IamA President of a 501c3 (tax exempt non-profit) that is called FALE. We teach people to pick locks! AMA!

How can I learn to do this? I like the challenge of building/taking apart subtle mechanisms i.e clockworks.

It's crazy easy. there are a few sites that sell lock picks, if you would like details PM me and i'll get you some resources (dont want to be accused of advertising). i'll also post some links to some tutorials in the original post because i assume this will be a popular question!

I would love details about what to buy and where to buy it

i'd prefer not to link directly to places to buy so i don't get accused of advertising or anything ridiculous. feel free to PM me.

as far as WHAT to buy, don't get too hung up on the number of tools you get. you'll end up using 5 or 6 of the tools for 99% of the locks. there are 2 main things you need to pick, tension wrenches and picks. Tension wrenches (torsion wrenches if you want to be a neckbeard about it) do the turning, picks do the lifting, you will want a handful of each in different sizes. as far as types of picks, there are "single peaked" picks and "multi peak" picks. Single peaks are called single lifters, and used for manipulating a single pin at a time. Multi peaked picks are called rakes, and used for manipulating multiple pins at a time. you will want a few of each, in different sizes and shapes.

other than that, its all personal preference. i really prefer spring steel over stainless because spring is tougher, and gives better feedback. stainless is softer, but wont rust.

I'm gonna be purchasing a motorcycle soon and was wondering if you had any tips for keeping my bike secure, I've looked at a number of things and don't really know where to start?

honestly there is no good way to secure a motorcycle (sorry), anything that can be picked up and placed onto a truck is inherently insecure. there are some REALLY good lock brands (abloy, medeco, mul-t-lock, etc) that make excellent shrouded padlocks. That and a big ass chain goes a long way.

other than that you are looking at electronic measures such as lojack or something similar.

A big ass chain didn't help Pee Wee.

he also takes his big ass chain out and public and swings it around

how difficult was it to establish 501c3 status? any recs to follow?

its a pretty awesome combination of weirdly easy, and super confusing... It takes a LOT of documentation, some of which you may not have. We started FALE (on paper) this year, and the IRS requires 3 years of projections for how much income you will have, and it has to be itemized by source, and anticipated expenses. how the hell are you supposed to project out 3 years when your organization has only existed for a month???

You literally end up making up numbers, based on what you know, or expect. after that a lot of the stuff is just articulating what you are doing, in terms that the IRS "accepts" as being a tax-exempt activity. It was about 70 pages of documentation, bilaws, etc, and took about 2-3 weeks to put together.

Cool organization! Two questions:

1. How difficult is it to pick an average home deadbolt?

2. Would your autobiography be called "Destined to FALE" or "Epic FALE?"

1) most people that can pick locks with what I would consider "some level of competence" can pick the "average" residential grade deadbolt in under 5 minutes in most cases. Lock picking takes advantage of some really neat manufacturing tolerance issues, so literally every lock is different, even locks out of the same package.

2) "Already FALE'd but my mom is still proud of me"

What percentage of lock pickings are legal?

there are no really good statistics on the matter because the numbers are extremely low, and most municipalities do not report on the specific implements of a crime. For example what percentage of break ins used a brick? what percentage used a crowbar?

Firstly I think what you're doing is great and don't want to come across as being a dick but... In this comment you said that percentages are not really known how many are illegal but in other comment you used the term "crazy low". I believe you in saying that the average burglar in thick a pig shit but your message confuses me. Do you know it's low or is it healthy denial to keep you feeling okay about what you're doing. Really not trying too offend.

yeah its like stormy_rawr said, there was huge media attention given to bumping, and it happened literally a handful of times so the media attention died out. theres no incentive to pick locks for a crime.

EDIT: I thought about this a little more and i figured i would mention that as with anything (religion, life, etc) I could be delusional, and would love evidence one way or another. my gut tells me that the percentages are very low, there are NO GOOD STATISTICS either way. lock picking crime by nature is more difficult to detect than a smash and grab, and therefor VERY LIKELY to be underreported. I would love for some actual research to go into this, and a good friend of mine is looking at ways to answer this question properly. Never apologize for asking me tough questions, I would love to be proved wrong. I learn more from my mistakes than my successes.

How did you become a penetration tester? What led you to do it? Were you interested in it from a young age?

I actually got my gig as a pentester from doing training at computer security events. My dad installed security systems, so i learned to bypass them. I started FALE, and we got invited to do some presentations. People started to recognize me as a lock guru and people needed physical security assessments. I had always been into computers and (bypassing) security is just a passion. I started picking when i was 14 or so.

Does the thought of one of the people you teach using your lock picking techniques for less than legal activities, enter your mind at all?

All the time. Fact of the matter is that lock picks being used for actual crime is CRAZY low. generally speaking burglaries are smash and grab. the only incentive to pick locks is if covert entry is a MUST. it's a skill that requires some level of training (albeit very minimal to START), and will always take more time than throwing a brick.

This being said, working in the security field i despise security through obscurity, which is essentially the concept that something is secure simply because people don't know how it works. This model has been shown time and again to not work, the only way to know if you are secure is to learn!

Thank you!

no, thank you my Oreo internet friend.

Why did you start FALE?

I wanted to drink beer, hang out with my friends, and talk about security. It turns out there are tons of people that are interested, and we sort of fell into the gig of educating people on physical security (we got invited, and said what the heck!). Turns out we love it, and kept doing it!

I wanted to drink beer, hang out with my friends, and talk about security.

Exactly why I started mine!

did we just become best friends?

How long does it normally take for an average person to learn to pick a lock of a money safe?

"money safe" is not really a good description, if you are talking about some residential garbage like a sentrysafe, you are looking at learning in probably... 10 or 15 minutes. if you are talking about an actual commercial grade (group 2 or group 1) safe, it takes a lot of time and training to open one non-destructively. they can be opened in minutes with some good tools and drill points in a destructive manner.

edit: it should be noted that if you are talking about a safe with a key-override, they are generally garbage, and not that hard. there are of course exceptions.

I have a sentry safe... Hearing you refer to it as garbage has me wondering... Are there any safes you recommend for residental use for under 500 dollars?

they are indeed garbage.

https://twitter.com/lockFALE/status/467744075643224064

check out this picture of a girl that had never picked locks before and her posing with a sentrysafe moneybox and our butt dildo.

you should be able to get a gardall or something similar in that price range, honestly your best bet is to find a local safe dealer and talk to them since shipping tends to be ridiculous and you'll end up wanting to source it locally anyway.

edit: i should mention that safes have UL listings, group 2 and group 1 safes are usually pretty decent. I would still avoid anything you buy at lowes or home depot.

Assa-Abloy: their shit really secure?

some would say they have their shit on..... lockdown.

What is the most pick-resistant cylinder sold in the United States today?

I'm a pretty big fan of abloy protec. The company seems to rapidly address any issues, and the locks are built to ridiculous standards. The US government uses medeco locks for basically everything, but these have been picked by a pretty elite handful of people. keep in mind things like..... whats weaker the door and lock or the 3/4" sheetrock next to it.

In that case, how would you compare Abloy to Medeco to Mul-T-Lock?

Also, what are your views on a) restricted key blanks; and b) quasi-mechanical/electric keys, e.g. the Cliq variant?

so abloy, medeco, and mul t lock all work under different premise, with mul t lock and medeco being sort of not really similar.

Mul t lock uses a pin-in-pin system, there is an outer pin sleeve, and an inner pin, and tons of serrations and nastiness. i would say these are probably my least favorite of the locks i would actually buy.

medeco uses a rotating pin system, basically there is a slot cut in the edge of the pins, and the pins have a spade shape rather than round. the spade shape sits in a groove cut in the key, and when rotated to the proper direction, the slot in the pins all line up, and allow a sidebar to slide into the slot. its kind of hard to describe, but you can google some cutaways.

abloy uses disk detainers rather than pins. the key is shaped that as it rotates, it rotates the disks into position, and a bar can drop into notches cut in the disks. this is A LOT like how a safe door operates.

I think the disk detainer design is better overall, and abloy improves on the basics with their ridiculous quality control.

How can I truly "lock" something, so that no one can move it/take it. For example: a bike, or the lock on a box of private documents?

you can't.

basically security comes down to 2 categories.

1. Tamper Evident
2. Tamper Resistant

What this means is with tamper evident the goal is not to keep someone out, but its to know that someone got in. lots of things are link this.... an envelope is a simple example. or the plastic nonsense they put on your power meter.

Tamper Resistant on the other hand, the goal is not only to know that someone GOT IN, but to keep them out Long enough to respond. That last bit is important.... you'll never keep someone out forever. The goal is to do a risk assessment, determine the length of time it takes you to:

1. Identify the threat exists
2. Determin the appropriate response
3. Implement the response
4. Response stops the threat

this means if you know that someone will walk by your bike, on average 15 minutes... and it would take 5 minutes for them to identify the bike is being stolen, 10 minutes for the police to show up and stop the guy.... you realistically need to keep them out for like... 30 minutes.

buy a good lock :)

All this is good THEORY, in reality you just need to have shittier stuff than your neighbor, so people rob him instead.

Do you play Skyrim, and if so, what level is your lockpicking skill?

i only pick locks in real life simulator. the graphics are great but the story is kind of depressing.

What do you think of the toool emergency lock pick card and limited edition defcon set, available here, as a backup or EDC?

What is a good metal stock to use to bend your own picks that is easily available? Street sweeper bristles aren't common in my area.

Do you have a good resource for determining legality of picking and carrying picking tools in different states/ cities/ countries?

Do you have any interest in forced entry, for example using halligans, etc.?

Do you ever think of picking in terms of emergency preparedness? Like say you are trapped in a burning building and the only way out is a locked door.

Hoping you get to these, thanks for doing the AMA.

wow lot of questions here, lemme make sure i get to them all.

1. I think the break away picks are a GREAT backup, but a TERRIBLE primary set. The metal is soft, the handles are trash, and they tend to have burrs from the removal tabs. All that being said i would take them over some improvised bobby pin or paper clip picks anyday.

2. as you mentioned a lot of people use street sweeper blades, I personally prefer hacksaw blades (cheapest you can find, never use bi-metal blades, they break). some people use the metal stiffener from old wiper blades, auto parts stores usually have a ton in the trash outside on rainy days. this metal tends to be kind of soft, but it works. Some people like to use "feeler guage stock", but i have never found a good source for it so i dont use it.

3. the BEST resource is for sure is this page from TOOOL http://toool.us/laws.html keep in mind it may be out of date in some cases so you MUST look up and read your states statute yourself and validate. As for international im afraid i wont be much help, i would reach out to some international pickers on lockpicking101.com and ask for help

4. yes, i have a LOT of interest, check out this series on youtube, its silly https://www.youtube.com/watch?v=NemNhkF4ZV4

5. Honestly emergency preparedness is not really something we have worked on much, as its outside most of our expertise. Personally if the building is burning down i would not want to have to rely on ANY of the FALE guys to save my butt. If you need someone to break into a building, social engineer their way to the server room, hack into your old ass mainframe and steal your companies financials then we have the crew :)

why did you get fired from BSidesLV?

you.

Teach people to pick locks..as a skill to build a career?

Really our focus as a group is to make people more educated about their security. One of the ways we do this is by showing how trivial it is to pick many locks. if a novice can pick up a set of picks, and with 15 minutes of practice pick a masterlock consistently under 5 minutes is the problem the lock or the fact that someone showed them how to pick?

Hi,

Is it possible to pick a medeco lock? How would you apporach the challange of trying to pick a medeco lock?

Like any other lock, with a few exceptions. first, medecos are really well made locks. second, they have a sidebar. First, remove all the pins and the sidebar. Start by putting one pin stack back in place, and pick that with no sidebar. then put the sidebar in and learn to pick it with the rotation aspect. Then do the same for 2-6(or 7) pins.

[deleted]

I have a kwikset on my house. You are better off locking your doors, getting some decent anti-theft coating on your glass (doors,windows) and getting a dog and some good exterior lighting than worrying about your home locks. Homes were not designed to be protected, they were designed to look pretty, and keep you dry when it rains. also buy cheap stuff so people rob your neighbor. that being said, i'm a pretty big advocate of businesses protecting their stuff. Their buildings CAN reasonably be protected if they take steps, schlage makes a lock called the schlage primus thats pretty decent, I can pick an everest in about the same time as any other decent lock. check out https://www.thinkpeterson.com/tensiontools.html to see why.

Where's a good place to buy bump keys, and what do we need to know when buying a set?

theres a few places, i dont want to advertise for anyone in particular, feel free to PM me and i'll shoot you some places.

The best thing to know about bump keys is they can damage locks pretty easily, and you are better off learning to pick.

That's pretty sketchy proof, friend, because anybody can link to a website. Do you have anything else?

sure what would make your heart super happy.