EDIT: back from sleep, ready for more questions.

Hi,

I started a non-profit that focuses on educating the public on matters of physical security such as locks, safes, card access, etc. I filed for our tax exempt status myself (no lawyers), and started the group with a handful of friends. We travel the country doing lock picking villages and other training events. I also happen to work in information security, doing penetration testing and threat intelligence. Ask me anything!

Proof: http://i.imgur.com/bwisC33.jpg

More proof because people are skeptical of an official document sent to me by the IRS and apparently twitter is a primary source: https://twitter.com/lockFALE/status/543603941347713024

EDIT: couple links to some lockpicking resources!

http://www.lockpicking101.com/

(pdf) MIT Guide to lockpicking

Comments: 69 • Responses: 27  • Date: 

ismellliketuna7 karma

I'm gonna be purchasing a motorcycle soon and was wondering if you had any tips for keeping my bike secure, I've looked at a number of things and don't really know where to start?

melvin200112 karma

honestly there is no good way to secure a motorcycle (sorry), anything that can be picked up and placed onto a truck is inherently insecure. there are some REALLY good lock brands (abloy, medeco, mul-t-lock, etc) that make excellent shrouded padlocks. That and a big ass chain goes a long way.

other than that you are looking at electronic measures such as lojack or something similar.

EnderBoy4 karma

A big ass chain didn't help Pee Wee.

melvin20019 karma

he also takes his big ass chain out and public and swings it around

lance_cavendish7 karma

How can I learn to do this? I like the challenge of building/taking apart subtle mechanisms i.e clockworks.

melvin20018 karma

It's crazy easy. there are a few sites that sell lock picks, if you would like details PM me and i'll get you some resources (dont want to be accused of advertising). i'll also post some links to some tutorials in the original post because i assume this will be a popular question!

lance_cavendish3 karma

I would love details about what to buy and where to buy it

melvin20015 karma

i'd prefer not to link directly to places to buy so i don't get accused of advertising or anything ridiculous. feel free to PM me.

as far as WHAT to buy, don't get too hung up on the number of tools you get. you'll end up using 5 or 6 of the tools for 99% of the locks. there are 2 main things you need to pick, tension wrenches and picks. Tension wrenches (torsion wrenches if you want to be a neckbeard about it) do the turning, picks do the lifting, you will want a handful of each in different sizes. as far as types of picks, there are "single peaked" picks and "multi peak" picks. Single peaks are called single lifters, and used for manipulating a single pin at a time. Multi peaked picks are called rakes, and used for manipulating multiple pins at a time. you will want a few of each, in different sizes and shapes.

other than that, its all personal preference. i really prefer spring steel over stainless because spring is tougher, and gives better feedback. stainless is softer, but wont rust.

NorbitGorbit5 karma

how difficult was it to establish 501c3 status? any recs to follow?

melvin20015 karma

its a pretty awesome combination of weirdly easy, and super confusing... It takes a LOT of documentation, some of which you may not have. We started FALE (on paper) this year, and the IRS requires 3 years of projections for how much income you will have, and it has to be itemized by source, and anticipated expenses. how the hell are you supposed to project out 3 years when your organization has only existed for a month???

You literally end up making up numbers, based on what you know, or expect. after that a lot of the stuff is just articulating what you are doing, in terms that the IRS "accepts" as being a tax-exempt activity. It was about 70 pages of documentation, bilaws, etc, and took about 2-3 weeks to put together.

Cyrano_De_BIRDATTACK3 karma

Cool organization! Two questions:

  1. How difficult is it to pick an average home deadbolt?

  2. Would your autobiography be called "Destined to FALE" or "Epic FALE?"

melvin20018 karma

1) most people that can pick locks with what I would consider "some level of competence" can pick the "average" residential grade deadbolt in under 5 minutes in most cases. Lock picking takes advantage of some really neat manufacturing tolerance issues, so literally every lock is different, even locks out of the same package.

2) "Already FALE'd but my mom is still proud of me"

3AlarmLampscooter2 karma

Assa-Abloy: their shit really secure?

melvin20017 karma

some would say they have their shit on..... lockdown.

LouisSeize2 karma

What is the most pick-resistant cylinder sold in the United States today?

melvin20013 karma

I'm a pretty big fan of abloy protec. The company seems to rapidly address any issues, and the locks are built to ridiculous standards. The US government uses medeco locks for basically everything, but these have been picked by a pretty elite handful of people. keep in mind things like..... whats weaker the door and lock or the 3/4" sheetrock next to it.

LouisSeize1 karma

In that case, how would you compare Abloy to Medeco to Mul-T-Lock?

Also, what are your views on a) restricted key blanks; and b) quasi-mechanical/electric keys, e.g. the Cliq variant?

melvin20011 karma

so abloy, medeco, and mul t lock all work under different premise, with mul t lock and medeco being sort of not really similar.

Mul t lock uses a pin-in-pin system, there is an outer pin sleeve, and an inner pin, and tons of serrations and nastiness. i would say these are probably my least favorite of the locks i would actually buy.

medeco uses a rotating pin system, basically there is a slot cut in the edge of the pins, and the pins have a spade shape rather than round. the spade shape sits in a groove cut in the key, and when rotated to the proper direction, the slot in the pins all line up, and allow a sidebar to slide into the slot. its kind of hard to describe, but you can google some cutaways.

abloy uses disk detainers rather than pins. the key is shaped that as it rotates, it rotates the disks into position, and a bar can drop into notches cut in the disks. this is A LOT like how a safe door operates.

I think the disk detainer design is better overall, and abloy improves on the basics with their ridiculous quality control.

Human_Monkey2 karma

How long does it normally take for an average person to learn to pick a lock of a money safe?

melvin20011 karma

"money safe" is not really a good description, if you are talking about some residential garbage like a sentrysafe, you are looking at learning in probably... 10 or 15 minutes. if you are talking about an actual commercial grade (group 2 or group 1) safe, it takes a lot of time and training to open one non-destructively. they can be opened in minutes with some good tools and drill points in a destructive manner.

edit: it should be noted that if you are talking about a safe with a key-override, they are generally garbage, and not that hard. there are of course exceptions.

working1012 karma

I have a sentry safe... Hearing you refer to it as garbage has me wondering... Are there any safes you recommend for residental use for under 500 dollars?

melvin20011 karma

they are indeed garbage.

https://twitter.com/lockFALE/status/467744075643224064

check out this picture of a girl that had never picked locks before and her posing with a sentrysafe moneybox and our butt dildo.

you should be able to get a gardall or something similar in that price range, honestly your best bet is to find a local safe dealer and talk to them since shipping tends to be ridiculous and you'll end up wanting to source it locally anyway.

edit: i should mention that safes have UL listings, group 2 and group 1 safes are usually pretty decent. I would still avoid anything you buy at lowes or home depot.

josephtutora2 karma

How can I truly "lock" something, so that no one can move it/take it. For example: a bike, or the lock on a box of private documents?

melvin200111 karma

you can't.

basically security comes down to 2 categories.

  1. Tamper Evident
  2. Tamper Resistant

What this means is with tamper evident the goal is not to keep someone out, but its to know that someone got in. lots of things are link this.... an envelope is a simple example. or the plastic nonsense they put on your power meter.

Tamper Resistant on the other hand, the goal is not only to know that someone GOT IN, but to keep them out Long enough to respond. That last bit is important.... you'll never keep someone out forever. The goal is to do a risk assessment, determine the length of time it takes you to:

  1. Identify the threat exists
  2. Determin the appropriate response
  3. Implement the response
  4. Response stops the threat

this means if you know that someone will walk by your bike, on average 15 minutes... and it would take 5 minutes for them to identify the bike is being stolen, 10 minutes for the police to show up and stop the guy.... you realistically need to keep them out for like... 30 minutes.

buy a good lock :)

All this is good THEORY, in reality you just need to have shittier stuff than your neighbor, so people rob him instead.

AlwaysUnreliable2 karma

How did you become a penetration tester? What led you to do it? Were you interested in it from a young age?

melvin20012 karma

I actually got my gig as a pentester from doing training at computer security events. My dad installed security systems, so i learned to bypass them. I started FALE, and we got invited to do some presentations. People started to recognize me as a lock guru and people needed physical security assessments. I had always been into computers and (bypassing) security is just a passion. I started picking when i was 14 or so.

cmac30452 karma

Does the thought of one of the people you teach using your lock picking techniques for less than legal activities, enter your mind at all?

melvin200111 karma

All the time. Fact of the matter is that lock picks being used for actual crime is CRAZY low. generally speaking burglaries are smash and grab. the only incentive to pick locks is if covert entry is a MUST. it's a skill that requires some level of training (albeit very minimal to START), and will always take more time than throwing a brick.

This being said, working in the security field i despise security through obscurity, which is essentially the concept that something is secure simply because people don't know how it works. This model has been shown time and again to not work, the only way to know if you are secure is to learn!

cmac30452 karma

Thank you!

melvin20015 karma

no, thank you my Oreo internet friend.

DrRectangle2 karma

Why did you start FALE?

melvin20013 karma

I wanted to drink beer, hang out with my friends, and talk about security. It turns out there are tons of people that are interested, and we sort of fell into the gig of educating people on physical security (we got invited, and said what the heck!). Turns out we love it, and kept doing it!

TurnipCannon1 karma

I wanted to drink beer, hang out with my friends, and talk about security.

Exactly why I started mine!

melvin20014 karma

did we just become best friends?

Lynchie242 karma

What percentage of lock pickings are legal?

melvin20012 karma

there are no really good statistics on the matter because the numbers are extremely low, and most municipalities do not report on the specific implements of a crime. For example what percentage of break ins used a brick? what percentage used a crowbar?

ThickPiss2 karma

Firstly I think what you're doing is great and don't want to come across as being a dick but... In this comment you said that percentages are not really known how many are illegal but in other comment you used the term "crazy low". I believe you in saying that the average burglar in thick a pig shit but your message confuses me. Do you know it's low or is it healthy denial to keep you feeling okay about what you're doing. Really not trying too offend.

melvin20016 karma

yeah its like stormy_rawr said, there was huge media attention given to bumping, and it happened literally a handful of times so the media attention died out. theres no incentive to pick locks for a crime.

EDIT: I thought about this a little more and i figured i would mention that as with anything (religion, life, etc) I could be delusional, and would love evidence one way or another. my gut tells me that the percentages are very low, there are NO GOOD STATISTICS either way. lock picking crime by nature is more difficult to detect than a smash and grab, and therefor VERY LIKELY to be underreported. I would love for some actual research to go into this, and a good friend of mine is looking at ways to answer this question properly. Never apologize for asking me tough questions, I would love to be proved wrong. I learn more from my mistakes than my successes.

manthello2 karma

Do you play Skyrim, and if so, what level is your lockpicking skill?

melvin200111 karma

i only pick locks in real life simulator. the graphics are great but the story is kind of depressing.

agentdarko1 karma

Where's a good place to buy bump keys, and what do we need to know when buying a set?

melvin20011 karma

theres a few places, i dont want to advertise for anyone in particular, feel free to PM me and i'll shoot you some places.

The best thing to know about bump keys is they can damage locks pretty easily, and you are better off learning to pick.

Jimmybullard1 karma

Teach people to pick locks..as a skill to build a career?

melvin20013 karma

Really our focus as a group is to make people more educated about their security. One of the ways we do this is by showing how trivial it is to pick many locks. if a novice can pick up a set of picks, and with 15 minutes of practice pick a masterlock consistently under 5 minutes is the problem the lock or the fact that someone showed them how to pick?

Tetragramatron1 karma

What do you think of the toool emergency lock pick card and limited edition defcon set, available here, as a backup or EDC?

What is a good metal stock to use to bend your own picks that is easily available? Street sweeper bristles aren't common in my area.

Do you have a good resource for determining legality of picking and carrying picking tools in different states/ cities/ countries?

Do you have any interest in forced entry, for example using halligans, etc.?

Do you ever think of picking in terms of emergency preparedness? Like say you are trapped in a burning building and the only way out is a locked door.

Hoping you get to these, thanks for doing the AMA.

melvin20011 karma

wow lot of questions here, lemme make sure i get to them all.

  1. I think the break away picks are a GREAT backup, but a TERRIBLE primary set. The metal is soft, the handles are trash, and they tend to have burrs from the removal tabs. All that being said i would take them over some improvised bobby pin or paper clip picks anyday.

  2. as you mentioned a lot of people use street sweeper blades, I personally prefer hacksaw blades (cheapest you can find, never use bi-metal blades, they break). some people use the metal stiffener from old wiper blades, auto parts stores usually have a ton in the trash outside on rainy days. this metal tends to be kind of soft, but it works. Some people like to use "feeler guage stock", but i have never found a good source for it so i dont use it.

  3. the BEST resource is for sure is this page from TOOOL http://toool.us/laws.html keep in mind it may be out of date in some cases so you MUST look up and read your states statute yourself and validate. As for international im afraid i wont be much help, i would reach out to some international pickers on lockpicking101.com and ask for help

  4. yes, i have a LOT of interest, check out this series on youtube, its silly https://www.youtube.com/watch?v=NemNhkF4ZV4

  5. Honestly emergency preparedness is not really something we have worked on much, as its outside most of our expertise. Personally if the building is burning down i would not want to have to rely on ANY of the FALE guys to save my butt. If you need someone to break into a building, social engineer their way to the server room, hack into your old ass mainframe and steal your companies financials then we have the crew :)

twirap1 karma

Hi,

Is it possible to pick a medeco lock? How would you apporach the challange of trying to pick a medeco lock?

melvin20011 karma

Like any other lock, with a few exceptions. first, medecos are really well made locks. second, they have a sidebar. First, remove all the pins and the sidebar. Start by putting one pin stack back in place, and pick that with no sidebar. then put the sidebar in and learn to pick it with the rotation aspect. Then do the same for 2-6(or 7) pins.

needanacc0unt1 karma

[deleted]

melvin20011 karma

I have a kwikset on my house. You are better off locking your doors, getting some decent anti-theft coating on your glass (doors,windows) and getting a dog and some good exterior lighting than worrying about your home locks. Homes were not designed to be protected, they were designed to look pretty, and keep you dry when it rains. also buy cheap stuff so people rob your neighbor. that being said, i'm a pretty big advocate of businesses protecting their stuff. Their buildings CAN reasonably be protected if they take steps, schlage makes a lock called the schlage primus thats pretty decent, I can pick an everest in about the same time as any other decent lock. check out https://www.thinkpeterson.com/tensiontools.html to see why.

whereistehnarwhal1 karma

why did you get fired from BSidesLV?

melvin20013 karma

you.

Eternally65-5 karma

That's pretty sketchy proof, friend, because anybody can link to a website. Do you have anything else?

melvin20016 karma

sure what would make your heart super happy.