Bjørn Madsen – Seattle's Maple Leaf Locksmith LLC

How safe are safes?

It isn’t often that news about safes and safe locks hits the mainstream. Recently it came out that Liberty Safe had provided a factory code to the FBI to open up a gun safe owned by one of the accused in the January 6th imbroglio.; not with a court order but with a search warrant. This is upsetting to people for two reasons, number one they didn’t know that there was any such thing as a factory override code and two because they think the manufacturer shouldn’t give out these codes, much less have a database of these codes.

Here is a photoshopped image attempting to conflate the Liberty Safe override scandal with the Bud Light endorsement of a trans activist and hoping for similar fallout to Budweiser losing huge amounts of money due to boycott.

Here’s possibly an upsetting fact for you: most safe manufacturers have factory installed override codes for their safes. I as a registered safe tech can call many of these manufacturers and for free or a small fee they will give me a factory unlock or reset code! Liberty Safe is not the only one maintaining and giving out codes to authorities with legal requests. It’s actually an industry standard! If you register your safe with the manufacturer they will probably give you such codes as well in your time of need. They have these not for the FBI but primarily for you when you get locked out.

Those of you with privacy concerns, dislike of government overreach, and also maybe those of you with illegal/quasilegal stuff in your safes may be asking yourselves what you can do to actually secure your safe from an evil locksmith or the FBI/ATF/whatever and the factory codes they can get from the safe lock manufacturer.

Following is information that, if you use it, will all be your own responsibility. I accept no responsibility for the consequences of anything you do. The following should be thought of only as a series of thought experiments.

The answer is that first, if your safe lock has these codes you should figure out how to erase them or buy an aftermarket safe lock and install it yourself and don’t register it. Then remove any identifying stickers from the safe keypad. These are used legitimately by people like me to open safes without any drilling. If you do so, it may void warranties and cost you more down the road if you lose the combination or there’s some glitch with an electronic safe lock. Be careful of what lock you get, a cheap one might be vulnerable to software developed that can open many electronic safe locks in minutes by bruteforcing the combination.

Better yet, if you want to be certain that nobody else can get into your safe buy a mechanical safe lock. There will only be one combination that you yourself can change. That of course doesn’t prevent automated safe dialers or people knowledgeable about how to do so from opening your safe. As an aside, mechanical safe locks are much more reliable than electronic ones. Despite lacking lots of the whiz-bang features of the battery powered ones, mechanical safe locks last for decades. Some are still going after a century. That just isn’t going to happen with the slapdash soldering and incomplete seals put over circuitboards in today’s manufacturing world. Something will fail. Even circuitboards made to go into space that are examined for every possible failure still fail sometimes. Lowest common denominator pricing guarantees that the failsafes demanded by the likes of NASA won’t make it to your safe lock which will likely fail in ten years or less depending on wear.

This fiasco has been a long time coming. Safe manufacturers have been playing with fire maintaining databases of key overrides. In the software industry we’ve seen time and again how social manipulation and network intrusion from hackers has yielded entire databases of customer credit card information before. How likely is it that safe manufacturers are using modern best practices to secure these override codes like salting, air gapping the computers with the database, etc? Or one rogue employee dipping his dirty mitts into the private database as seen with Twitter and Dreamhost in the past.

I have the ability to open safes without the override codes so it isn’t the end of the world for me if the safe manufacturers stop maintaining these databases. Of course it would make life harder and the customer would end up paying a lot more for an opening, but reading the fallout from this scandal it seems like there is a high demand for a safe manufacturer that doesn’t maintain a database of override codes. If you’re trying to lock the world out from your safe maybe you should demand that nobody can open the safe but you.

As long as you know about the factory overrides, people should make informed decisions about what they put in their safe based on what methods are available to open the safe.

Safes should just work

I got called out to fix a safe last week. Normally this wouldn’t be newsworthy but this time it was because I was the second safe technician to show up that day. The first one told the customer that they must continue hitting the safe door with a hammer to close it or get it open. They also said that the fix was to buy a new safe even though the problematic one was only a few months old.

The manager on duty told me that my help probably wasn’t necessary, somebody had already come by earlier who instructed them to just hit the safe door with a hammer to both open and close it but when I passed on what the previous tech told the customer, the NSP asked me to check the safe. Turns out the NSP told the last guy to cancel and called me instead, but the last guy came out anyway. I wonder what kind of silliness the last guy committed before?

So I go take a look at the safe and immediately see a small screw wedged into the frame, just where the door should go when closed! Surprise surprise, the safe worked like new without an obstruction.

I don’t know what the moral of the story is, I guess it is that there are people who think they know what they’re doing who actually don’t. It’s experiences like these that make me question what dentists and auto mechanics are telling me. Did I get a good one or a bad one?

New developments in locks and technology

There has been proof of concept attacks to take control of vehicles by getting access to the can bus but this is an interesting sign that the criminal underworld has begun distributing a tool for stealing cars in a way that bypasses the ECU and immobilizer by directly accessing the car’s local network, as it were. Essentially car thieves buy an object that looks like a jbl bluetooth stereo and bust your headlight off and attach the fake bluetooth speaker to the wires going to the headlight. There’s a chip in the device that automatically unlocks the door and starts the car.

More security news: As I mentioned in other posts lockpicking is becoming an actual problem in Seattle. Either the criminals got smarter or they got more desperate. Lockpicks are being recovered at crime scenes and today I came to a house whose owner sweared he had locked his schlage deadbolt before leaving but found his house had been rifled through after returning from his vacation. Normally I assume that people just forgot to lock their doors in this situation but I rekeyed the locks to make the guy feel safe and noticed when I took the deadbolt cylinder apart, there were scratches on the tailpiece. This is a telltale sign of lockpicking since afactory sc1 key won’t touch the tailpiece of an sc1 original cylinder, much less make a straight scratch mark. As a result I can drop the preamble to my sales pitch for high security locks: they are not snake oil in seattle for average homeowners.

Another development is that Napco’s Alarm Lock is no longer offering ANY locks for thick doors. This is going to be a major issue for people who installed a dl2800 on a two and a half inch door a year ago and have a warranty issue. I’m kind of in this boat right now. If you have a thick door chassis for an alarm lock dl2800 call this guy.

Sometimes doors sag because of negligence

There are many reasons for doors not shutting correctly. Loose hinges, frames not connected to anything, pivot hinges wearing out. Today I encountered one that was heretofore alien to me: negligent installation. There were maybe 30 holes on this continuous hinge and the people who installed it only tapped and installed about six or seven screws, and those not very well. As a result of installing about 20% of the screws the door was sagging and the frame was bent. What screws were actually installed had been driven in at a jaunty angle so that the heads were sticking out and would prevent the door from shutting all the way.

When I saw this I told the building superintendent that this was installer negligence and they should call whoever installed it to fix it for free. The building owner came over and told them that it was normal to only install a handful of screws and to prevent this from happening one should put threadlocker on the screws! That’s the biggest load of malarkey I’ve heard in weeks and I listen to NPR every day.

Continuous hinges are an amazing development and they can last for decades, but only if they are installed correctly. I can’t imagine who would half-ass a continuous hinge installation and if they were going to why they wouldn’t screw in the top ten highest hinge screws. Maybe they forgot their ladder?

How to get Yale 1520 exit device to work correctly

This is just what I did, I’m not recommending it because it might void the warranty and fire rating if this is 1520f and lawyers etc etc, you are the captain of your own boat in life. You have to remove any play in the top rod by adding a cotter pin or roll pin in the sliding telescoping portion with a one inch cutout.

Ok I’ve had a real runaround with Yale tech support on this (spent about an hour trying to reach relevant tech support on the phone, apparently phone system was down at Yale that day) and ultimately figured out a solution that works reliably on my own. I don’t know if it is the correct one or not but figured this may save some hair loss and extra wrinkles from forming out there. I’m not one to claim that the manufacturer screwed up design wantonly but if you’re here trying to figure this out no doubt that is one conclusion you’ve entertained!

Like most vertical rod exit devices the rod is pushed up to release the top latch and then also hold the bottom rod up inside the door until the door closes and the top latch trigger is hit, locking the top latch and dropping the bottom rod into a hole on the floor. Normally to make this work correctly you have to eliminate any play in the system. If there is any play in the rods then the small amount of travel gained from pushing an exit device or rotating a lever will not be enough to release the top latch.

Good luck figuring this out if you aren’t used to this kind of hardware.

The Yale 1520 doesn’t come with a lot of instructions, just a kind of exploded view on an 8.5×11″ sheet of paper. The carpenters on this jobsite did the rod prep but I think they did as well as can be expected of anybody. There were some issues with this hardware straight from the factory at Yale. They shipped out “yokes” that weren’t compatible with the Yale 1520, they just didn’t fit. When the site manager called and complained they sent out more of the wrong part, argued and then finally sent out the correct part when shown pictures of it not fitting. The site manager was the one who noticed that in Yale’s tech support pictures the yoke was a different color!

Once the yokes were installed the next huge problem was that the upper vertical rod for some reason has about an inch of play built into it with a roll pin that slides in a 1 inch cutout. I can’t imagine what purpose this serves. You push the exit device, the upper latch is released, and then when you release the exit device the top rod’s inner sleeve falls an inch and the bottom rod drags on the ground.

The solution to this problem is to drill an additional hole in the cutout and put one of the included cotter pins through it and thereby remove the inch of play. The bottom rod will then stay inside the door when the door is open reliably.

Add one of the cotter pins, make sure to fold it over into the cutout so it doesn’t grab anything inside the door during movement.

This system was a nightmare to work with. I also have misgivings about how well the little threaded connection between the yoke and the vertical rods will last if there is any abuse. Locksmiths generally dislike vertical rod exit devices because of these sorts of things but I detest this lock, I may just walk away if I see one of these on a job site again. Yale tech support was extremely unhelpful with this, I lost money on it, the jobsite super probably thinks I’m a clown locksmith and probably also doesn’t like Yale hardware anymore.

Every time any adjustment to rod height has to be made you have to carefully unscrew a 5/64″ screw from the rod. Don’t drop anything into the door or it might fall into the bottom rod assembly and cause it to malfunction! Then you have to screw it back into the rod. This may require three hands to get it started. To do properly you probably want to add the spacers which seem designed to fall into the door. Then you have to reinstall the exterior trim which is no picnic, the tailpiece is connected to a spring so you have to line things up perfectly. Sometimes you get lucky and the tailpiece slides in, other times you have to curse and fidget for twenty minutes. I hate concealed rods but I hate the Yale 1520 more, maybe even more than the knockoffs I’ve installed for people who bought them off of amazon (never again!).

New developments in lock security

For years people have asked me if they need to replace their locks with ones that are more resistant to lockpicking. Until now I have always said that unless it is known that you have things highly desirable to thieves, a standard five pin Schlage deadbolt is probably good enough. Until now except rarely thieves haven’t been using lockpicks or other professional tools for lock bypass and manipulation, but that is changing.

In the past month one of my customers in a troubled building has found a lockpick outside his building’s front door. In a different building’s back door I found a broken lockpick. What this means is that the minimum bar for security has been raised. Now apartment buildings need the same high security cylinders that banks and jewelry stores have been using for decades.

The reason for this is up for debate but my personal theory is that police response times in Seattle are not great and criminals know it. They have more time to break into buildings to steal packages or break into cars before authorities show up. Even if they are caught they know that they won’t be held for long, often getting back out a few days later.

Add into the mix the popular Youtube channel The Lockpicking Lawyer whose videos raise awareness of how easy lockpicking can be and also sells said lockpicks to anybody and it is hard to imagine that this situation wouldn’t have arisen. Along with standard lockpicks, criminals with a little more money can buy Lishi picks (from The Lockpicking Lawyer) which will open more than half the commercial and apartment buildings in Seattle. These tools cost under $100 online and can be purchased by anybody.

The more interesting question is what to do to prevent illicit entry with the proliferation of lock bypass and manipulation tools. The answer is that building owners can no longer rely on inexpensive lock pin tumbler lock cylinders that have been standard for more than 100 years. It’s old technology and with the help of Youtube and the vast knowledge available on the internet criminals have caught up. It is time, at least in Seattle, to upgrade to higher security lock cylinders that are much harder to open without a key.

There are a few features that building owners should be looking for in an upgrade. Pick resistance comes from difficult keyways, sidebars, security pins and other features found in higher security locks. These locks frequently also feature other desirable features like restricted keyways and hardened steel inserts to prevent drilling.

I sell a few different keyways that fit the bill. While budgeting for a new expensive lock system and keys, also consider moving to an audited electronic form of entry. Don’t be cheap with electronic locks though. Many buildings are implementing fob systems that are no longer very secure either. The cheapest fobs that are also the most common are easily cloned at Minutekey kiosks. These systems are also quickly and easily spoofed with off the shelf electronics and tutorials on how to do it are easy to find on Youtube where the lockpicking lawyer helpfully also points out where to buy these tools.

The “Flipper Zero” is a new tool available for less than $200. It can be used to unlock a lot of doors using key fobs. Access control systems can use higher encryption that is more difficult for these tools to crack and also prevents unauthorized duplication of fobs. Iclass cards for example. I don’t do a lot of access control systems because in this state I’m not allowed to run wires.

Rate Increases Coming

Inflation and increasing amount of travel time due to increasing number of drivers and decreasing traffic infrastructure means it is time to raise rates. I realized I was undercharging a lot, 50% less than many of my colleagues. I have now updated pricing to 10% under market rate. I will continue to provide documentation for those who wish to save money by doing things themselves on my website.

Veto Propac zipper separation problem fix

I am a happy owner of my third Veto Propac and still have my last one because it still sort of works but the zipper comes apart which is concerning if you are walking over grass, you might leave a trail of very expensive tools behind you without hearing them fall out!

I took the bag to a local seamstress but after cleaning the zipper with oil she was unable to get it working properly so I thought I might have to ship it in to Veto for zipper replacement. I could probably get them to do it for free because they have a five year warranty but this was my fault stuffing to much stuff in the bag and forcing the zipper closed so it would have been expensive.

Today I needed a grocery backpack for my motorcycle and I saw that bag in the back of the garage and I thought I fix mechanical problems all day, why not fix this one? After realizing the zipper wasn’t forcing the two sides together enough I tried squeezing the back of the zipper together and also the top and bottom together with some pliers. It worked! I squeezed the other side and now I have two Propacs. Now I can have a dedicated one for weekend and afterhours lockouts. I hope this helps somebody out there fix their busted zipper, I know it is a common problem because Veto has a FAQ on their website talking about how to prevent this…but not how to fix it!

Getting a Weslock to use Schlage SC1 key

TLDR: you have to drill or grind out the top of the cylinder housing where the bible goes a little bit.

Schlage cylinder after Weslock housing modification

There are two kinds of manufacturers: those that manufacturer products that use industry standards and those that make it up as they go along. They might make their own standards as a form of protectionism or vendor lock-in, or they might do it because it’s too hard to conform to standards.

Whatever the case, in the lock world many deadbolts can take a key in knob or “universal” cylinder, and many can’t. This is a daily explanation I give to people asking me to make one key work in their house full of incompatible locks. The mantra is, “If the key can be inserted into the lock then the lock can probably me made to use that key.”

Then the customer says, “But the key doesn’t work in that lock.” Then you have to explain that you aren’t asking if the key works in the lock, only if the key can be inserted into the lock. It is sometimes a lot to ask for people to understand this concept and you have to explain it several times. Perhaps you will have to re-read the above a few times to understand the conundrum. If you are one of these people maybe you will have to go over to your door and try sticking random keys into your lock to understand the difference between a compatible key and a working key.

Sorry for going off on a tangent. Back to the issue, getting one key to work with a bunch of different locks. Most Schlage deadbolts can have aftermarket key in knob cylinders installed in them so I buy a lot of Kwikset kik cylinders. I charge $40 to put one in a deadbolt. You can’t put a Schlage cylinder in a Kwikset deadbolt though, they use a proprietary cylinder format. To their credit, Kwikset recently started selling Smartkey cylinders in Schlage’s SC1 keyway but if you want to install some other kind of keyway you’re out of luck. Medeco might make aftermarket cylinders in this proprietary format but that’s it as far as I know.

Schlage isn’t totally absolved of this mess either because they invented their goofy floating cap cylinders for the popular f series handlesets. They did used to manufacture cylinders for these in the Kwikset keyway and Medeco made afermarket cylinders for the old version of the F series but the floating cap was probably a deal breaker for Medeco who rightly recognized the nightmare that the floating cap would be in product support. Any locksmith will take a deep breath before launching into a tirade of loathing about the floating cap if you ask them about it.

The same thing with Weslock, aftermarket cylinders won’t fit into their locks because of their custom format. However when there is a will and enough money there is a way. You can modify a Weslock to accept the taller bible of a key in knob format cylinder. A customer recently had a blank cheque for getting their house working with one key which is good because I ran into problems rekeying their profile cylinder, but also was willing to pay me $75 to modify their Weslock. The guy who built the house could have very easily bought a Schlage compatible front door lock and saved this guy some money but I digress.

The trick is to take a die grinder or even a good HSS drill bit and ream out the area at the top of the cylinder housing about a 1/16″ until the cylinder slides in. Try to only remove the area at the very top, you don’t want the cylinder rotating around in that big area to the left. You could jam some wood in there I guess. A 5 pin cyinder can reuse the Weslock cylinder housing screw, a 6 pin would require a longer screw. Note the tailpiece is the Weslock original. You need a really long tailpiece and it has to be skinnier than a Schlage, GMS or Ilco tailpiece to fit through the bolt.

Nanawall Multipoint Lock Cylinders Don’t Use Normal Pins

Before considering getting a “Nanawall” installed here are some pitfalls for you to consider. TLDR: use SFIC pins or reuse the bottom pins in a different configuration.

The Nanawall appears to be a well constructed door, my issues are with the lock cylinder itself. The main problems with this lock cylinder are that it is an odd size so replacement will be difficult and that it doesn’t use standard .115″ diameter pins. That means when you call some poor sap like me out to rekey it we will have a real headache trying to get regular pins into it.

Locksmiths are used to problems with pinning up profile or euro cylinders as they are variously called. CES cylinders use different depths despite using the Schlage SC1 key. If you are lucky there are threaded caps for each chamber so that you more easily rekey them but it is still more laborious than some other lock cylinders. If you aren’t lucky then you have to take the profile cylinder apart with a special follower that most North American locksmiths won’t have or know how to use.

Enter the Nanawall profile cylinder. It does have the threaded caps. The factory pins come out easily enough. When you put a .115″ pin in it will go through the top of the cylinder but get stuck in the plug. Then you will spend maybe 30-45 minutes trying to get that pin out of there by eventually dismantling the cylinder to get the plug out. Then you will discover that the pin holes are drilled too small for normal pins. SFIC pins will work but this is a hack, it means that you will have to use a lot of extra top pins to build up the pin stack making the lock less secure. I would also like to say that it is very obnoxious of this manufacturer to use a cylinder whose bible is drilled for .115″ pins but whose plug is not. It will earn the ire of locksmiths everywhere!

Replacing this bastardization of a lock cylinder is not cheap or straightforward. In North America the profile cylinders available to us are shorter than those in the Nanawall. They wouldn’t work. Both GMS and Ilco make these and Ilco has two lengths but neither are long enough. Ilco is willing to custom make them for a price. If you want to buy a $200 profile cylinder Ilco will do it for you. Abloy will also make custom profile cylinders for the Protec2 but those are well over $500 each!

To sum it up unless you’re cool with keeping the keys that come with a Nanawall and using those in perpetuity or spending a ton of money in the future, steer clear! If I was going to rekey that house again knowing what I know now I would keep the bottom pins from the nanawall and rearrange them in a different order and codecut a key for that configuration to rekey the rest of the house with. That’s a workaround. It shouldn’t be necessary though, using .115″ pins should be an easy thing to design a modern lock cylinder around.

madsenbjorn

Author: Bjørn Madsen