General Cycling Discussion - Your brand new bicycle u-lock is not safe!

Well, this is scary... I came out of the gym last night around 9pm and found a Bic jammed in my Evo 2000. Didn't think anything of it at the time, but now I have a whole new perspective.

I haven't tried it myself, but I'd say that people are reading about it for sure...

And yes, I also registered just to post in this thread...

LOL you are a lucky lucky man

wow.
:eek:


Awesome videos.

<--registered just to post here


caught the link from http://www.cycleforums.com


posted a thread on http://www.sportbikes.com

Be sure to update this thread with info from kryptonite.

Ok, if you don't work for Kryptonite (I imagine you do

Hehe.. no, I do not work for Kryptonite. If I did I probably wouldn't be suggesting replacing the lock that comes with the NY chain with one from a different maker. I have just been a lock geek and a cyclist long enough to have a not-so-reactionary response to this kind of news, and I've seen the results of people using crappy locks many times. In my experience, and in my city, a case-hardened chain with a good lock is the minimum if you want to keep your bike. The Krypto chain is a great one and readily available. But now someone figured out an easy way to pick the lock. I'm not saying that this is not a problem. I think it's a big enough problem that I'm shopping for a new padlock on the way home from work today. I'm just saying that compared to the flaws in everything else on the market, this isn't particularly surprising or unusual, and I don't think it's going to destroy kryptonite or put them out of business as some have been suggesting. I also don't think it's enough to recommend many of the other locks on the market... e.g., I hear all sorts of people asking about the master lock cuff-style lock. I live in New York, and I remember seeing master lock cuffs three times here... Once locking a bike up, and twice broken on the ground. Pretty bad recommendation. So the bic method of picking a lock only takes a simple tool... bike thieves can and will get whatever tools are necessary, and as long as they can get in and out fast they don't care much if it's obvious theft.

Anyway, calling me names won't improve the security of your bike. I only posted because I've had one stolen myself, at a time when I absolutely couldn't afford it, it was a terrible experience, and I want to encourage people to lock their bikes well and not buy some cheap lock in a panic.

If you want to avoid kryptonite, you can probably find another good case-hardened chain and a decent padlock. Non-case-hardened chains (including most hardware store stuff) mush like butter under the jaws of a bolt cutter. I'm not sure who else makes them for the bike market, but I know I've seen a couple out there. They aren't cheap, but neither is replacing your bike.

Nanojath's post about how this works is pretty much correct, though I don't think the malleability of the pen makes that big a difference, as long as it can grab... it's more about just moving the pins back and forth while providing enough twist that you can get a minute amount of rotation when a pin is in the right place... thus the "twist and wiggle" recipe. Picking "normal" locks isn't really any harder except that getting to pins inside a deep narrow slot takes slightly more advanced tools, e.g., a paperclip, with a sideways press against the bottom of the key slot from a pencil point to provide the rotational bias.

Anyway, flame me all you want, but be realistic about what a lock will and won't do for you. Most of them provide sadly little security, and having to add a big chunk of the krypto lineup to that category is nothing earth-shaking. People used to thing U locks were all unbeatable, until someone figured out that they can almost all be popped off with a little leverage. The info got out fast, and .... people still use them, they still sort of work, and from time to time they get broken and a bike is stolen. I just don't see how this is so different.

And for the record, do not, I repeat, do NOT go to ATA Cycle.

Sorry, I forgot to mention that this is ATA Cycles in Cambridge, MA.

at this point i would prefer ANYTHING to the bictastic kryptokrap i have right now. heres why: I AM NOT AFRAID OF BIKE THIEVES be they fancy unemloyed locksmiths gone bad or sadsack junky street kids desperate for their next fix. what i AM scared of is BIC PEN USERS who dont give a shiit about bicyclists or bike culture and the code of the land that says stealing someones bike makes you lower than a worm. for example, the university college kid be they jock or stoner or whoever. they pass my bike and say 'ha i heard about this on the net. i wonder.....' and just like that my bike is gone.

no right now i am mostly glad i have a fixed gear w/o handbrakes, and clipless pedals w/ rather small platforms. even if they get through my 'kryptodefense technology' with their writing instruments i dare them to make a quick getaway.

by the way nice work fixie forum for being at the forefront of danger and security simulataneously! we rule. :p

Just came across this thread from MTBR, so I grabbed the 10year old Kryptolok out of the back of my truck and guess what.. took about 30 seconds to open it. Not earth shattering but disapointing anyways.

I just registered to post on this thread..
Really suprised nobody had taken "Brandon" already, same name on MTBR.....

I just noticed kryptonite's now offering 4 years of anti-theft protection. Looks like they recently put it up cause I didn't recall seeing it yesterday.
http://www.kryptonitelock.com/images/ATPCoupon.pdf

Ps. Probably many more people read this forum than ever post on it. A fair amount of the internet community I normally post at happen to be on here also and I didn't realize it until today. This is the kind of issue that is going to snowball and it started here so expect many more first time posters.

I heard about this via an email from the Bicycle Kitchen in Los Angeles. No word yet on how successful anyone there was in attempting this.

I'm hesitant to try it, as I only have one U-lock and no funds handy to replace it - don't know if I could lock it up again if I succeeded.


You mean you think this ought to be in a more-widely-read, less-specific forum, too?
As a mototrcycle/scooter rider who uses his Krypto to secure his easily-hotwired ride, I think that yes, this *IS* information that goes beyond bike-forum specific.

BTW - the old aphorism is apropos: "Locks keep honest people honest."

I DECLARE SCHENANIGANS!

The lock in the picture isn't and evo, look at the picture, when the lock is opened the bottom of the U is not bent. Kryptonite locks have a bend at the bottom. I dont know why you would want to freak people out about this.






Well, I don't know what side of the bed you woke up on, but that lock is a Kryptonite. It uses the same standard locking mech. as most all kryptonite locks. The double-locking shackle was supposed to be more secure.

See my picture with part of the R.E.Load sticker removed.

Oh, and yes, Kryptonite - I am available for interviews at your convenience. B.S.M.E. with internship in the cycling industry and experience in machine design.

I just talked to absntr...

He has a friend who has a new, having been bought very recently, krypto mini lock. He said it appeared that the diameter was a bit smaller on this lock than his *older* mini. I know this doesn't really solve anything because you could just use a smaller pen or create your own pen out of random scrap.

Really I'm checking this thread way too much lately. It makes me think that this is getting a little bit out of control. Of course it's a big deal, but really ... Yeah it would suck if someone stole my bike. I guess I'm going to go back to my huge chain and lock. And yeah it sucks that we have to carry around a chain that weighs as much as a bike (at least my pants will never creep down anymore), but I'd rather do that than have someone swipe one of my bikes. Even my beater fixie, actually especially my beater fixie.

We can't live in a mini u-lock because it fits snuggly in my back pocket bubble forever.

Maybe I'll make a mobile out of all my old u-locks. I'm feeling artsy. At least they won't be thrown away.

My friend from Australia just e-mailed, it's made it to the other side of the web. So funny, she starts off with, "Hope you haven't seen this yet..."

Oh yes I have. Since Sunday night.

Making news unaesthetic, making news baby.

those videos have been downloaded twenty-five thousand times in the last 24 hours.

Nice... If you need a mirror, let me know, I am sure there are a few guys here with dedicated servers who can help out.

I have been hammering this thread on each update, but that's because I use a bike as my main for of transit...and right now, of all my bikes, only one is in servicable shape...if it gets stolen...I have little means outside of the bus or other gas-guzzling menas to get groceries, and do the things I normally do. This would put even more of a financial damper on me than merely replacing the bike...i have to have 100% trust in the lock being of solid design.

now I do understand that NO lock is thief-proof, however I would have expected the lockmakers to have people to probe and pick at their locks, so by now they should have already known about this. Heck, in the software industry often they hire contractors to try to hack into their own software, and then give them a report on how it went, so they can be assured of a reasonable level of security.

Jamming a pen into the lock is not a skilled task, it just takes luck. This is what scares me, 7 pins, many are the same height, prolly only about 100 or so combinations once you account for mechanical slop that is present in most frequently used u-bolts...and well you see why its so bad.

Really this has left me with an upset sotmach all day...I really need to buy new locks, and soon...that way they can't jsut take a bic pen and possibly get my bike.

Yeah.. news, no doubt. I've been contacted by a bunch of friends who I told this to yesterday and who are now seeing it pop up on all the really popular portal sites (a lot of them linking your video, most linking bikeforums).

I was contacted by one news person so far, but out of respect for Kryptonite and their unfortunate situation; I've decided to give them a couple days to make it up to me before doing any interviews (I was kind of kidding about being interviewed earlier but I guess there is actually interest)...

I'll keep you guys posted. I've still not personally heard back from Krypto even though I've heard a few people have.

Oh, and until then how about you guys direct some of this traffic over to my new website! http://collectornerd.com/ hahaha

Cheers.

What bothers me is not that the lock can be picked (all locks are pickable) and not that thieves can use other techniques against any lock. The thing that bothers me is that now any kid can take his cheap BIC pen and pick up a new bike on the way home from school. The average person does not have easy access to specialized lockpicking tools but everyone has access to BIC pens.

The number of potential thieves has skyrocketed overnight. I'm glad I use a flat key lock and do not live in New York or any college campus.

If the video-hosting people are getting hammered, you should try FreeCache. Just change the URL to http://freecache.org/http://thirdrate.com/misc/krypto.mov and FreeCache will take most of the traffic.

Note that freecache won't take over until it recieves a certain number of requests. Until then it just redirects to the target server.

Update: freecache only caches files over 5MB. So I guess that won't work.

Alternatively, use bittorrent!

Burn, baby! BURN!!! HA! HA! I sort of wish I had a fire to dance arouns right now. No, I do not know why.

The number of potential thieves has skyrocketed overnight. I'm glad I use a flat key lock and do not live in New York or any college campus.

But having lived in NYC I knew NEVER to trust U-locks. And then I moved out to the sticks ... I mean Chicago and decided I could return to my u-lock because, hell, it's a lot easier and lighter to carry around. I think most riders in NYC who lock their bikes up outside for any period of time will agree that a good quad chain with a really good lock is the only way to go. I was just lamenting over the idea that the NYC philosophy will finally have to be applied everywhere. Yeah, it really does suck that some punk can mosey on by a rack of bikes and be like a kid in a candy store and pick whichever one he/she wants.

To give credit to the krypto people, they were really nice when I called earlier today. I think unaesthetic is doing a really good thing by not going on record with the press yet. Hell even if he mentioned that they (krypto) were being professional the press people would probably edit that out in an instant.

And shed no tears for kryptonite, they still make really good chains which I'm sure there will be a run on shortly.

I have only gotten my dad's kryptolok to go 1/8 of a turn and I can't get it to go back...

MTBR

http://forums.mtbr.com/showthread.php?t=48182

http://forums.mtbr.com/showthread.php?t=48142

I heard about this thread from the first post.

Yes, I just registered to post this.

My jaw dropped when I saw this at first. I tried it on my new New York Chain (5') with EV disk lock. The lock has a round tumbler (unlike the Fahgettaboudit). After a little fiddling I opened it with NO problem. I was so upset I rode right to my local bike shop (Westchester Pro Bike Shop, Westchester Square, Bronx, NY) and showed them my BIC key.

I used the universal BIC key to open up one of the shop's U locks that were on the wall. Needless to say, that opened. The owner and store mechanics were as upset as I was and the customers around me.

As New Yorkers, we'd all known and respected those products and suddenly they were junk. They are Junk. You cannot start an AUDI with a paperclip and you should not be able to open a lock with a pen.

I'll be calling Kryptonite tomorrow and requesting a Fahgettaboudit lock to replace mine. This clearly isn't an issue of defective parts or a poor batch. It's a product that is now worthless. Those joking about getting a new bike had better consider that they themselves are acting fraudulently and (in NY) are stealing from others whose bike are covered by a special insurance policy.

Kryptonite is obligated to do something about this, including a recall and replacement with something that is secure and will be covered by their insurance policy. This could go as far as a class action lawsuit (How many people have read this? How many locks were sold that are now useless?)

Expressing concern for Kryptonite as a company is something most feel initially, however Kryptonite isn't some small company in MA. It's part of Ingersall-Rand, a huge multinational that is obligated to make this right.

If someone else doesn't go to press with this soon I'll be disappointed. For the reaction on the web alone this is something that I'm sure the NYT would love. What about when Ingersoll-Rand has to make due with this problem? I should go and short the stock tomorrow morning. On second thought they are still selling lots of other security products that are more than covering this Kryptonite F-up.

I am a cancer researcher, bike rider, former professional bike mechanic and foremost a pissed off Kryptonite Customer.

I'll be emailing the NYT editorial Staff tonight along with others. I'll be sure to credit this forum with my inspiration.

Just forked over $100 I don't have for a Master Lock Street Links (nice and flat regular key), similiar to the Fahgettaboudit (staying away from Kryptonite for now), something like 8 lbs (I guess it can only make me stronger?) And yeah, all locks are defeatable, but someone who's determined and qualified enough to undo this thing will have my bike anyway, I just don't want to give it away to some punk wielding a bic.

well just got home and tore up 2 or 3 bics, and my hand - guess I need to start working out. the result is that it works - but if you're going to try it make sure you go all the way or you jame the cylinder.

this proves the adage - keep it simple stupid. we're all devising new high tech methods, and the thieves are in the stone age! remember wwIV will be fought with sticks and stones.

Once again I feel like, at least for my own sake of mind, I have to clarify my thoughts...

Kryptonite makes a good chain but without the lock. Toss the lock that comes with the chain and pick up something of better quality, less able to be picked etc.

Call me a mushy sap but I still think the krypto people need to sort their s*** out before we go ballistic. Yeah now in hindsight it seems like a no brainer that something like a bic can be used to pick the lock. BUT none of us have thought of it before, or had it happen to us, and how long have these locks been on the market?

15+ years.

FYI, my key number is KK####

if you've tried to crack it, please post yours!

First try 2 minutes. Second try 30 seconds, now less-adding teflon chain lube made the proccess FASTER . Same bic pen.

Yellow EV2000 disc key series KK####.

This bloody blows chunks!

(Yep, just registered so I could post this. )

I hate to break up the Kryptonite Bash Fest, but I just applied the same method to two other brands of locks with cylinder type keys. Both worked, with slightly variations. The white pen portion of the BIC did not fit on one, but the cap conveniently fit after breaking off the part that holds it to your shirt (had to break of that part and trim the buldge off). It took me about 5 minutes of fiddling, but it unlocked (and locked). I'm sure with a little practice, and perhaps a better "pick," it would be similar to the Krypto.

Just to be fair all around, I can also pick most flat key locks in less than a minute with a homemade pick (made out of something everyone can easily find). Until the recent special keys (computer chips, etc.) I could get in and start most cars in under a minute. Houses even less.

Locks help keep honest people honest.

So, I don't think I've written anything inflamatory, but flame if you must.

GASP! My friend just showed me the mov of my EV disc getting opened...And reading thru this thread shows many KK#### locks have been defeated. I have the KK :(

I think i'll give Kryptonite a call tomorrow to see if I can get my name on the list. I've had this chain for 1 1/2 years, I hope they dont leave those of us who haven't purchased them recently out in the dark :(

I called Kryptonite today and asked if they would refund my money as the lock is just over a month old. The lady I spoke with was nice and give me the line that they are working on the problem and will get back with me. I told her that I would call her if i did not hear from her in 2 weeks. THEY WILL WANT YOUR KEY NUMBER WHEN YOU CALL.

BTW, when I told her why I was calling I think she said "Oh sh#$". It was kind of funny except that I wasted $40 on the lock and I doubt there is any "fix" other than buying a new lock.

Class action suit? The good news is that if you forget or lose your key all you need is a Bic pen to fix the problem.

If you cannot duplicate the problem I posted a previois message explaining how to do it. It took me all of 5 minutes.

Thanks to unaesthetic for the word on this!

Troll.

Speaking of which...I'm amazed this thread has gone on this long without anybody mentioning that Bic is a French corporation. C'mon folks, leave Kryptonite alone...blame it on the French.

Well I also can't open my NBA series Kryptolok. Locks in general aren't that secure, I've broken into offices, desks, my friend's house (he left his keys at home), etc. without too much trouble. The difference is usually it requires a little bit of understanding and practice and at least some tools slightly more advanced than a pen barrel. Still, these things happen. That's the way the true masters defeat security: attack from a completely unexpected angle. Lots of manufacturers didn't see this coming as evidenced by the fact that Krypto isn't the only one affected. For now I'm moving to a Kryptocable I have sitting around and thinking real seriously about the flat-keyed New York 3000. I'm going to wait a week or so to see what the long-term response is. This isn't going to bankrupt Kryptonite. I'm sure just like any well-run company, they buy their insurance from a proper insurance company who will bear the brunt of any claims filed as a result. Meanwhile, they issue a recall and most cyclists will be completely unaware of it, having not heard of it from the Internet.

PS: I didn't just register to post in this thread! :)

My sons has dorm insurance and the insurance company rep said to get a good lock for his bike. My wife said she told the rep that he had a Krypto and the rep said to get something else 'cuz they can open the Krypto in a second. Now the question is whay she didn't tell me that, but that is a post for another forum.........

Geez that is so easy. I've never tried to pick a lock in my life, but *have* used Kyrptonite locks forever.
Saw the video, took my "Trek Kyrponite" extra long u-lock and a Bic pen and 30 seconds later I had it opened.

What a joke, there was a post way back in '92 about this (Google Groups) and still it's just as easy. Literally zero skill is involved, you might need a hammer to bang the Bic into the key hole if you can't hit it against the ground.

I just unlocked my old Kryptonite lock from way back (1993?) using the now famous Bic pen technique. I used a Bic pen cap because it was the correct diameter. It definitely takes some jiggling to get the lock to turn and I have to hold very tightly on the pen cap after it's been inserted then twist and jiggle. Eventually the lock turns.
Lock model is Cyclepro from early 90's. Key number is 5XXX and has the letters "CDC" and then a logo with a C in it. Notice in the pictures that the cylinder is stuck in the open position and a key cannot be inserted because IT WASN'T OPENED WITH THE F***ING KEY! Great lock design Kryptonite. Thanks for wasting my time and money.

- fitz

FYI

An owner of a certain 'rapid' bike shop in Wicker Park (Chicago) has said that customers are coming in reporting locks with bic pens jammed into them.

This info is now out there ... be careful

I have a "Schwinn"-labeled U-lock I bought from Price Point a year or two ago, and I tried the Bic pen technique and it worked.

This issue is not unique to bike locks. Evidently, the same is true for the same style mechanism used to secure laptop computers:


Two security alerts have now been posted. One deals with the Kensington
key lock, and one with the Targus combination lock. Both are vulnerable
to extremely simple methods of bypass.

The Kensington cable lock 64038 can be bypassed by a technique called
impressioning. The end of a Papermate Flexgrip pen is utilized to move
all pin tumblers to shear line, simulating the key. This is a known
technique for opening axial pin tumbler locks, and is very effective
with this model. Within a few seconds, the tumblers are aligned by the
barrel of the pen, and the lock can be opened.


In light of this, when the time came for me to purchase my bike lock last week, I opted for a Kryptonite Kryptolok Combo. It uses a 4-digit combination which is easily set to a personal code using the small tool included with the lock.

Don't the Yakima rack systems and rails have the same type of locking mechanism? Has anyone tried to break open one of those?

Shawn

I hope you don't mind, but I put a mirror up of the .mov files and a link to this thread. You can pound away at comcast, they don't complain about bandwidth usage.

http://home.comcast.net/~phule/

FYI,

For those of you with NBA series kryptoloks, I played around with a BIC pen for a while. At first I thought that the barrel of the pen was too narrow to fit into the key chamber. Then, I applied force and stretched the pen diameter out to fit inside the key chamber...pop! The lock opened. Apparently no one with any sort of circular key lock is safe.

'Ok, now that we've griped, complained, moaned, and b*tched, WHAT IS A GOOD LOCK TO USE ON OUR BIKES? I think we've about done this thread to death, but it would be nice to get some recommendations about what we CAN do to protect our bikes.

Thanks!

Koffee

Just forked over $100 I don't have for a Master Lock Street Links (nice and flat regular key), similiar to the Fahgettaboudit (staying away from Kryptonite for now), something like 8 lbs (I guess it can only make me stronger?) And yeah, all locks are defeatable, but someone who's determined and qualified enough to undo this thing will have my bike anyway, I just don't want to give it away to some punk wielding a bic.




$100!!!

By coincidence, I was pricing some lock/chain combos the other day at a hardware store. They had 5/8" hardened steel chain, gold-ish color, highest rated bulk chain there, with a posted admonition to the flunkies working there NOT to try cutting with the hydraulic cutter. So I'm figuring decently hard stuff. Less than $5 a foot. The shrouded Masterlock padlock was about $12. I was thinking of getting three feet of that chain, stuffing it in a old inner tube, and using that exact same padlock. Less than $30.

'Ok, now that we've griped, complained, moaned, and b*tched, WHAT IS A GOOD LOCK TO USE ON OUR BIKES? I think we've about done this thread to death, but it would be nice to get some recommendations about what we CAN do to protect our bikes.

Thanks!

Koffee

Probably a nice heavy chain and a decent industrial lock with an armored shackle.

I have an On Guard U lock w/ a flat key I will try to pick tomorrow (Wednesday) so look back here for results, anyone who is interested in the On Guard. So far I haven't been able to find any weakness in it, and it was highly recommended at the shop I worked at previously. Haven't tried to pick it in earnest though.

Do we know if this technique works on similar models of different makes? ie. Master Locks version of the U-Lock??

(n00b - signed up to post this)

i did a search and didn't see a link to this movie. if it has already been posted, i'm sorry.

http://www.engadget.com/common/videos/pt/lock.wmv
http://engadget.com/entry/7796925370303347/

this thread has also been linked on boing boing so that is why you're getting lots of traffic.

flame on.

NOT ALL ACE LOCK

Yes, the Kryptonite 2000 lock is poorly make & it can be defeated there to much play tolerance in the lock.That why it can be bypassed. The reason why I know is that I'm a locksmith for past 35 years.
With my pick the Kryptone 2000 or the CHEATER one from over sea Open maybe 10-30 second. The better one can take 10-15 minute w/my experience. If you want one of the better lock {ABUS} you will have to pay big $$$. Bic pen work best on the barrel lock we call .360 dia the larger one .370 dia that is why the larger barrel one people harder time getting the Bic pen to entry the lock w/o force.

what makes the kryptonite chain so special? yeah i am going with the local hardware store chain myself.

what makes the kryptonite chain so special?

"Kryptonite Quad Chain: It's heavy like any other three foot chain, but the square link design (quad chain) makes it harder for bolt cutters to get a good angle on the chain. Just like a krypto chain is essential for an NYC messenger so are bolt cutters to an NYC thief. Quad chains force a bolt cutter's blade to put pressure down on at least one corner of a chain link. A thief risks denting the blade of his cutters by trying to clip a quad chain."

http://www.nybma.com/faq/question3.htm