General Cycling Discussion - Your brand new bicycle u-lock is not safe!

As an engineer that's worked on a project where people's lives depended on it and also with a product that almost killed someone, this is less severe but I'm willing to bet someone just dropped a load in their pants right now.

Oh, and btw, I've known how to break combo locks since I was 9... Just pull the lock mechinisim away from the locking "tube" slowly twist the numbers.... it feels like it catches when you try to spin off from the 'right' number..... takes practice, but I can pick a combo lock in <10 seconds

Not a thief, just learned it from the old guy down the street when I forgot my combo over the winter months...

A lot of newer combo locks have addressed this issue.

What bothers me is the fact that there are very little intermediate U-Locks out there. I don't consider the New York Chain or Evolution 3000 to be intermediate locks. Those locks weight over 3 pounds and there is no way I'm going to lug those around for 40 or 50 miles.

The Evolution 2000 was perfect because the device was only about 2 pounds but now it's worthless. Does anyone have any experience with the Abus U-Lock??

The only Kryptonite lock I own that I haven't been able to break yet is an Evo 2000 Mini LS with a key code beginning YSE. I *am* able to break all keycodes beginning KK. The YSE seems to ahve a slightly larger lock core diameter, and is an older lock - perhaps the more recent ones are actually more vulnerable?

I tried some friends' regular old Kryptoloks with the NBA serial. No dice. The one I did get to work, my old Kryptolok I can' find the key for but I can use the Bic! Which does work. So I don't know if that one says KK.

I still can't open my Mini and it is indeed a YSE.

fyi, the 2 movies on my server have been downloaded almost 8,000 times since yesterday evening and the rate appears to be increasing.

the access logs show links from dozens of different pages.

Yeah, this is no hoax. I freaked out a dozen or so lock owners last night when we tried it out. The first time it took about 10 seconds, the second time only 2 seconds, and after that the pen was "stripped" and it was harder.

Now that I have more pens I'm going to try it on my older U-Lock. I won't be that surprised if it works on that one too.

Beyond getting new locks from Kryptonite, what the hell are we going to lock our bikes with?!

Beyond getting new locks from Kryptonite, what the hell are we going to lock our bikes with?!

You can always weld it to the rack.

I have a Kryptolok from a few years ago (make that many years ago) and I cannot open the lock, the number on my key is F####.

Ten seconds. I feel like I've violated myself. Amazingly, the Kryptonite customer service folks are still being very nice.

FYI, my key number is KK####

if you've tried to crack it, please post yours!

I still can't open my Mini and it is indeed a YSE.

i've gotten my YSE Mini open a few times. it takes a little while, but it works.

Beyond getting new locks from Kryptonite, what the hell are we going to lock our bikes with?!

I just went out 5 minutes ago to the hardware store and bought myself a $7 brass padlock to use in addition to the NY Disc Lock that came with my NY Chain. At least now a thief will have to know about this pen trick, and also have at least a cutting tool. Makes me feel a little better.
http://www.chinrose.com/images/brasslongshackle.jpg

Mine is KK, got it open.

oh my god! this is crazy. just got back to the thread. we done blown up yo! i have a feeling that right now at this very second there is a bike theft being committed.

Not but seconds ago, I locked one of these Kryptonite locks around the neck of my girlfriend during a little rough play.

I couldn't force myself to pass the key quite yet (we always swallow them to make it more fun)

But she had a cold and couldn't breathe.

Don't you guys use a password when things get a little too rough and one wants to stop?

Joe: Metafilter too.

http://www.metafilter.com/mefi/35590

FWIW, I just opened my old Kryptolock, about 15 years old. The kind with the key on the end. Took a couple minutes with the bic pen.

Just the other day, I was looking at some hardened 3/8" chain to use with a rather buff padlock I have. I'll have to get a couple feet worth now.

here are a few sites the movies are linked from....

http://www.s2ki.com/forums/index.php?showtopic=235230
http://www.cyclingforums.com/t176936.html
http://www.bentrideronline.com/messageboard/showthread.php?t=5281
http://my.work.has.lame.filters.metafilter.com/mefi/35590
http://speedzilla.zeroforum.com/
http://jhu.dailyjolt.com/forum/read.html?id=78057&mreturn=78068
http://groups.yahoo.com/group/chicagocriticalmass/message/18648
http://groups.yahoo.com/group/Superstar_Roadies/interrupt?st=2&m=1&done=%2Fgroup%2FSuperstar_Roadies%2Fmessage%2F9592
http://forums.nocarlno.com/showthread.php?p=355881#post355881
http://forums.bicycling.com/thread.jspa?messageID=1340837
http://chicagofreeride.com/forum/viewtopic.php?t=11
http://board.dogbomb.co.uk/showthread.php?p=511506
http://adamjansen.com/news
http://antikoan.net/
http://www.bcsportbikes.com/forum/showthread.php?t=40005
http://www.eyebeam.org/reblog/archives/002662.html
http://www.giantrobot.com/forums/showthread.php3?s=&postid=800695

and a livejournal or two...

http://effendi.livejournal.com/friends
http://www.livejournal.com/community/bikepirates/
http://www.livejournal.com/community/bikepirates/670721.html
http://www.livejournal.com/community/bikepirates/670721.html?nc=2
http://www.livejournal.com/community/bikepirates/670721.html?style=mine
http://www.livejournal.com/community/bikepirates/670721.html?view=4947969#t4947969
http://www.livejournal.com/community/bikepirates/670721.html?view=4951553#t4951553
http://www.livejournal.com/users/andrewnomicon/friends/
http://www.livejournal.com/users/anever/friends/
http://www.livejournal.com/users/anomalite/friends
http://www.livejournal.com/users/bikes_not_bush/friends/
http://www.livejournal.com/users/breadzeppelin/friends/
http://www.livejournal.com/users/cataplexy/friends/
http://www.livejournal.com/users/chickbean_cat/friends
http://www.livejournal.com/users/clevernonsense/friends
http://www.livejournal.com/users/dannthraxxx/friends
http://www.livejournal.com/users/dogoncouch/friends/
http://www.livejournal.com/users/enderwaves/friends/
http://www.livejournal.com/users/endlessxmike/friends
http://www.livejournal.com/users/fotoman311/friends/
http://www.livejournal.com/users/fuso13/friends/
http://www.livejournal.com/users/gendertrouble/friends/
http://www.livejournal.com/users/iliketherobins/friends
http://www.livejournal.com/users/internalxternal/friends/
http://www.livejournal.com/users/luna_littleone/friends/
http://www.livejournal.com/users/matenmultiplate/friends/
http://www.livejournal.com/users/mikeydreadful/friends/
http://www.livejournal.com/users/noitsmyface/friends
http://www.livejournal.com/users/p4nc4k35/friends/
http://www.livejournal.com/users/petre/friends/normal
http://www.livejournal.com/users/pinchegringo/friends/
http://www.livejournal.com/users/proleptic/friends/
http://www.livejournal.com/users/reddirtboi/friends/
http://www.livejournal.com/users/ribald_******/friends
http://www.livejournal.com/users/robert1er/friends
http://www.livejournal.com/users/shadowfang/258048.html?mode=reply
http://www.livejournal.com/users/shannanigans/friends
http://www.livejournal.com/users/sluttycakes/friends
http://www.livejournal.com/users/velosophy/friends
http://www.livejournal.com/users/xiamin/friends
http://www.livejournal.com/~256/friends
http://www.livejournal.com/~ianrox/friends
http://www.livejournal.com/~save_me__jebus/friends
http://www.livejournal.com/~sckot/friends/

=v= I've had no luck, but my key starts with "NBA." Note that in NYC, a lot of people get the New York Chain and upgrade the lock to one of those "undrillable, unpickable" types that are on all the storefronts:

http://www.things.org/~jym/bicycles/pix/rts-chain-lock.jpg

<_Jym_>

lol. I saw the post on Metafilter and I was like, "Wow, that's funny... I just read about that 2 days ago on BikeForums." Then I looked at the links they put up:

One to the video.
One to this thread.

Yay, Bikeforums!

brunning, I hope your server is doing better then mine; I have a dual xeon 2.8 w/ 4 gig of ram, and the load is hovering around 3.8 - 4.2!

I am so glad that I bought an Abus now

joe, i just have a shared web hosting plan, but it allows me 64 GB of transfer a month, and i usually never even come close to that.

I've had a bit of experience with lockpicking (though I only use my powers for good), and have read quite a bit about bike theft, and this issue isn't really that big a deal. Most bike locks can be defeated in one way or another in seconds. Cables of any size are very easy to cut, as are any non-case-hardened chains and locks. Most U locks (not the stronger krypto models) can be popped off with no tools at all, by lifting the bike off the ground and using its frame as a lever to twist the lock. I've picked many "normal" style locks in about a minute using improvised tools, like a paper clip and a pencil, and with practice I'm sure it would be much faster.
A friend of mine once saw a bike stolen... a van stopped, a guy with cable cutters got out, snipped a lock, grabbed the bike, and was off again in about ten seconds, before any of the passersby even realised what was happening.
All that considered, one more method of defeating a bike lock isn't that earth shaking. It definitely is something to be aware of, and I personally plan to replace my ev disk lock with somethimg the theives havn't seen so often, but it's important to remember that if anyone really wants a bike that's locked outside, they can probably have it a lot faster than you'd like.

Regarding some of the suggestions that have been posted:
-Cross locking (using multiple locks of different types) works. Most theives only carry the tools for one type of lock at a time, and even if they have all the tools, don't want to spend too long on one bike.
-I haven't tried it with this method yet, but I suspect that lubing the keyway will make it easier rather than harder. As a general rule, lubricated locks in good working order are far easier to pick.
-Using a second padlock in addition to the Kropto lock on an NY Chain sounds like a good deterrent.
-Locking close to the ground may make picking with a pen more difficult, but is traditionally considered risky as it allows a thief to hammer on the lock using the ground as an anvil. Under present circumstances, that's probably less of a threat though.

Here are some thoughts from NYC Bike messengers on appropriate padlocks for an NY chain: http://www.nybma.com/faq/question3.htm

All this said, Kryptonite makes great locks. It sucks to find out that a great pick for their style lock is so common, but every competitor that I've looked at has had many other flaws in their products, so don't be too hasty to buy something different.

Oh crap I just called Kryptonite and the said they'd have to get back to me. All they did was take my name, number and Key number and said they'd call in a day or two. Has anyone tried this with a Master Lock yet? Specifically the Street Cuffs?

I suspect that the memos are flying!

More then just memo's... :(

Maybe some nice politician can get those darn BIC pens outlawed.

I suspect that the memos are flying!

You're darn right they're flying!........over at CBS.... :D

well now you'll start getting hits from my place of work, I jsut posted it to the internal bicycling mailinglist. You won't find a link, but add one more to your list of places this thread is linked at.

I'm also going to add it to a few other groups.

So I tried this out on my kryptonite, not sure what model, I've had it for years. I managed to turn it enough that now the lock is stuck! I cannot get it to move any further though. I'm gonna keep trying here, but it definitely is possible as it turned partially.

Is that a Dan Rather joke Fixer? I would have that you could come up with something else rather dan dat. <snicker> Hey Joe! You should start charging admission t this thread. You could retire!

Maybe some nice politician can get BIC pens outawed.

Nah, i like bic pens...best darn spitwad launchers in history. i also made a very nice BB launcher ouf of one of those clear ones before. As far as cheap pens, Bic is great....

....now Krypto needs to get their stuff stright and move to flat locks, like NOW.

I would really like some more reviews on the Master Lock Street Cuffs as well. I have only ever found one review and it was kind of ehhh. My friend really likes them, but I would like some more opinions....and to know if a Bic will ruin them as well.

There are like 850 people looking at this forum currently....compared to about 12-15 people in the other forums. Crazy.

sh*t! Now I can't wait to get home and look at the $95 I wasted on my false sense of security! I know it works - the plastic on the pen is just pliable enough to create a form inside the tumbler. Remember James Bond making wax molds on the fly - same principle. ...and I was going to buy another bike tonight!!!!!

I've had a bit of experience with lockpicking (though I only use my powers for good), and have read quite a bit about bike theft, and this issue isn't really that big a deal. Most bike locks can be defeated in one way or another in seconds. Cables of any size are very easy to cut, as are any non-case-hardened chains and locks. Most U locks (not the stronger krypto models) can be popped off with no tools at all, by lifting the bike off the ground and using its frame as a lever to twist the lock. I've picked many "normal" style locks in about a minute using improvised tools, like a paper clip and a pencil, and with practice I'm sure it would be much faster.
A friend of mine once saw a bike stolen... a van stopped, a guy with cable cutters got out, snipped a lock, grabbed the bike, and was off again in about ten seconds, before any of the passersby even realised what was happening.
All that considered, one more method of defeating a bike lock isn't that earth shaking. It definitely is something to be aware of, and I personally plan to replace my ev disk lock with somethimg the theives havn't seen so often, but it's important to remember that if anyone really wants a bike that's locked outside, they can probably have it a lot faster than you'd like.

All this said, Kryptonite makes great locks. It sucks to find out that a great pick for their style lock is so common, but every competitor that I've looked at has had many other flaws in their products, so don't be too hasty to buy something different.

Ok, if you don't work for Kryptonite (I imagine you do), then you are being a sucker. There's a huge difference between (1) going around in a van with bolt cutters, (2) carrying around a big hammer for u-lock breaking, or (3) being a skillful lockpicker, and the layperson being able to open a lock with a commonly available Bic pen. It's totally ridiculous to think that "one more method of defeating a bike lock isn't that earth shaking" when that method is as simple, cheap, and easy as the one here. You don't have to buy any tools, and you definitely don't have to carry any tools. And passerbys won't notice what you're doing because it basically looks like someone opening their own lock and takes so little time. It's WAY WAY different than using the ground as an anvil for your hammering.

Krypto does make good locks, but c'mon, don't be an idiot. This flaw overshadows all the other good manufacturing. Who cares if a competitor's lock can be broken somewhat more easily when a Krypto can be opened with a freaking pen? It's just way too easy, there's almost no chance of getting caught, and you don't have to buy something big and kind of costly to do it.

I'm buying chain and a padlock today.

I hope Kryptonite returns to regular keys and drops the conical round type joke locks. I like the Evolution 2000 because it wasn't too heavy and was good for light touring. Since the cycling community is fairly small, I don't see how anyone can ever buy another round type lock ever again.

Other than the New York 3000 and Evolution 3000, the entire Kryptonite product line is a joke!

Some thoughts (guesses) on why this works, why mileage varies so much in people's experiments with it, and what it means exactly for security.

Most lock-picking centers on the same basic technique. The security of a lock depends on a row or a ring of spring-loaded pins that are divided into two pieces at uneven breaks. In their resting positions, these pins prevent the lock mechanism from turning. The key is shaped so that when it is pressed against each of those pins (either moved underneath them in a standard lock or pressed straight against them in a tubular lock), each of those breaks lines up at exactly the same height, the shear line where the lock mechanism turns. Then the mechanism can be turned and the lock opened. This is hard to explain verbally, the how stuff works bit on lock picking has good pictures that make it more clear, though -

http://home.howstuffworks.com/lock-picking.htm

Like just about any mechanism tooled for everyday use, there is a bit of play in the whole system, and lock picking exploits that. How a lock is picked in essence is first, you apply pressure sideways against the pin, then you tease it up with a pick. When it hits the shear point, it shifts a bit, as there is enough play in the bottom part of the pin that the pressure you are applying to to nudges it to the side. Professional lock pickers (the vast majority of whom are honest locksmiths) develop a feel for hitting the right point on the pins, and of course a better picker can do it faster and more reliably.

I'm guessing this works in some cases with the pen acting as both the source of pressure (by getting compressed and lodged between the inner or outer cylinder and the pin) and the pick (by directly forcing the pins down). As one jams and wiggles it about, the pins get forced down and when they hit the shear point, the barrel jammed against them forces them out of true enough that they won't get forced down any more.

The fact that the plastic barrel of the pen is relatively soft and deformable, and that a lot of pens of this sort have a bevel on the edge of the cylinder, probably help this work. I'd also suspect that it would have to be tremendously inexact: I'm guessing it would depend a lot on the particular lock and pen and just the luck of the draw of a particular attempt. I imagine like most hacks, some people will have a knack for making it work and others won't.

I'm of two minds about this. In one sense it is certainly a serious "found design flaw" in a particular range of tubular locks (I'm guessing a relative diameter match is the main indicator for how likely success is). Traditionally these lock types are seen as more secure from picking because it is harder to apply pressure against a ring of pins than a row of them. On the other hand, I don't think Kryptonite was necessarily negligent. They will have to fix this but lockpickgeek is right - all systems are vulnerable and simple application of overwhelming force is far and away the thief's preferred method of forcing a lock (there's not much point worrying about the relative availability of lock-pick tools, for example, because in general thieves just don't use them. It's an art, and it takes a lot of work to get really good at, and most people who habitually steal just can't be bothered. Number one method for entering someone else's habitat is a door or window got left open. Number two is a good hard kick). The relative match of the pen barrell diameter is an unfortunate thing because pens are so ubiquitous and not suspicious to be carrying around. There's little doubt habitual bike thieves will add this to their repotoire, but I'm also guessing it's at best a quick and dirty first-attempt tool - knowing the basic design and precision of this type of lock, I just find it very unlikely that this is all that reliable of a method.

I DECLARE SCHENANIGANS!

The lock in the picture isn't and evo, look at the picture, when the lock is opened the bottom of the U is not bent. Kryptonite locks have a bend at the bottom. I dont know why you would want to freak people out about this.

I have worked in shops for years and I worked with kryptonite a great deal as I used to live near them. They work really hard to make thier locks the best, no really. I dare anyone to try it and they will realize it a scam.



Edited for language, Joe

lol brunning
look at all those leechers ;)

Did you also happen to read the link he gives? It recomends Kryptonite through the whole thing!

a kryptonite customer service rep just called me. he was very nice and apologized for the trouble, explained that they do their best to make a good product, test extensively (which doesn't go too far with me, as i opened it with a pen) and made a point of explaining that some of the competition's locks are at fault as well (which they are).

anyway, they are going to come up with a solution of some sort in 24-48 hours.

Personally, I'm going to stop screwing around with U-type locks at all and just go with a> the ludicrous chain, and b> the ludicrous padlock. This Abloy PL362 looks nice, and it looks like UK motorcyclists use it with the New York-chain type chains...

http://www.abloy.com/modules/imagemanage/images/Pl362%2Ejpg

Kryptonite U-locks: just something heavy to carry.

Burdenofproof....if you think this thread is a hoax you are ********.

Let's keep the personal attacks off the forums, thanks.

I didn't believe it, till my brother came over this morning and demonstrated. Took him about 5 min, although his hands were still a bit sweaty from the ride, or else he would have gotten it a bit faster. I am still going to use my little lock, but I am gonna lock a bit lower near the BB, probably through the rear triangle so it cannot be moved much. Hopefully this will deter any would be bic thieves.

Phil

Well, this is scary... I came out of the gym last night around 9pm and found a Bic jammed in my Evo 2000. Didn't think anything of it at the time, but now I have a whole new perspective.

I haven't tried it myself, but I'd say that people are reading about it for sure...

And yes, I also registered just to post in this thread...

I just tried it and it worked on my Kryptonite Mini Evo 2000. I also just went to buy a new lock, an OnGuard U-lock.

And for the record, do not, I repeat, do NOT go to ATA Cycle. I was there and I showed them how easy it was to open the U-lock with a Bic pen. The girl behind the counter said "maybe we shouldn't be selling those locks," so I said I could probably do it with one of the new ones they have on the
floor. As I stuck the pen in it, this mechanic from the back came out, saw that I opened my lock with a pen, and then said to me, "if you mess it up, you buy it." I gave a little laugh, but then he said, "I'm serious." What a stupid, arrogant *******.

This, in the same shop where I saw just moments earlier, a salesman tell a customer, "these tires are 450 dollars," while pointing to a set of Shimano WH-540s, which are complete wheels with spokes and hubs. The he said "I think the Ksyriums are the second best rims out there," when he clearly
meant the wheels (including the fancy Ksyrium spokes and hubs), not just the rims.

There's no need to go to a shop where they're snobby *******s AND they can't even use the right terminology. Don't give money to ATA Cycles. I've been there before and they've always given me attitude -- this was the final straw.

Note to the press:

I will be available all week for interviews ;)

Note to Kryptonite:

Again, I am sorry you are going to have a busy week.

I actually live in foxboro Mass. About 15 miniutes from Canton MA. I am going home tonight to test my lock. If this trick works I am going over there tomorrow and I will stick this Kryptonite lock up someones ass. If anyone can post a video of this procedure being done in a file, I will put it on a cd and take it over there.