Level responds to lock picking claim, says Level Lock+ exceeds standards

AppleInsider

The developer of Level Lock+ decries "exciting headline" about lock picking, and says that its device has been granted the best grade possible in every category by the BHMA standards body.

Level's response comes after a YouTuber demonstrated picking the Level Lock+. As reported by AppleInsider, the methods used were the same tension tool and bump key approach that works on regular locks, and Level confirms that.

"For compatibility, Level uses a typical type C lock cylinder from a major industry supplier and is commonly available in hundreds of lock brands on the market," said the firm in a statement sent to AppleInsider. "It's no secret that any consumer grade lock cylinder can be readily picked by those with some expertise and tools."

"The only way to limit vulnerabilities around the keyway is to remove it entirely," continues the firm. "That is an idea we continue to consider closely though the vast majority of customers prefer the comfort of the keys they have been used to for decades."

Regarding the lock hardware, the company reports that "we have received the BHMA [Builders Hardware Manufacturers Association] AAA rating for strength, durability, and finish."

Furthermore, Level says that lock picking "accounts for only 4% of home break incidents.

"While it makes for an exciting headline, homes are broken in most via open doors and windows, or forced entries," says the company. "Level products help minimize home break-in risks with Auto-lock settings at your control -- a feature that no analog lock can match."

These auto-lock settings, again as reported by AppleInsider, mean that a Level user will be automatically notified when a lock has been opened.

Read on AppleInsider

TechnoTacno

It’s alarming that the BHMA has rated a lock that can be picked in seconds with a AAA rating. 

How can a consumer find a secure lock if the rating suggests AAA and can still be picked in seconds?

jayweiss

A lock is a device for keeping honest people out. A criminal WILL break in if they really want to. 

chadbag

TechnoTacno said:

It’s alarming that the BHMA has rated a lock that can be picked in seconds with a AAA rating. 

How can a consumer find a secure lock if the rating suggests AAA and can still be picked in seconds?

Because for a consumer type lock it meets the criteria.  It seems almost all consumer locks “suffer” from the same deficiency:   A professional can pick a consumer lock relatively easily.  Regardless of brand (not a “Level” issue exclusively).  

retrogusto

To me the point here is that it’s a lot of money for a lock that provides a relatively low level of security. To be this easily picked, it probably doesn’t have a lot of pretty standard security features that you can find even on some very reasonably priced locks, such as spool or mushroom pins that require more skill to open than just a quick rake job. And I guess if they didn’t bother with that, it probably also doesn’t have any hardened steel shielding that would make it tougher to drill out. And for a fraction of this price, you can get something like a Medeco which is extremely difficult to pick. 

As others have noted, most people will be fine with a low-security lock, and others can swap out the cylinder for something better if they need to and are aware of the issue, but at this price people might assume that they are splurging for good security.

maury markowitz

TechnoTacno said:

It’s alarming that the BHMA has rated a lock that can be picked in seconds with a AAA rating. 

How can a consumer find a secure lock if the rating suggests AAA and can still be picked in seconds?

Almost all locks can be picked in seconds. All you need is the tool. The high-security locks for homes generally add security by making the keyhole have a weird shape so the pick won't fit. So the Norman, for instance, uses a key that looks like an S in cross-section, so a normal flat pick won't fit into the curved slot. But that's it, after that it's the same mechanism. So all you have to do is use a different pick, which is why you have a lockpick SET, not a lockpick.

There's a great article on the topic here:

https://books.google.ca/books?id=x3YlRSphAaMC&printsec=frontcover&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false

Go to page 128. "Ninety percent of all key cylinders sold can be picked in 10 seconds."

But much more important: only 10% of illegal entries are unforced, and the vast majority of those are using a copied key - like the one you gave someone you trusted.

The idea that you're losing security by using a standard barrel is simply not an issue. Every house around you has one of these locks - how many of them have been robbed by someone picking the lock?

maury markowitz

retrogusto said:

To me the point here is that it’s a lot of money for a lock that provides a relatively low level of security. 

It provides exactly the same security as the lock you have on your door now. It uses the same cylinder. Did you replace your cylinders with a higher security one? No? Then you don't really care.

And you can totally swap out the cylinder in this lock, it is the entire design concept.

I don't know why people keep failing to mention this in the articles. The entire concept of the Lever is that it fits into a totally standard cut out and uses a totally standard cylinder. The original sales concept was to sell them without any hardware, and you would simply insert their bits into your existing lock. Now they add an actual physical lock, identical to the one you have now, and everyone's freaking out.

chadbag

What do I search on if I want to look at alternative cylinders?   I’ve tried searching but don’t know what terms to use.   We’re building a house and will need all new locks and (regardless of the “Level” brand) I’d like to inform myself of the various options and pros/cons and costs.  

maltz

chadbag said:

TechnoTacno said:

It’s alarming that the BHMA has rated a lock that can be picked in seconds with a AAA rating. 

How can a consumer find a secure lock if the rating suggests AAA and can still be picked in seconds?

Because for a consumer type lock it meets the criteria.  It seems almost all consumer locks “suffer” from the same deficiency:   A professional can pick a consumer lock relatively easily.  Regardless of brand (not a “Level” issue exclusively).  

That's sort of missing the point.  Yes, nearly ALL consumer type locks are crap.  But making a decent quality lock isn't hard or expensive - that's what's so galling about locks like this, especially at these price points, and is kind of the raison d'etre of LPL's channel.  We're not talking making it out of titanium.  Just add some security pins, maybe change the shape of the key way, and in the case of padlocks and such, give some passing thought to mitigating the well-known, low skill attacks that they're commonly susceptible to.  (shimming, striking, etc.)  It's not rocket science, it's just that no one bothers.

BTW, a rake attack such as the one this lock fell to is trivial - it hardly requires a professional or even specialized tools.  I've done it myself with a paperclip.  It's even more trivial to defend against in lock design.

maltz

chadbag said:

What do I search on if I want to look at alternative cylinders?   I’ve tried searching but don’t know what terms to use.   We’re building a house and will need all new locks and (regardless of the “Level” brand) I’d like to inform myself of the various options and pros/cons and costs.  

I was impressed with Kwikset's Smart Key locks.  Their claim to fame is that you can re-key them yourself in seconds with the original key, the included tool, and a new key.  It's got some fundamental differences from normal cylinders that make picking it impossible unless you're very familiar with how it works.  LPL has a video about it where he says it's "not that hard to pick" if you know what you're doing.  But he used an unorthodox picking method, and it still took him a full minute, which is an eternity for him compared to most residential locks.  lol  Older models were susceptible to being forced open with a screwdriver, but more recent versions have improved that.

It's still a residential lock, on a residential door, in a residential door jamb, so if someone really wants in, they'll get in.  But I figure it puts picking/raking/etc out of reach enough that other, less stealthy means of entry would probably be required if they're that determined.

To clarify - these are NOT smart locks, nor are the cylinders exchangeable with normal locks.  They're proprietary.  The "Smart Key" branding is just referring to the ability to re-key them.  (They may have a "smart" version of a "Smart Key" lock, for all I know, but I don't have them.  I'm not ready to connect the lock on my front door to the internet...)

TechnoTacno

I have just fitted a Yale TS007:2014 3 Star approved lock. Anti Pick, Anti Bump, Anti Snap, Fireproof. 

TS007 uses the handle and cylinder test that is already part of PAS24 – ie a 2min 30sec attack with tools (3mins when tested as part of PAS24 on a complete door set). It is only a test on the cylinder and the hardware around the cylinder though and does not cover any other part of the door.

This is the best (consumer) lock I can find. 

So yes, if someone wants to get in they will, but if it’s going to take 2 1/2 mins with tools to break open, then I’d take that over an ‘AAA’ rated lock that can be picked in seconds. 

My point though is that the test for ‘AAA’ is not fit for purpose.  May as well get an unrated lock if ‘AAA’ is only secure for a few seconds. 

laytech

This is a non-issue. All locks are the same. I’m sure many people who locked themselves out have been relieved when someone was able to open their door again it without destroying it.

However, what you do get with level lock is a notification your door has been unlocked, so even if someone hacked it, you would instantly know the door was unlocked where you would would not with a non-smart lock.

i love my level lock. The convenience has been fantastic and saved me multiple trips home when people have been locked out. I don’t give keys to visitors I give them the app. It’s just so good.

Xed

Not only did the Lock Picking Lawyer unlock their product, he also unlocked their butthurt in record time.

Xed

laytech said:

This is a non-issue. All locks are the same. I’m sure many people who locked themselves out have been relieved when someone was able to open their door again it without destroying it.

However, what you do get with level lock is a notification your door has been unlocked, so even if someone hacked it, you would instantly know the door was unlocked where you would would not with a non-smart lock.

i love my level lock. The convenience has been fantastic and saved me multiple trips home when people have been locked out. I don’t give keys to visitors I give them the app. It’s just so good.

1) If you've ever watched his channel "All locks are the same" is not even remotely accurate.

2) He tests very specific things. He doesn't comment about whether convenience aspects are worthwhile to a buyer or not. His videos re very balanced and without emotion.

darkvader

maltz said:

chadbag said:

What do I search on if I want to look at alternative cylinders?   I’ve tried searching but don’t know what terms to use.   We’re building a house and will need all new locks and (regardless of the “Level” brand) I’d like to inform myself of the various options and pros/cons and costs.  

I was impressed with Kwikset's Smart Key locks.  Their claim to fame is that you can re-key them yourself in seconds with the original key, the included tool, and a new key.  It's got some fundamental differences from normal cylinders that make picking it impossible unless you're very familiar with how it works.  LPL has a video about it where he says it's "not that hard to pick" if you know what you're doing.  But he used an unorthodox picking method, and it still took him a full minute, which is an eternity for him compared to most residential locks.  lol  Older models were susceptible to being forced open with a screwdriver, but more recent versions have improved that.

It's still a residential lock, on a residential door, in a residential door jamb, so if someone really wants in, they'll get in.  But I figure it puts picking/raking/etc out of reach enough that other, less stealthy means of entry would probably be required if they're that determined.

To clarify - these are NOT smart locks, nor are the cylinders exchangeable with normal locks.  They're proprietary.  The "Smart Key" branding is just referring to the ability to re-key them.  (They may have a "smart" version of a "Smart Key" lock, for all I know, but I don't have them.  I'm not ready to connect the lock on my front door to the internet...)

They do in fact have "smart" versions, including HomeKit compatible ones. 

And while Kwikset's regular locks are easily pickable, Smart Key locks are significantly more difficult to pick.  The easiest attack uses a camera that fits inside the keyway and lets you look at the sliders.  Once you've got that position info, you can cut a key.  Yes, that means special tools are required for the attack, though it's relatively easy if you have them.

I'm honestly not that concerned about connecting my front door to the internet.  An internet attack on my front door is FAR less likely than a brute force attack or even a picking attempt.

This Level thing on the other hand is inexcusably bad.  The raking attack takes a few seconds, just because Level didn't even bother putting in a single security pin.

the1maximus

No one is buying a Level Lock because of the security aspect of the key tumbler.  People are spending $200-$300 for the convenience of having a smart lock that isn't god awful ugly.  The key tumbler itself is a standard Schlage key tumbler, so if you walk down the aisle in any big box store and pick up a Schlage, the chances of you getting the same style tumbler is 100%.  The BHMA AAA rating for Strength, durability, and finish doesn't specify Pick resistance. 

https://www.schlage.com/blog/categories/2017/03/how-to-understand-BHMA-lock-security-grades.html

The main functions of this SMART LOCK is to be smart, they did not develop the key tumbler, so unless they invest in the R&D to develop their own key type and security the tumbler will always be its flaw.  With that being said, everyone goes and says Kwikset doesn't have this issue, huh, yes they do, in fact LPL has picked plenty of the Kwikset "SmartKey" locks, so if you put a professional lock picker up against ANY lock with the right tools, they can pick anything.  

beowulfschmidt

maury markowitz said:

retrogusto said:

To me the point here is that it’s a lot of money for a lock that provides a relatively low level of security. 

It provides exactly the same security as the lock you have on your door now. It uses the same cylinder. Did you replace your cylinders with a higher security one? No? Then you don't really care.

Pretty sure that is maury_markowitz' point.  It's exactly the same security, for a lot more money.  Whether the convenience features are worth that premium price is a different question which can only be answered by the purchaser, but the security features (being exactly the same) are arguably not.

Yes, it's true that one can spend even more money to upgrade the cylinder, but that's also true of a non "smart" lock.

Xed

the1maximus said:

No one is buying a Level Lock because of the security aspect of the key tumbler.  People are spending $200-$300 for the convenience of having a smart lock that isn't god awful ugly.  The key tumbler itself is a standard Schlage key tumbler, so if you walk down the aisle in any big box store and pick up a Schlage, the chances of you getting the same style tumbler is 100%.  The BHMA AAA rating for Strength, durability, and finish doesn't specify Pick resistance. 

https://www.schlage.com/blog/categories/2017/03/how-to-understand-BHMA-lock-security-grades.html

The main functions of this SMART LOCK is to be smart, they did not develop the key tumbler, so unless they invest in the R&D to develop their own key type and security the tumbler will always be its flaw.  With that being said, everyone goes and says Kwikset doesn't have this issue, huh, yes they do, in fact LPL has picked plenty of the Kwikset "SmartKey" locks, so if you put a professional lock picker up against ANY lock with the right tools, they can pick anything.  

That's a pretty weak argument for a device whose primary purpose is to keep someone not given access out. Case in point, the LPL has also done many tests on safes with biometric security. With your argument, the reason they buy those is that it's "smarter" by having a biometric fingerprinted reader, so you don't think it's a big deal that you can just stick a piece of wire in it to release the catch.

https://www.youtube.com/watch?v=w4SjajIO5qo

And that's not even the worse of them.

maltz

the1maximus said:

The main functions of this SMART LOCK is to be smart

No, the MAIN function of any lock is access control.  The fact that ratings systems ignore something as trivial to mitigate as low-skill raking and bumping attacks (much less actual picking) in their ratings just goes to show how half-assed the entire industry is in their craft.