyclists and cyclists use with a heavy duty chain. i saw the post and thought WTF? so out of curiousty i tried it. took 3 seconds to open each lock. looking around the bike storage, i was shocked at how many other people use these locks. (all brands). if a thief came in here, he would be able to remove ALL the bikes in our storage room (400 bikes - ranging from el cheapo to $5000 + ) in very little time.

try different pens. i had excellent results with the softer plastic pens, not the hard ones. remove the inkstick and top of pen. push into a lock with that has the barrel style key. push and turn. lock opens. i also tried this on the vending machines at work (manager present) if i had been a thief, i would have had access to well over 1000 bucks in change.

something to think about.

i have since replaced all my locks with the circular disc locks sold by ABUS and others.

something to think about too - if a piece of pen plastic will open a barrel lock, why not try a flat piece of plastic in a regular flat key style lock. you would be shocked at how unsecure the world just became.

I thought of going to a circular lock.

When I said 2 to 4 lock I ment different type. not all Masterlocks. Maybe One U lock(flat key design), and One circular lock with a cable or thick chain.

1/4" soft copper pipe (thinwall) will also work. this is one h*ll of a shakeup for the bike world, inlcuding motorcyclelocks..... just heard the local insurance guy in my area will no longer cover bikes locked with barrel key style locks.

you all might be interested to know that the videos have been downloaded from my server (including redirects, where the link was to my server, but the video is being linked from bikeforums.net) well over half a million times this week!

and who knows how many times it's been downloaded from other mirrors...

Referrals to the videos from the bikeforums.net domain and this thread only: 183,234

Referrals to the videos from the bikeforums.net domain and this thread only: 183,234


It's called dialup. :p

I have a Master Lock Pro Sport Resettable Combination U-Lock with Carrier Bracket.

If it is the kind with wheels side by side, lay a very thin piece of metal, like chrome, in the space to the right of one wheel. Press gently on this piece while turning the wheel and you will feel when the wheel comes to a flat spot. move to the other wheels and do the same. when all the flat spots are aligned, turn the wheels as a group until the lock opens.

something to think about too - if a piece of pen plastic will open a barrel lock, why not try a flat piece of plastic in a regular flat key style lock. you would be shocked at how unsecure the world just became.

Won't work unless you're extremely lucky - different engineering.

hi-

new here. just heard about the new Krypto-disaster, and had to give it a shot on my own lock. tho't I'd pass along that fortunately, the Bic pen method doesn't seem to work on older Krypto locks; mine is at least 10 years old, and the pen barrell doesn't even come close to fitting over the center part of the lock roller (not even tapping it with a hammer). I haven't tried finding something that actually DOES fit, to see if it will have the same effect, but have a feeling it could be possible. For now at least, the Bic doesn't work.
Anyway, perhaps this has already been covered in this thread, as I only read the first half dozen pages or so, so forgive me if I'm being redundant.
That being said, does anyone know if there are any other security issues with the older style Kryptos? I've been considering upgrading my old lock, but now doesn't seem to be the best time...

- probably an ACE II which seems much less susceptible to this attack.

I have an ACEII lock sitting in front of me. The only real reason it's more difficult is that there are fewer pens that are the right diameter to fit around the center. The bics used in the videos don't fit and either flare out until they're worthless or crack if you try and force them.

What about the bic company how will they fair in this mess

The story just made it on slashdot.org. I predict a real test of the bikeforums server is about to occur.

If you go the cutting disk route, make sure the bike's owner isn't around. I've never had a combo lock change while the lock was closed.

I'm just assuming his lock possibly broke for whatever reason. I never trusted combo locks, and never will.

I have an ACEII lock sitting in front of me. The only real reason it's more difficult is that there are fewer pens that are the right diameter to fit around the center. The bics used in the videos don't fit and either flare out until they're worthless or crack if you try and force them.

Try boring out the center of the pen tube and see how it does. That's how you get a papermate flexgrip to work on a kryptolok too....well that and shaving off that *(#& rubber.

by the way I just got an onguard ultimate u-lock. So far it seems pretty nice. It is quite heavy though.

The locking mechanism uses a double-row key, which also happens to be very narrow, a good thing to avert lockpickers, plus you have plenty of spares should a key get damaged for whatever reason. The locking mechanism also attatches to the U portion via two retracting pins, not one like on teh kryptolok. The bonus to this is the locking portion can be attatched either way.

Sizewise, it's slightly larger than the Kryptolok, but not as large as the kryptolok LS. I think this size difference might have to due with having a squared U portion.

Overall it seems to be a nice lock...and a suitable replacement, although I would like my far lighter Kryptolok to have its locking portion replaced.....

main reason for getting this was so I don't even ahve to worry about having to yank pens out of my locks...

There's this one type of key that you see on some filing cabinets; no teeth, but there are two channels running both sides (4 total) that key the tumblers. Does anyone know what these are called and how well they work?