156

I am partially responsible for some resources protected by a 4-dial combination lock like this one: Lock

There are two things that people will usually do after they've locked it:

  • reset all the digits to 0, so that the combination reads 0000, or
  • mash around on the dials a bit so that the combination reads something else.

I have a strong feeling that there is no functional difference between the two, but I am encouraged to set a best practice. So, assuming that the lock has a random combination and is practically unbreakable without entering the correct combination, which approach is more secure?

Improve this question
21
  • 46
    With a pick from Kevin Mitnick's Lock Pick Business Card (I have two, one undone) and watching a video to learn how, anyone can pick a 175d in a few seconds.... don't worry about how you reset the dials.
    – CGCampbell
    Commented Apr 13, 2018 at 19:23
  • 42
    Don't reset all the digits to 0 if the combination is 0000! ;-)
    – Michael
    Commented Apr 13, 2018 at 20:58
  • 14
    Zero it out AND set the combination to 0000. Fool proof.
    – RenaissanceProgrammer
    Commented Apr 14, 2018 at 0:36
  • 63
    If you are actually responsible for valuable resources, get rid of that lousy lock immediately, replacing it by a proper high-quality tamper-resistant padlock, or a proper safe, depending on the value. It makes no sense to use a lousy lock that anyone can break within 30min. Worse still, many such combination locks can be broken within 1 minute if you know how, as Chris Johns sketches in his answer.
    – user21820
    Commented Apr 14, 2018 at 5:12
  • 8
    These locks (and combination locks in general) are perilously insecure, usually due to exploits that have nothing to do with guessing the combination.
    – le3th4x0rbot
    Commented Apr 16, 2018 at 2:44

12 Answers 12

Reset to default
119

In theory zeroing or any predetermined sequence is more secure as you could, in theory make a guess at how far someone might move the dials.

It is also conceivable that if you were able to check the state of the dials when locked on enough different occasions then you could narrow down the likely combination if it is being reset in a similar manner each time.

In practice this is probably a bit far fetched and anything with a combination lock probably has larger concerns eg the combination being known by too many people or the fact that any number between 1950 and 2018 plus the birth years of moderately famous people is probably a fairly good guess.

Having said that there may be operational advantages in having combinations set to zero as it gives a clear unambiguous guideline and it is easy to visually check that the lock is secure without the person doing the checking needing to know the combination, especially if actually physically checking that the lock is closed is problematic eg opening it sets off an alarm. You could also argue that adding the extra step of zeroing creates more of a routine and so makes it less likely that people will forget to set the lock at all, although this is admittedly debatable.

For example if you have a night security guard you could just ask them to check that all locks are set to 0000 which is both easy to do and verifiable.

It also gives an (admittedly weak) check that the locks haven't been tampered with, here a more arbitrary sequence would be better.

For example if you set all your locks to 2375 when you leave and the sequence is different when you get back you know that someone has been messing with them.

You should also be aware that some types of combination dial lock are very trivial to pick as you can often feel when each dial engages by quickly cycling through each dial or by probing from the outside. Equally a 4 dial lock only has 10,000 (10^4) possible combinations and you can often systematically go through combinations very quickly.

Improve this answer
15
  • 11
    This answer is the best because it considers actual security, not just cryptographic security of the numbers themselves.
    – NH.
    Commented Apr 13, 2018 at 20:56
  • 1
    4 dial lock takes relatively long time to through all combinations, most locks on the market are 3 dial, which are very fast to open just by systematically checking all combinations. 3 dial locks should not be used for anything except child's play. Of course, any dial lock is never very secure.
    – Tero Lahtinen
    Commented Apr 14, 2018 at 7:08
  • 2
    @RedwolfPrograms: you probably should redo your math. Dial locks usually have some tolerance built into the system, so dialing adjacent numbers would usually still work.
    – Lie Ryan
    Commented Apr 16, 2018 at 0:35
  • 2
    @TeroLahtinen especially if your 4-dial lock is set to detonate everything after 5 straight failures!
    – Carl Witthoft
    Commented Apr 16, 2018 at 15:46
  • 2
    @TeroLahtinen Some dial locks have a vulnerability where simultaneously trying to dial and open the lock will provide some feedback telling you if an individual dial is in the correct position. This allows the lock to be opened faster than brute force.
    – kasperd
    Commented Apr 18, 2018 at 21:07
192

I would recommend setting it to 0000 or some other specified combination (doesn't really matter what).

"Mashing around the dials" is a little vague, but I would guess based on my own behavior that people would tend to move most or all of the dials at once, which would create a strong correlation between the current combination and the lock combination. For instance, if the lock combination is 1234, someone might change it to 5678 (probably not exactly, but close enough that an attacker could prioritize the combinations they try).

Humans also have a tendency to think some things seem more secure when they actually weaken security. Someone may try to set it to a combination that seems "further" from the lock combination, such as changing 1234 to 6578 instead of 2142 because 2142 is too "close" to the lock combination. This could allow an attacker to prioritize the order they attempt combinations. Specifying a constant value to set it to avoids such issues.

Improve this answer
14
  • 118
    And if the combination is 1234, probably no one will let it be x2xx after shuffling it. An attacker records the numbers on the lock time and time again and can create a profile of likely digits based on that.
    – ThoriumBR
    Commented Apr 13, 2018 at 15:25
  • 29
    @ThoriumBR So true. Most people may even deliberately avoid having part of their code show up. I just need to watch you spin the lock half a dozen times to narrow down exactly what 4 numbers you use, then I have only 4*3*2*1 = 24 combinations to test out. You just completely destroyed your security due to your own flawed idea of what security is...
    – Nelson
    Commented Apr 13, 2018 at 16:38
  • 41
    Short version: Humans are even worse at RNG than computers, even if we think otherwise.
    – Kamil Drakari
    Commented Apr 13, 2018 at 18:27
  • 77
    In the real world, both options are basically equivalent, because if someone actually wants in badly enough to break the law, they're not going to do statistics or spend hours trying every combination. They're going to use a crowbar or a drill.
    – BlueRaja - Danny Pflughoeft
    Commented Apr 13, 2018 at 18:32
  • 13
    As a practical matter, setting 0000 is probably better since it will indicate to an attacker that they should move on to an easier target. Even if the attacker doesn't crack your code, you don't want to encounter them making an attempt.
    – MooseBoys
    Commented Apr 13, 2018 at 19:26
34

It does not matter.

A lock can provide three forms of protection:

  1. Delay an attacker from accessing a resource so that they can be interrupted and stopped
  2. Provide evidence of tampering
  3. Dissuade a would-be attacker from attempting an attack

As discussed throughout answers and comments, it fails to do much in the way of delaying an attacker. The lock can be easily cut with a tool, like this $10 pair of bolt cutters. It can be easily picked with a tool, as CGCampbell's comment points out.

The ease with which it can be picked also limits its effectiveness as tamper evidence. Other answers point out that it can be fairly easily defeated even without a picking tool. So it really fails on that, as well.

This leaves its only value as the psychological benefit. It communicates that the valuables inside are not meant for unrestricted access, which dissuades people whose sense of morality or the fear of being caught will prevent them from attempting at all.

What the dial sits on thus has nearly zero relevance to its defensive capabilities. As a result, you'll need other defensive mechanisms to achieve your security goals if they include anything beyond the psychological influence. Surveillance (video or in person) would give you tamper evidence much more reliably if that's what you need; if that's not viable, there are other means of achieving it. Other means of protection are required if your intention is to protect it from determined attackers.

Improve this answer
4
  • 21
    Locks are often used for tamper evidence, not just to provide physical security. In these situations, an attacker may have a less strict time limit, but is unable to physically destroy the lock (because it would leave evidence).
    – forest
    Commented Apr 14, 2018 at 1:09
  • 6
    See @CGCampbell's comment on the original question. That lock does not even provide tamper evidence. Anybody who knows the trick can open that lock with a simple tool more quickly than a person who knows the combination can dial it in. Opening it with the tool leaves no evidence whatsoever.
    – Solomon Slow
    Commented Apr 14, 2018 at 16:13
  • 1
    Or cut the lock, open [container] replace with alternate lock - who cares if the combination is wrong...
    – Baldrickk
    Commented Apr 16, 2018 at 12:35
  • @forest Thanks. I updated my answer to incorporate that possibility.
    – jpmc26
    Commented Apr 19, 2018 at 22:20
23

Zero it out. Maybe more work, but you don't run the risks of rotating too little or rotating the same amount for multiple dials. An attacker would have very little to go on in either case, though... Most people wouldn't consider this. Actual real-world security between the two is probably about equal. They would just have nothing extra to go on if you zero it out, and it's good to form a habit like that.

Improve this answer
6
  • 1
    It may not be more work. If you put it at 0000, then you could think of a combination of 1234 as 1 click up on the first dial, 2 clicks up on the second, etc., and wouldn't have to do subtraction to figure out how far to move each dial. And you could do the same backwards when you reset it afterwards. It might even be easier!
    – Guy Schalnat
    Commented Apr 13, 2018 at 16:13
  • 1
    The key is to reset it to the same pattern so the reset cannot be used as a vector of attack, then you can use this consistency to open the look without visual sight... adding even MORE security.
    – Nelson
    Commented Apr 13, 2018 at 16:40
  • 16
    I think this answer is right, but with the caveat that if the additional security is worth that extra work, you're probably using too weak a lock for the job. But that may not be in your control.
    – Steve Jessop
    Commented Apr 13, 2018 at 16:50
  • 3
    That lock looks like one I used to have decades ago--if so I believe it had a stop that prevented it from going backwards past zero making it far easier to zero than scramble.
    – Bill K
    Commented Apr 13, 2018 at 18:39
  • 1
    Good attackers aren't "most people" - as always, the threat model has to include the level of adversary you're defending against.
    – Toby Speight
    Commented Apr 19, 2018 at 11:47
11

There are a few things to take into account when answering this question.

  1. If you are looking for a statistical answer, then "spinning" the dials a specific number of times randomly forward and backward. (I don't have the count as that would be a calculation I don't have with me. It's like a required number of shuffles in Vegas to be considered random.)

  2. If you're looking at this from a security perspective, then set it to a specific number is the better answer (where 0000 could be that specific number). The reason its a better answer has been touched on in other posts, but in summary, it requires the person locking the lock to "think" to ensure it's been dialed. It provides no statistical information over time to guess movements. It allows for periodic "discovery" of tampering (if even to move the numbers around). If the number you set is 0000, the tampering part will have a potentially lower effectiveness as someone playing with it will probably remember to turn it back to 0000.

Unfortunately all of this overall is somewhat moot if the person trying to open the lock knows what they are doing. These 4 digit combo locks like the one pictured typically can be opened in under 30 seconds by someone who has experience with them. If they have a thin shim, even faster... Just a typical example video of how this is done (with more exposed dials albeit) https://www.youtube.com/watch?v=ABKsUNitXqw or https://www.youtube.com/watch?v=jmhSSuCIdPI. Having worked at DefCon for several years, it's pretty amazing to sit for a few minutes in the lockpicking village and watch young adults pop these things quickly after less than 15 minutes of training.

Knowing how easy these are to pop, and the fact that you're probably worried about tampering, #2 above is the long-term way to go.

Improve this answer
5
  • 1
    (+1) I mostly agree with your answer, except for "1.": For this type of combination lock, (#1) "spinning" (any or all) dials more than once doesn't improve security. The issue is that the person locking the lock (or verifying it later) should insure all the dials are moved from the opening combination. The question is, should they be moved to specific (incorrect) positions (like 0-0-0-0), or some random positions. One motion on each dial should be enough, either to a specific, or random position. Moving the dial twice (or more) in either direction could move it back to the opening position.
    – Kevin Fegan
    Commented Apr 15, 2018 at 20:20
  • 2
    Moving each dial seperately to a random but not opening position leaks information about the code to an observer who can observe the lock over time.
    – Peter Green
    Commented Apr 16, 2018 at 15:24
  • It's fine if some of the dials can be in their "opening" position, as long as not all are. That way the search space is only reduced by up to one code per observation.
    – cHao
    Commented Apr 19, 2018 at 15:19
  • As for the stats, true randomness would mean spinning 0 to 9 positions forward, with an equal chance of each and each dial independent of the others. I wouldn't count on muscle memory for this; use a RNG.
    – Mathieu K.
    Commented Apr 23, 2018 at 2:01
  • "no statistical information over time"—I'm guessing the additional wear in those dials whose correct digits are furthest from 0 would eventually be detectable.
    – Mathieu K.
    Commented Apr 23, 2018 at 2:06
6

To add an extra level of security, either use both directions equally for zeroing or always rotate all to a single direction, to leave equal amount of fingerprints. People tend to pick a number once and memorize it. The path from zero to (or near) the correct combination might get revealed in UV light.

I think that's even easier than guessing whether a non-zero combination shown is from blind spinning or hand picked: memorizing what has been already tried might take similar amount of time and effort than going through 0000-9999 in order. And once it's stolen, time and combination gets irrelevant: I'd concentrate on threats that could actualize while you turn your back, without knowing the secrets were compromized.

Improve this answer
3
  • Isn't the path to zero the reverse of the path from zero that you use when opening? So turning the lock back the natural way should even out the up/down fingerprints.
    – Toby Speight
    Commented Apr 19, 2018 at 11:49
  • Rolling forth 0-1-...-7 leaves the same trail than rolling back 7-6-...-0, while 7-8-9-0 leaves fingerprints on all numbers.
    – Esa Jokinen
    Commented Apr 19, 2018 at 11:54
  • Ah, I think I see what you mean - I was thinking more of wear patterns on the casing than on the wheels!
    – Toby Speight
    Commented Apr 19, 2018 at 13:00
4

Theoretically, setting it to 0000 is superior because there is no possibility of any correlation to what was there before. Practically, it's slightly superior because you have a way to check for compliance, whereas any specified procedure that requires an adequate amount of randomization, can't be easily checked up on to see if people are actually following the protocol as opposed to just casually brushing their thumb over all the wheels together.

But still more practical, it is utterly stupid to depend on such a lock for serious security. If it is worth this level of analysis, it's worth a lock that isn't a toy. Bolt cutters rule.

Improve this answer
2
  • Well, there is a 10/10000=0.1% chance of correlation to what was there before, as that could be 1111, 2222, etc. Small, but not "no possibility".
    – Andrew Leach
    Commented Apr 15, 2018 at 12:35
  • 1
    @AndrewLeach That is not a correlation. A correlation would be between your target and any given correct combination. In other words, it would be a correlation to "a correct combination", not to "1111".
    – forest
    Commented Apr 16, 2018 at 12:31
3

More on zeroing the result, which is my recommended approach. This is a theoretical answer.

Assuming an attacker knows how you reset the lock by either zeroing, setting to any fixed value, or scrambling the digits, they should still keep zero knowledge of the correct combination and thus equal odds of matching a random combination.

This could be broken with "mashing around" because no human is a perfect source of random source. Actually they could be the worst.

Mashing around the digits could work with a mechanical/electronic device that spins the digits based on a truly or good-random source.

But normally humans would apply the digits patterns that may reduce the possible values to look for.

Suppose you and the attacker share a set of locks of which both know the combination. Normally one would for example swipe the fingers "randomly" on the reels to make them point to a different number. Or move the reels in an order that the brain wants to keep.

Maybe somebody will make sure the resulting number shows all digits different from the correct combination, or a minimum number of ticks when changing each digit.

This will result in a known plaintext attack of an increasing number of attempts (again, this is a theoretical answer) and will give additional information on the combination that the attacker should not have.

What does emphasized additional mean? That even if the attacker succeeds in determining that a single digit is surely a wrong guess they have just dropped the needed brute force attacks by 1000. Add more digits to restrict the attack surface.

Setting to 0000 or to any predefined value makes the odds of every combination the same

Improve this answer
1

In a practical sense it really doesn't matter, trying to undo your blind scrambling is going to be harder than just wiggling the dials around and getting a feel for the lock. It's fairly easy to open a combination lock just from turning the dials and feeling how it reacts. Combination locks like these are only mild deterrent.

Improve this answer
1
  • It's not necessarily that hard to undo blind scrambling. I've had a 4-dial lock and managed to unlock it just by moving every single dial at once (save the one on the far left, for reasons) and trying to open it each time. It worked in less than a minute.
    – forest
    Commented Apr 20, 2018 at 4:01
0

you could also fix another random number 3234 for example and bring it back to this number after locking , so its easier to know if it has been played with , instead of 0000

Improve this answer
2
  • Everyone must memorize two codes, and then someone will confuse them.
    – djechlin
    Commented Apr 17, 2018 at 22:41
  • This seems more like a comment than an answer...
    – forest
    Commented Aug 7, 2018 at 2:35
0

It's actually a pretty bad idea to require everyone to use all 0's because requiring all 0's is burdensome security theater.

I have a strong feeling that there is no functional difference between the two, but I am encouraged to set a best practice.

The best practice should be something people consistently do and follow, and something for which your cohort understands the importance. The arguments that will ensue when someone forgets to set all to 0 or doesn't feel like it will be nothing but petty. Of course everyone else on your team knows it doesn't make any difference, at least not any difference that doesn't start with "well technically".

When management is literalist about security you can expect employees to be literalist right back at them. If people really got upset, you could expect to find the lock on the ground set to all 0's and the safe open some day, just like management wants it.

Improve this answer
-1

In theory, they are equally (in)secure. Were one of them more secure (e.g. blindly spinning the dials), then the attacker would know it as well and set the lock to "0000" to reduce the complexity, and vice versa.

One thing to note though is that spinning digits randomly could theoretically give out your code if it's "easier" to spin the digit to the correct position (which should mean it's a very bad lock, but to my knowledge some locks are like that). Hence, if you do want to introduce some random element, you may be better off coming up with a random number yourself, making sure it's not too close to the correct number, and setting the lock to that number

Improve this answer
2
  • 2
    -1 for making sure it's not too close to the correct number because that itself is a correlation, and a pretty strong one, too. some of the other answers have pointed that out.
    – forest
    Commented Apr 22, 2018 at 9:54
  • @forest If we were to talk in abstract terms, I would have agreed with you. Realistically however, there are many more things at play, both mechanical and psychological. First, lots of people forget to reset their locks, so the lockpicker will much more likely try the number that the lock was set to (along with its adjacent numbers) before going with the brute force approach. Second, some cheap locks are designed in a way that by spinning their dials randomly you will be more likely to get the correct digit than any other. The list goes on.
    – undercat
    Commented Apr 22, 2018 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .