New Kryptonite Charges Were False

It turns out that  Bruce Schneier's charges that the Kryptonite replace locks were also unsafe was dead wrong. I am sorry to have pointed to something that turned out to be be stone cold wrong.  I apologize to Kryptonite for any bried embarrassment I may have caused. As someone wrote recently, we all need to think about the risks we take on trusting single sources of information.

Comments

[orcmid]

The Kryptonite site is still broken. Looks like the server crashed and needs manual intervention.

Meanwhile, I will go get some honest-to-gosh "ground truth" and pedal into the bike shop later today, Saturday, August 13.

[orcmid]

New pop culture quiz: "Kyptonite is to Superman as Bic Pen is to ----------- ."

[This is Jimmy Olsen, unpaid investigative reporter with the scoop.]

When Dennis Hamilton stumbled over the 2004-10 note by Bruce Schneier about the amusing proposed remedy to the vulnerability of Kryptonite locks, Dennis sends a quick e-mail heads-up to Scoble and Israel in case they hadn't encountered that wrinkle in their study of the case. Not exactly the right sequence for bringing calm deliberative attention to important details.

Being conscience-nagged over handing off a possible loose potato, Dennis follows up a phone call with Robert Scoble with a call to a local bike shop and obtains verbal confirmation that the locks are now very different. They don't have those round keys and tube locks any more. That gets reported to Shel and Robert by phone and e-mail later. (Meanwhile, Shel has blogged about it here, etc., etc.)

But Dennis didn't actually set eyes on the new lock, even though he also found out the shop had shoes he needs to replace his ancient and ragged Nike Cross Trainers and he went in to buy some.

Now, here's the ground truth after careful inspection of one of the new locks.

The current Kryptonite Kryptlok has a rather small keyway. The key is a thick, flattened bar and there are rectangular notches in it. The lock is known as a cylinder lock, not a tube lock, and it is very different. There are no visible pins, or anything like that, and there is very little exposed to access. Without the right tools -- I'm sure there are some -- it looks difficult to get very far. It also appears that clumsy but foreceful tampering could well jam the lock and render it unopenable.

The inspected model has UPC 20018-11031. There is an anti-theft guarantee of $1250 US (the guarantee must be purchased for $10-15-20 if you want 1-2-3 years). The shackle is 1/2" hardened high-grade steel and the key location is in the center of the crossbar, not in an end.

The Kryptolok's made in Taiwan and there's a footnote on the packaging that says the guarantee is against product failure and is not to be construed as bicycle insurance.

Meanwhile, both http://www.kryptonitelok.com (identified on the packaging) and http://www.krytonite.com (the URL I guessed) are down and there's no help there.

Also, the package bears a "K-Tough Security Rating" of 3.5 K-Stars, whatever that's about. A slightly different package shows about a 7 on a scale of 10. There's no indication of what the rating is based on.

There you have it. Exactly what I should have found out first instead of putting Shel on the spot with incomplete work and a hasty warning flag on the play in case it mattered for the "Naked Conversations" book.

There's more of interest to me in this around trustworthiness and transparency (mine included) and threat models with Kryptonite as a great example that everyone can understand. I must figure out how to use that.

Here I want to fess up to how I was casual with the first report on Schneier's October amusement and then I didn't independently fact check the phone report that the new locks really weren't just ones with smaller tubes. That's enough lessons for this boy for one morning.