[00:00.000 --> 00:03.320]  Can I have an on-stage live demo?
[00:03.760 --> 00:07.800]  No, no, this time it's just this introducing the contest.
[00:11.040 --> 00:20.240]  Which is so nice to actually, for the first time in pretty much my presenting career, I'll be able to step off a stage when I'm done and just be like, boom, walk away.
[00:20.680 --> 00:22.800]  Not getting 18 cases worth of crap.
[00:22.800 --> 00:23.840]  Right, yeah.
[00:26.240 --> 00:26.680]  Woo!
[00:27.600 --> 00:31.040]  I remember, I mostly remember the wait.
[00:31.520 --> 00:31.680]  Yeah.
[00:33.040 --> 00:34.320]  This line is not that bad.
[01:24.450 --> 01:29.210]  Just by show of hands while we're waiting to sit down and everything, how many people have been to the lockpicking area?
[01:30.010 --> 01:30.450]  Yeah!
[01:31.530 --> 01:33.750]  Some of you are lying, there's not that much room.
[01:33.750 --> 01:35.290]  I don't even know what was awesome.
[01:35.850 --> 01:37.450]  How many people just saw Ray's talk?
[01:38.090 --> 01:39.470]  How many people thought that was awesome?
[01:40.790 --> 01:41.190]  Yeah.
[01:44.450 --> 01:46.690]  Yeah, he's a hard act to follow, but we'll try.
[01:48.850 --> 01:49.630]  I think we're ready.
[01:49.830 --> 01:50.070]  All right.
[01:50.150 --> 01:51.850]  I'll give a quick intro and then we'll get going.
[01:52.070 --> 01:59.250]  So I do have one interesting and somewhat relevant announcement, although I discovered it's not related to TOOOL or any of the folks running the Lockpick Village.
[01:59.490 --> 02:01.730]  But there's something called the College of Lockpicking.
[02:01.810 --> 02:02.630]  This is not a joke.
[02:04.210 --> 02:07.750]  The College of Lockpicking is fundraising for hackerspaces.
[02:07.950 --> 02:17.030]  For every 10 piece custom lockpick set you buy for 30 bucks, the College of Lockpicking will donate 10 to the hackerspace of your choice.
[02:17.190 --> 02:23.990]  So you can visit the College of Lockpicking there on the second floor of the mezzanine area of the event space.
[02:25.490 --> 02:27.190]  So thanks for hanging with us.
[02:27.350 --> 02:37.090]  We're having, I think, a very successful day and we're going to have a very successful evening and into the morning and just don't plan on sleeping a lot for the next three days.
[02:38.070 --> 02:41.490]  Up next is all about mastering.
[02:41.490 --> 02:48.430]  We're going to talk about mastering the master keyed system by the master of the master keys.
[02:48.430 --> 02:49.110]  No, no, enough of that.
[02:49.310 --> 02:49.770]  Deviant.
[02:49.990 --> 02:50.630]  It's posh.
[02:50.990 --> 02:51.850]  Thank you, Greg.
[02:52.470 --> 02:53.410]  Yeah, Deviant!
[02:53.690 --> 02:54.070]  How you doing?
[02:54.530 --> 02:54.850]  Woo!
[02:55.230 --> 02:55.850]  How you doing?
[03:01.280 --> 03:02.460]  So thank you.
[03:02.720 --> 03:03.600]  Thank you very much.
[03:03.600 --> 03:06.000]  This talk was originally going to be Babak and I.
[03:06.300 --> 03:12.520]  Babak is still, as far as I know, waiting for a flight that's about to take off from Las Vegas, where he is at the Aloha show.
[03:12.880 --> 03:17.180]  So just because we hate ourselves and love you guys, he's at Aloha.
[03:17.380 --> 03:19.380]  I was here coming off of Shaka Khan.
[03:19.480 --> 03:22.000]  He's flying back from Vegas to be here for two nights.
[03:22.240 --> 03:27.260]  Then we both go to Lock Khan, the International Congress of Lockpicking, held this year in Kentucky.
[03:27.400 --> 03:32.780]  Then he gets to go right back to Vegas where he was, because you can never get enough of 114 degrees.
[03:33.460 --> 03:36.980]  Feet on the ground, train at Black Hat, run things at DEFCON, and then come home.
[03:37.100 --> 03:39.360]  And then because I hate myself, I'm going to tour camp.
[03:39.860 --> 03:42.160]  And everything else that I can't even think of until then.
[03:42.820 --> 03:45.900]  How many people get to other conferences around the world, around the country?
[03:46.420 --> 03:46.820]  Excellent.
[03:47.060 --> 03:48.000]  Support other cons.
[03:48.200 --> 03:49.280]  Support your hackerspaces.
[03:49.720 --> 03:50.900]  Support your makerspaces.
[03:51.020 --> 03:54.140]  Support anyone who wants to learn fun stuff.
[03:54.440 --> 03:56.300]  And we love it, love it, love it.
[03:56.360 --> 04:01.180]  When people come by the lockpicking area, we love that in the lockpick village, most people get it.
[04:01.320 --> 04:06.040]  That locks are not these magical black boxes that you're not supposed to look inside.
[04:06.400 --> 04:10.080]  We think that you should look in and play with all of them and see how they work.
[04:10.280 --> 04:11.900]  Understand what your locks are doing.
[04:12.280 --> 04:13.820]  Understand what they're capable of.
[04:14.240 --> 04:15.600]  Understand what you're capable of.
[04:15.880 --> 04:17.900]  And we're going to talk a lot about that right now.
[04:18.800 --> 04:21.920]  So yes, I am up here because I'm dressed in a black t-shirt.
[04:22.100 --> 04:23.140]  You know that I am with TOOOL.
[04:23.560 --> 04:26.340]  If you see me in nicer clothes, I'm usually with my company.
[04:26.340 --> 04:29.280]  But all in the same, we do the same thing.
[04:29.480 --> 04:30.740]  We break into stuff.
[04:30.960 --> 04:33.080]  One, because we think it's fun if I'm with TOOOL.
[04:33.360 --> 04:36.520]  And if I'm with my core company, I'm getting paid to break into stuff.
[04:36.860 --> 04:41.580]  So if you've ever considered a career in physical pen-testing, I can tell you, it's a hoot.
[04:41.960 --> 04:46.580]  Running down stairwells while security is coming after you and you've got a backpack full of financial records.
[04:46.960 --> 04:48.900]  And you're totally never going to jail for it.
[04:50.020 --> 04:52.060]  It's pretty choice, I'll let you know.
[04:54.100 --> 04:58.820]  So TOOOL, where we don't get paid, is actually where we honestly have even more fun.
[04:58.980 --> 05:01.040]  TOOOL is the open organization of lock pickers.
[05:01.360 --> 05:08.620]  And all we do is go around teaching people about this because we think locks are beautiful little puzzles that should be dissected and understood.
[05:09.040 --> 05:10.440]  TOOOL was founded in Holland.
[05:10.760 --> 05:12.160]  TOOOL is now here in the U.S.
[05:12.160 --> 05:19.320]  And as long as you follow the two golden rules of lock picking or lock opening, we'll say, you're usually fine legally.
[05:19.540 --> 05:20.100]  We're not lawyers.
[05:20.400 --> 05:24.140]  Ask Alex or pay him, Alex Muentz, or somebody else and they'll tell you the law.
[05:24.420 --> 05:33.920]  But ultimately, if you do not pick locks that you don't own and if you do not try to open locks on which you rely regularly, you should always avoid hassle.
[05:34.400 --> 05:40.020]  And we can get into more about what we mean there and we always top off every lesson in the lock pick village with these rules.
[05:40.020 --> 05:44.920]  But ultimately, none of this knowledge is illegal unless you do illegal things with it.
[05:46.060 --> 05:58.760]  So really quickly, just in case you haven't been downstairs where we show you that all these different mechanisms are really one and the same, I want to give a quick hit on how locks function, just to make sure we're all starting on the same page.
[05:59.000 --> 06:01.880]  Then we'll go through the real meat, which is master keyed systems.
[06:03.060 --> 06:06.620]  Most of you do know, I think, that locks involve pins.
[06:06.680 --> 06:09.100]  Somewhere in the most locks involve pins, right?
[06:09.100 --> 06:12.580]  So internally, this is a pin tumbler lock.
[06:13.320 --> 06:17.460]  From the outside, you can only see a little piece of one pin here.
[06:17.560 --> 06:19.900]  This is this reddish pin, we would call that the key pin.
[06:20.520 --> 06:27.360]  Inside, you see it's the key pin and the driver pin here, topped off by a spring making this pin stack.
[06:27.980 --> 06:34.760]  Now at rest, this lock cannot be turned if you have no key in it, because that driver pin is binding, it is in the way.
[06:35.460 --> 06:49.860]  Every time you use a lock, every time you operate it with a key, key goes in, that lifts the pin stack just enough so that the sheer line between those two pins is at the edge of the plug, everything is free to turn because there's nothing obstructing.
[06:50.000 --> 06:50.480]  Make sense?
[06:51.280 --> 06:51.960]  Very good.
[06:52.480 --> 06:55.500]  This is from the side, same song, different verse.
[06:55.640 --> 06:59.000]  It's just a number of pin stacks reaching back into the lock.
[06:59.000 --> 07:03.020]  And they're all the same construction, it's just different heights on those red key pins.
[07:03.360 --> 07:12.620]  Every time you use your key, the cuts on your key, that's called the bidding of the key, has to have the exact right combination of up, down, up, down, matching all the heights.
[07:12.780 --> 07:13.560]  And there you are.
[07:14.320 --> 07:15.040]  Make sense again?
[07:15.740 --> 07:16.480]  Everybody nod.
[07:16.660 --> 07:18.220]  Nice and clear diagrams, yes.
[07:19.780 --> 07:29.720]  Using lock picks, if you come down to the village, you will learn that it's possible to get those pins into the right position, to get all the pins right at the edge of the plug without a key.
[07:30.140 --> 07:31.820]  We're happy to show you how to do that.
[07:31.980 --> 07:38.260]  It involves basically just stressing the system slightly, as with a lot of hacking, you twist and bang on it and see what falls out.
[07:38.500 --> 07:47.700]  You know, you stress the system in just the right way, you cause some force and some tension and some binding, and you reach around and you can manipulate pins with sort of a hunting, seeking action.
[07:48.720 --> 07:50.880]  Please come on down if you've never tried it.
[07:51.080 --> 07:53.060]  Once again, let's see those hands, who's done some lock picking?
[07:53.780 --> 07:54.580]  Is it easy?
[07:55.380 --> 07:55.780]  Yes.
[07:56.000 --> 07:57.960]  Who has never opened a lock with picks before?
[07:58.980 --> 07:59.380]  Beautiful.
[07:59.600 --> 08:01.100]  I want all those people downstairs.
[08:01.460 --> 08:03.960]  I want you downstairs after Ray does his handcuff demo.
[08:04.160 --> 08:04.980]  We're going to stick around.
[08:05.140 --> 08:06.180]  We're around all weekend.
[08:06.480 --> 08:07.640]  We love for you to come by.
[08:07.760 --> 08:09.720]  We really appreciate whenever you come by and learn.
[08:09.880 --> 08:12.040]  And it's just as easy as pop, pop, pop, pop, pop.
[08:12.700 --> 08:14.420]  Now, let's say you don't have picks.
[08:14.420 --> 08:20.180]  Or let's say you're in a situation where you're attacking a more complicated lock, something not quite so simple.
[08:21.100 --> 08:24.180]  Let's say you're in a large institution type building.
[08:24.440 --> 08:29.760]  Big offices often will not want to have a billion different keys for every door.
[08:30.220 --> 08:34.960]  Big institutions of education, colleges, a lot of college campuses and dorms.
[08:35.120 --> 08:37.480]  All of these are master keyed systems.
[08:37.840 --> 08:41.880]  Many of you are probably familiar with this term, yes, where there's different levels of permission.
[08:41.880 --> 08:44.260]  Some keys will only open one door.
[08:44.500 --> 08:46.760]  Other keys will open a whole series of doors, etc.
[08:47.400 --> 08:50.100]  Which is, you know, I realize it's not a very applicable talk.
[08:50.140 --> 08:52.100]  You don't have like a lot of big buildings in this city.
[08:52.340 --> 08:56.540]  But there are probably a couple, I'm going to guess, that are master keyed.
[08:58.040 --> 08:59.020]  How does it work?
[08:59.140 --> 09:00.640]  In a nutshell, this is it.
[09:01.720 --> 09:02.500]  That's all it is.
[09:03.520 --> 09:08.420]  Additional pins in some or all, but usually just some, of the pin stacks.
[09:08.940 --> 09:11.520]  So we have our red key pins that we saw before.
[09:12.020 --> 09:13.700]  Blue pins are all just drivers.
[09:13.900 --> 09:14.380]  We saw them.
[09:14.700 --> 09:18.400]  But a couple of these pin stacks, you'll see they have small pins in the middle there.
[09:18.500 --> 09:19.600]  Those little teal colored ones.
[09:20.020 --> 09:22.200]  Those would just be called master pins.
[09:23.760 --> 09:27.660]  Occasionally, locksmiths who were in the trade for many years, you'll hear them call those master wafers.
[09:27.700 --> 09:29.820]  Because they're so thin, they're wafer thin.
[09:31.740 --> 09:35.700]  But, how many cons can you go to where people will get an old Python reference?
[09:35.700 --> 09:36.020]  Really?
[09:36.160 --> 09:37.240]  Come on, that's awesome.
[09:38.180 --> 09:40.200]  I dislike saying master wafers.
[09:40.980 --> 09:46.160]  Basically, because if anybody who's done a lot of lock picking, you know there's a whole other kind of lock called a wafer lock.
[09:46.460 --> 09:49.620]  Also found in big office buildings on file cabinets and the like.
[09:50.060 --> 09:55.020]  But instead of muddling those terms, you'll always hear me say, you know, key pin, driver pin, master pin.
[09:55.720 --> 10:02.740]  And the introduction of master pins in some of these chambers causes the potential for multiple shear lines, just at different heights.
[10:03.640 --> 10:07.020]  So here you see it's possible to line everything up at a shear line, yes.
[10:07.440 --> 10:10.080]  But if you have an eight cut on one of your keys.
[10:10.320 --> 10:13.560]  Because all those bidding cuts, they're specifically numbered.
[10:14.040 --> 10:17.840]  Every manufacturer has, you know, starting at like zero would be a blank key.
[10:18.120 --> 10:19.620]  They have a one, two, three, four.
[10:19.720 --> 10:20.660]  They have depths.
[10:20.860 --> 10:23.400]  And you can look up depth charts and keying charts.
[10:23.820 --> 10:26.520]  Most manufacturers do not ever exceed nine.
[10:26.520 --> 10:28.460]  A lot of them don't even go that far.
[10:28.580 --> 10:32.040]  Kwikset, the most common lock around anywhere is most goes to six.
[10:32.420 --> 10:34.480]  Actually goes to seven in master key environments.
[10:34.720 --> 10:35.580]  But that's not common.
[10:36.320 --> 10:38.360]  But if you have an eight cut on one of your keys.
[10:38.420 --> 10:39.740]  Sorry, my second is an eight cut.
[10:39.940 --> 10:47.300]  Well, you don't really know if that eight cut is operating a single pin stack or a six plus a two, which might also operate at a six.
[10:47.440 --> 10:47.940]  You don't know.
[10:48.500 --> 10:52.180]  So unless you take the lock apart, how do you know what's going on?
[10:52.180 --> 11:08.680]  Well, it turns out if you have a key that works in any door to a master keyed system, you can, with very little effort, very little cost, and virtually no suspicious activity, completely extrapolate out the top master key.
[11:08.940 --> 11:10.720]  It's really, really simple.
[11:11.280 --> 11:12.100]  Want to learn how it works?
[11:13.320 --> 11:14.060]  All right.
[11:14.540 --> 11:16.520]  Imagine a hypothetical office.
[11:16.920 --> 11:20.780]  In this office, we have Alice and we have Bob.
[11:20.780 --> 11:22.620]  And they work on different floors.
[11:22.860 --> 11:24.280]  They work in completely different departments.
[11:24.720 --> 11:26.500]  They have keys to their offices.
[11:26.960 --> 11:28.500]  Their keys only work their doors.
[11:29.420 --> 11:32.500]  And to round out our example, we have a few more people we'll talk about.
[11:32.780 --> 11:33.560]  Here's Andy.
[11:34.100 --> 11:35.820]  Andy works on the same floor as Alice.
[11:36.100 --> 11:37.960]  But again, his key only works his door.
[11:38.060 --> 11:38.900]  It doesn't work anywhere else.
[11:39.480 --> 11:41.180]  There's also a janitor, Charlie.
[11:42.640 --> 11:46.520]  And Charlie, he's in charge of Alice and Andy's wing of the building.
[11:46.540 --> 11:48.680]  So his key will work in their office doors.
[11:48.680 --> 11:50.740]  His key does not work in Bob's door.
[11:50.880 --> 11:52.260]  Bob's more secure environment.
[11:54.260 --> 11:58.680]  And you don't have to start scribbling down a whole lot of maths and things, but I'm going to give you...
[11:58.680 --> 12:01.100]  This is a real master keyed system we're about to build.
[12:01.320 --> 12:06.920]  And various times in this talk, I'll talk about these numbers, these bidding values as we go around all their keys.
[12:07.360 --> 12:13.140]  Whenever you read off a bidding value, if you say you need to have a key code cut, there are machines that will cut by code.
[12:13.140 --> 12:14.420]  We'll talk about that.
[12:15.040 --> 12:17.780]  You would start from the shoulder of the key and work your way out.
[12:18.140 --> 12:22.580]  So with Alice's key, remember, low numbers like a zero, it would be no cut one.
[12:22.860 --> 12:24.540]  Low numbers means smaller cuts.
[12:24.700 --> 12:28.080]  So here we have a three, six, two, three, five.
[12:28.540 --> 12:29.140]  Does that make sense?
[12:29.900 --> 12:30.460]  All right.
[12:31.140 --> 12:32.980]  Let's talk about the locks in their building.
[12:33.700 --> 12:35.360]  Well, here's the same way you just saw the people.
[12:35.460 --> 12:36.400]  Here's Alice's door.
[12:36.920 --> 12:38.120]  Below that is Bob's door.
[12:38.460 --> 12:39.580]  Here's Andy's door.
[12:40.200 --> 12:41.740]  Charlie, he just sits in the boiler room.
[12:41.820 --> 12:42.520]  He doesn't really matter.
[12:42.680 --> 12:49.440]  But, you know, he can operate a lot of doors because of these different values of master pins mixed in with the key pins.
[12:50.360 --> 12:56.640]  So if Alice were to walk around the whole building, this is Alice's key being attempted in many doors.
[12:57.680 --> 12:59.500]  Alice's key naturally opens her door.
[12:59.720 --> 13:01.440]  All the pins are right at the edge of the plug.
[13:02.540 --> 13:06.020]  Alice's key looks like it almost would work in Andy's door, but it's not perfect.
[13:06.180 --> 13:07.660]  There's a few positions that don't work.
[13:08.280 --> 13:10.340]  Alice's key does not work in Bob's door.
[13:10.960 --> 13:12.100]  That is Alice's key.
[13:13.700 --> 13:14.580]  How about Andy?
[13:15.280 --> 13:19.180]  Well, Andy, his key doesn't work in Alice's door, but it sure as shooting works in his.
[13:19.500 --> 13:21.460]  And, of course, Bob can't get anywhere.
[13:22.160 --> 13:23.120]  That's Andy's key.
[13:25.140 --> 13:30.580]  Bob, well, he can't do anything on floor A, but, of course, he can operate his own door.
[13:31.120 --> 13:32.300]  This is Bob's key.
[13:33.640 --> 13:39.220]  Now, something I just wanted to show you with Charlie the janitor, this is what we would call an intermediate master key.
[13:39.440 --> 13:44.640]  If the system is built in such a way, Charlie can open Alice's door.
[13:45.400 --> 13:47.140]  He can open Andy's door.
[13:47.560 --> 13:49.200]  He cannot open Bob's door.
[13:49.200 --> 13:51.800]  Even though it looks kind of close, he can't quite make it.
[13:51.900 --> 13:53.120]  Some of you in the front can see that.
[13:53.620 --> 13:59.600]  And it's possible, depending on how technically, you know, you really want to delve into it, you can build all different layers of intermediate mastering.
[14:01.720 --> 14:11.520]  I owe a huge debt of gratitude, as do most of us, I'd say really all of us in the hacker community, to Matt Blaze, a professor down at UPenn, right near where I live in Philly.
[14:11.920 --> 14:17.500]  Matt Blaze, if you are not familiar with him, I don't know what rock you've been living under and not receiving radio signals.
[14:17.980 --> 14:22.960]  But he has put together some of the best research into crypto, awesome code breaking.
[14:23.360 --> 14:24.720]  He's, you know, he's a professor.
[14:24.900 --> 14:25.980]  He's this academic type.
[14:25.980 --> 14:32.140]  But he has this wonderful hackerish spirit that he's carried with him through his original days at phone company labs and engineering.
[14:32.300 --> 14:34.880]  And he's done work on P25 radio encryption.
[14:34.880 --> 14:37.340]  He's done work in so many great fields.
[14:37.640 --> 14:39.540]  Google his name and it pops up everywhere.
[14:40.380 --> 14:44.700]  He has done great work even in physical security, which is not his, you know, field.
[14:45.020 --> 14:51.920]  But he approaches it in this very beautiful computer scientist way, this crypto analyst way, where he's talked about safe cracking.
[14:52.120 --> 14:54.620]  And he's also talked about this master key vulnerability.
[14:55.140 --> 15:04.860]  This is a published attack, which when I first started BSing with some people about it, I said, you know, this would be neat if we talked about this to somebody who hasn't really heard about it before, because this has been out there.
[15:05.080 --> 15:06.420]  I wonder if, you know, where...
[15:06.420 --> 15:08.140]  And someone said, dude, you should pitch that.
[15:08.700 --> 15:10.700]  I'm like, no, like, that wouldn't make a lot of sense.
[15:10.800 --> 15:11.700]  Everyone's heard this.
[15:11.980 --> 15:14.680]  And everyone said, yeah, but, like, we don't really do it.
[15:14.800 --> 15:17.580]  Like, no one's ever really actually done this as an activity.
[15:18.320 --> 15:19.360]  Maybe there's interest.
[15:19.540 --> 15:22.640]  And I asked around, and that's kind of the reaction I got.
[15:22.740 --> 15:26.720]  Everyone said, well, yeah, like, everyone knows Matt, but I've never really, like, seen that done.
[15:27.420 --> 15:28.880]  So now we're friggin' here.
[15:29.360 --> 15:32.160]  So thank you to Matt for all the work that he's put together.
[15:32.320 --> 15:35.200]  Thank him for all the flack he took from locksmiths.
[15:35.640 --> 15:44.500]  Like, I'm pretty sure there was, like, a week-long period when Penn might have been opening his mail, because he was getting really angry letters from people saying, why do you talk about this?
[15:44.660 --> 15:50.780]  But, of course, you guys in this room, you know, talking about a problem, or talking about anything, doesn't make it bad.
[15:50.780 --> 15:54.200]  In fact, in the end, it usually makes people a lot better and a lot safer.
[15:54.380 --> 15:58.200]  So I thank you guys for getting that, and I thank you for being here in this talk.
[15:59.860 --> 16:01.600]  I want to paint a little picture for you.
[16:02.240 --> 16:03.340]  It involves Alice.
[16:04.400 --> 16:10.560]  Let's say Alice has grown tired of her time at this company, and she wants to leave.
[16:11.360 --> 16:16.700]  But maybe a nefarious, you know, other firm says, hey, you're that Alice lady, right?
[16:17.040 --> 16:24.560]  So if you're leaving Widjco, we want some of these papers that are in Bob's office.
[16:24.560 --> 16:25.580]  You know Bob, right?
[16:26.180 --> 16:27.940]  Can you get into Bob's office?
[16:28.720 --> 16:30.620]  And Alice is like, I wouldn't do that.
[16:30.740 --> 16:30.900]  What?
[16:31.000 --> 16:32.820]  No, I don't have a key that does that.
[16:33.000 --> 16:36.200]  And they're like, we'll totally pay you $50,000.
[16:36.300 --> 16:39.000]  And she's like, I'll find a way into Bob's office.
[16:40.600 --> 16:42.920]  Well, Alice doesn't have to break down any doors.
[16:43.220 --> 16:44.540]  She doesn't have to bribe guards.
[16:44.540 --> 16:49.100]  She can keep her whole 50K, you know, being unscrupulous, because you wouldn't do this.
[16:49.360 --> 16:51.060]  Only bad people would do this for profit.
[16:52.080 --> 16:56.760]  Alice doesn't even have to do anything around Bob's office.
[16:57.020 --> 16:58.720]  That's where, if you really are...
[16:58.720 --> 17:00.880]  This is like, this is holy shit kind of moment.
[17:01.000 --> 17:01.320]  You'll see.
[17:02.500 --> 17:03.660]  Alice has a key, right?
[17:03.860 --> 17:05.420]  She's been working at this company for years.
[17:05.420 --> 17:06.660]  It opens her door.
[17:08.360 --> 17:10.720]  Alice has bidding depths on her key.
[17:10.980 --> 17:15.540]  It is called a change key, by the way, because that's the lowest rung on the totem pole of mastering.
[17:16.980 --> 17:26.720]  Using only her change key and only her door, Alice can, with the aid of some blanks in a hand file, extrapolate out the top master key.
[17:27.620 --> 17:29.280]  Let's talk about how that works.
[17:30.400 --> 17:36.520]  Well, her key, which works in her lock, you know, she can infer a few things, but not a lot.
[17:37.000 --> 17:40.520]  She says, well, all the pins right now, I mean, they're all at the edge somewhere.
[17:40.760 --> 17:42.940]  Clearly, it's not binding if I can turn the key, right?
[17:43.440 --> 17:47.140]  But beyond that, you know, she doesn't know if it's all solid pins.
[17:47.360 --> 17:48.040]  It's probably not.
[17:48.040 --> 17:51.100]  If she's in a big building, she's like, I'm pretty sure there's mastering in this building.
[17:51.260 --> 17:52.720]  I've seen Charlie the janitor.
[17:52.860 --> 17:55.980]  He doesn't have 76 keys, and this is like a 10-floor building.
[17:56.880 --> 18:00.000]  But she doesn't know what specific details are going on.
[18:00.140 --> 18:03.640]  And short of taking the lock apart, you know, how do you know?
[18:03.720 --> 18:06.100]  These details are completely hidden inside the cylinder.
[18:07.400 --> 18:08.500]  So what's she gonna do?
[18:09.220 --> 18:12.700]  Well, Alice is going to prepare exploratory keys.
[18:12.700 --> 18:14.520]  And work them as follows.
[18:14.840 --> 18:17.140]  This is exploratory key number one.
[18:18.420 --> 18:21.400]  This first position, she's leaving at a zero cut.
[18:22.300 --> 18:27.620]  And she'll populate out the rest of the key with bidding depths that she already knows are valid.
[18:27.860 --> 18:29.180]  Valid on her change key.
[18:29.600 --> 18:32.620]  So we've got zero, and then six, two, three, five.
[18:33.060 --> 18:33.800]  With me so far?
[18:36.120 --> 18:42.540]  Now, Alice is going to simply sweep this whole range and see what falls out.
[18:43.740 --> 18:53.260]  So right now, you should be aware, unless you're a locksmith, you really don't have to get deep into what is called max, maximum adjacent cut specification.
[18:53.260 --> 18:57.900]  But be aware, locks can behave strangely, let's say.
[18:58.120 --> 19:03.960]  If you violate max too badly, they either will not open with valid bidding depths, or sometimes keys will get stuck.
[19:04.280 --> 19:06.720]  For the most part, we're not going to get heavily into that.
[19:06.880 --> 19:08.840]  But I'll touch on it just when it arises.
[19:09.000 --> 19:10.820]  In this case, this is not a valid key.
[19:12.660 --> 19:15.940]  Alice might even just file down to a one position in this first...
[19:15.940 --> 19:19.340]  Well, nothing is ever zero, like there's never a blank position.
[19:19.680 --> 19:20.140]  Can be.
[19:20.520 --> 19:23.020]  I've made locks that way in contests, because I'm a bastard.
[19:23.820 --> 19:27.040]  But no, there could be, but let's say she starts at one.
[19:28.140 --> 19:33.800]  She can do this hand filing pretty easily with the use of what's called a key gauge, or a key decoding card.
[19:34.160 --> 19:39.560]  You just take a key, slide it into the notch until it stops, and you know what value that depth is.
[19:39.640 --> 19:41.900]  It's very convenient, easier than calipers, let's say.
[19:43.120 --> 19:44.900]  So Alice has this key that she's made.
[19:45.900 --> 19:47.920]  Technically, this is still a max violation.
[19:47.920 --> 19:50.240]  But again, we're not going to concern ourselves too much with that.
[19:51.060 --> 19:53.960]  Alice walks up to her door, which she does every day.
[19:54.120 --> 19:55.060]  Everyone's, hey, how you doing?
[19:55.160 --> 19:55.640]  How's the baby?
[19:56.440 --> 19:57.100]  Tries the key.
[19:58.060 --> 19:58.600]  Doesn't work.
[19:59.160 --> 19:59.700]  Oh, well.
[19:59.880 --> 20:02.480]  She quickly has palmed her other key, so she's...
[20:02.480 --> 20:03.060]  Oh, this is funny.
[20:03.440 --> 20:05.240]  Switches it out, and she goes in.
[20:06.660 --> 20:08.920]  So, she knows that's not a valid cut depth.
[20:09.100 --> 20:10.500]  She says, well, that doesn't do anything for me.
[20:10.940 --> 20:18.480]  And maybe in the privacy of her office, or in a bathroom stall, or depending on how covert you are on a pen-test, you can hide in janitor's closets and other things.
[20:18.500 --> 20:21.120]  I've done filing in weird places in office buildings.
[20:21.360 --> 20:23.780]  But you file down to the next bidding depth.
[20:23.980 --> 20:26.100]  So now she's got a 26235.
[20:26.540 --> 20:28.620]  How are you guys with seeing those bidding values?
[20:28.740 --> 20:29.820]  Can we see them on the screen okay?
[20:30.440 --> 20:30.740]  You all right?
[20:30.740 --> 20:33.320]  Maybe the front row is getting a little screwed, but...
[20:33.840 --> 20:39.900]  Now, notice this looks different because, of course, she's hand filing, but the two opposite this was machine cut.
[20:40.120 --> 20:41.300]  But it's the same value.
[20:41.440 --> 20:42.360]  They're both a two depth.
[20:44.000 --> 20:45.780]  This is no longer a max violation.
[20:45.840 --> 20:49.540]  And I know this because this big head on the key, this is a quick set style head.
[20:49.540 --> 20:51.060]  I can tell it's a quick set system.
[20:51.360 --> 20:52.800]  Kwikset has a max of four.
[20:53.300 --> 20:55.260]  Schlage is like a nicer, you know, spec.
[20:55.260 --> 20:58.140]  Schlage pointy pins max of, I think, six or seven.
[20:59.360 --> 21:01.600]  But she tries the key again, 26235.
[21:02.860 --> 21:03.880]  Nope, doesn't open.
[21:04.860 --> 21:05.920]  All right, take the key out.
[21:06.400 --> 21:07.180]  File it down again.
[21:08.400 --> 21:09.480]  Tries this in the lock.
[21:10.020 --> 21:10.880]  Hey, it opened.
[21:11.720 --> 21:13.560]  But that was probably expected.
[21:13.800 --> 21:14.900]  Does anyone remember why?
[21:15.880 --> 21:17.640]  That was her original key, remember?
[21:17.880 --> 21:19.480]  Her change key had that same value.
[21:19.660 --> 21:21.420]  So she has just duplicated that.
[21:21.680 --> 21:23.720]  But this does tell her good information.
[21:24.260 --> 21:30.100]  She has learned that even though she hasn't checked these pins out at all yet, she knows this key pin is solid.
[21:30.400 --> 21:33.660]  She knows there are no intermediate values from zero to three.
[21:34.440 --> 21:36.680]  There could still be something going on up here, though.
[21:37.180 --> 21:37.960]  So Alice continues.
[21:39.200 --> 21:40.160]  File down again.
[21:40.820 --> 21:41.900]  Stick it in the lock.
[21:42.540 --> 21:43.040]  Open?
[21:43.380 --> 21:43.600]  Nope.
[21:44.720 --> 21:45.300]  Try again.
[21:45.700 --> 21:46.480]  File down again.
[21:46.760 --> 21:47.500]  We've got a five.
[21:47.800 --> 21:48.500]  Stick it in the lock.
[21:49.320 --> 21:50.260]  Eh, nope.
[21:51.560 --> 21:52.560]  File down again.
[21:52.560 --> 21:54.980]  She's got six, six, two, three, five.
[21:55.560 --> 21:56.520]  How about this?
[21:56.860 --> 21:57.280]  Hey!
[21:57.900 --> 21:59.420]  Now that's a little bit of news.
[22:00.460 --> 22:02.060]  What has Alice figured out now?
[22:02.320 --> 22:07.400]  Well, clearly, all drivers have to be out of the plug, out of the shear line, so everything's raised.
[22:07.960 --> 22:09.280]  This is the current picture.
[22:09.880 --> 22:12.680]  So now, again, we haven't touched these other chambers.
[22:12.680 --> 22:14.860]  But Alice says, all right, I know this.
[22:15.080 --> 22:16.080]  I know this.
[22:16.780 --> 22:18.460]  Maybe there's more shear lines.
[22:19.100 --> 22:22.480]  But personally, if I were in Alice's shoes, I would just call it good.
[22:22.660 --> 22:25.800]  I would stop and start checking other things out in the system.
[22:26.080 --> 22:27.520]  There's... you can always go back.
[22:27.660 --> 22:28.680]  You can always take notes.
[22:28.800 --> 22:31.540]  You can always be scribbling and say, oh, let me revisit this.
[22:31.880 --> 22:35.980]  I'm going to give you the most efficient way to bang through this process.
[22:35.980 --> 22:41.300]  And as you try later, maybe somebody's got a lock opening contest involving this technology.
[22:41.660 --> 22:44.460]  Maybe you're going to want to be as efficient and fast as you can.
[22:45.560 --> 22:48.040]  So again, you could keep on going.
[22:48.240 --> 22:49.800]  If you want, try a seven.
[22:50.380 --> 22:51.620]  Hey, okay, it didn't do anything.
[22:52.120 --> 22:53.640]  You could keep on going to the bottom.
[22:53.760 --> 22:55.940]  But remember, quick sets don't go past seven.
[22:56.140 --> 22:58.360]  So if there is more to the bidding range, you could hit it.
[22:58.480 --> 23:00.280]  I wouldn't even be doing that at this point.
[23:01.680 --> 23:03.100]  But now Alice is all right.
[23:03.100 --> 23:05.880]  I'm going to prepare another exploratory key.
[23:06.320 --> 23:10.980]  And Alice is really breaking the bank, considering that blank keys are, what, $1.50 at Home Depot?
[23:12.540 --> 23:16.280]  So Alice has discovered a master value in this first chamber.
[23:16.460 --> 23:17.480]  Does anyone remember what it was?
[23:17.940 --> 23:18.680]  It was six.
[23:19.600 --> 23:22.760]  She's going to leave a blank value in this position here.
[23:22.900 --> 23:23.360]  Zero cut.
[23:23.780 --> 23:25.920]  Anyone remember the last three of her change key?
[23:27.620 --> 23:28.940]  Yes, two, three, five.
[23:29.180 --> 23:30.520]  The value she already knows.
[23:31.580 --> 23:32.700]  Stick this in the lock.
[23:33.220 --> 23:35.440]  Now, of course, the zero depth is never used.
[23:35.660 --> 23:36.860]  So you could save time.
[23:37.420 --> 23:38.740]  You could start with the one depth.
[23:40.320 --> 23:41.740]  Max, of course, is being violated.
[23:42.080 --> 23:43.200]  Don't worry about it too much.
[23:43.600 --> 23:45.660]  But you worry about max when the key doesn't come back out.
[23:46.280 --> 23:48.920]  I'll be annoyed at you if you f*ck up my contest locks.
[23:49.280 --> 23:51.800]  You'll be much more annoyed at yourself if it's like 2 a.m.
[23:51.800 --> 23:54.360]  and you're on a pen-test job and you can't get keys out of a lock.
[23:54.440 --> 23:56.480]  And you're like, oh, shit, this sucks.
[23:57.400 --> 23:58.440]  I've totally done that.
[23:59.800 --> 24:00.600]  So, all right.
[24:00.820 --> 24:02.280]  We've got a six, one, two, three, five.
[24:02.700 --> 24:03.520]  Try the key.
[24:04.240 --> 24:04.820]  Doesn't open.
[24:05.900 --> 24:06.400]  All right.
[24:06.500 --> 24:06.940]  Take it out.
[24:07.440 --> 24:08.100]  File down.
[24:08.300 --> 24:09.300]  Six, two, two, three, five.
[24:09.540 --> 24:10.160]  Max is okay.
[24:11.000 --> 24:11.920]  How are we doing here?
[24:12.040 --> 24:12.580]  Try the key.
[24:13.020 --> 24:13.560]  Doesn't open.
[24:14.960 --> 24:15.840]  File down again.
[24:16.380 --> 24:17.840]  Six, three, two, three, five.
[24:18.440 --> 24:19.240]  Try the key.
[24:20.060 --> 24:20.460]  Nope.
[24:21.880 --> 24:22.700]  File down again.
[24:23.400 --> 24:24.000]  Keep on going.
[24:24.200 --> 24:24.700]  Easy to do.
[24:24.800 --> 24:26.420]  Notice you don't need a new key every time.
[24:26.420 --> 24:30.040]  You can just keep working the same blank key you paid a whole dollar fifty for.
[24:31.140 --> 24:32.140]  Hey, look at that.
[24:32.340 --> 24:33.360]  Six, four, two, three, five.
[24:33.600 --> 24:34.260]  Lock just opened.
[24:34.840 --> 24:37.900]  Now, Alice knows a serious bit of business here.
[24:38.640 --> 24:40.760]  Clearly, the drivers have to be at the plug's edge.
[24:41.140 --> 24:43.760]  She already knew the first chamber that she explored.
[24:43.980 --> 24:45.520]  But look here now what we have.
[24:45.760 --> 24:47.840]  We have a new line.
[24:48.040 --> 24:50.440]  She knows there's another one up here already from her key.
[24:50.680 --> 24:52.300]  This is a lot of good information.
[24:53.220 --> 24:57.980]  We don't know anything about these further depths, but now this chamber is kind of done.
[24:58.620 --> 24:59.580]  Why is that?
[24:59.740 --> 25:03.960]  Well, it's not just because it's rare to find more than one shear line.
[25:04.080 --> 25:04.820]  It's not impossible.
[25:05.060 --> 25:08.440]  But in most environments, only if you're dealing with a huge environment, it's kind of rare.
[25:09.120 --> 25:14.080]  There's also the consideration of master pins that are too small.
[25:15.140 --> 25:16.520]  And what do I mean by that?
[25:16.740 --> 25:21.320]  Well, we know, obviously, that this is a shear line, so there's got to be a double height master pin here.
[25:21.860 --> 25:23.120]  We're basically done.
[25:23.120 --> 25:23.620]  Why?
[25:24.660 --> 25:31.120]  Because master pins that are really small, and I mean like one depth in height, are a bad thing.
[25:31.540 --> 25:33.460]  They f*ck shit up sometimes.
[25:33.800 --> 25:34.780]  They flip.
[25:34.920 --> 25:35.960]  They get messed up.
[25:36.080 --> 25:37.900]  They cause headaches.
[25:38.340 --> 25:41.520]  And most locksmiths will try to avoid using them.
[25:42.100 --> 25:43.600]  It's not to say you'll never see them.
[25:43.960 --> 25:48.600]  I've built master systems that I still had to use once in a while if the master system is big enough.
[25:49.120 --> 25:50.420]  But it's not common.
[25:51.600 --> 25:53.600]  Especially not common to stack two of them together.
[25:54.540 --> 25:56.220]  So Alice would say, well, all right, look.
[25:56.520 --> 25:59.020]  It's unlikely that a five depth is going to exist.
[25:59.860 --> 26:04.100]  You could take the key, you know, you could just try the six to make sure you're still filing correctly.
[26:04.280 --> 26:06.300]  Because some people are really, am I really doing this right?
[26:06.380 --> 26:07.000]  How's my filing?
[26:07.200 --> 26:07.860]  Yeah, it opens this.
[26:08.140 --> 26:08.340]  Hooray.
[26:09.200 --> 26:11.000]  And now, what is, what's deeper than that?
[26:11.000 --> 26:16.320]  Well, in this system, you know, seven is the only deep depth that exists beyond this.
[26:16.640 --> 26:17.600]  But what would that involve?
[26:17.740 --> 26:21.120]  That would also involve a single depth master, which is probably a bad idea.
[26:21.620 --> 26:24.620]  So again, if I were doing this, I would just toss it and move on.
[26:24.780 --> 26:27.200]  I would say, all right, I think I've discovered my other shear line.
[26:28.140 --> 26:31.800]  Move on and prepare another key to explore the next chamber.
[26:32.740 --> 26:37.320]  So if we're going to prepare a third exploratory key, what value is going to go right up at the shoulder?
[26:39.800 --> 26:40.380]  Say it.
[26:40.900 --> 26:41.940]  Yes, six.
[26:42.460 --> 26:44.460]  What value have we discovered at the next position?
[26:45.780 --> 26:46.820]  It will be a four.
[26:46.980 --> 26:48.520]  Without the four, is this a valid key?
[26:50.080 --> 26:51.840]  No, because max is violated.
[26:52.040 --> 26:53.240]  But again, don't worry about that.
[26:53.240 --> 26:54.760]  So here was what?
[26:55.360 --> 26:55.840]  Four?
[26:56.400 --> 26:56.820]  Yes.
[26:57.280 --> 26:58.680]  How about the next position?
[26:59.480 --> 27:00.240]  Right on.
[27:00.860 --> 27:03.340]  Zero goes in the blank because you're about to sweep that range.
[27:03.500 --> 27:05.060]  And the rest is what?
[27:06.060 --> 27:06.080]  Three, five.
[27:06.460 --> 27:06.940]  Exactly.
[27:06.940 --> 27:08.140]  You guys are paying attention.
[27:08.480 --> 27:08.820]  Sweet.
[27:09.040 --> 27:09.940]  I like when people listen.
[27:10.100 --> 27:10.640]  Don't fall asleep.
[27:11.240 --> 27:11.920]  Three, five.
[27:12.560 --> 27:14.700]  So now it's time to sweep this range, right?
[27:14.800 --> 27:15.640]  It's time to explore.
[27:16.220 --> 27:17.380]  Or is it?
[27:18.740 --> 27:21.260]  Let's talk about being a little bit more efficient in here.
[27:21.780 --> 27:23.620]  Does anyone remember her known depth?
[27:24.180 --> 27:24.500]  Two.
[27:24.560 --> 27:25.260]  It was a two.
[27:26.240 --> 27:27.700]  So what's right above two?
[27:28.080 --> 27:28.480]  One.
[27:28.660 --> 27:29.680]  What's right below two?
[27:30.040 --> 27:30.260]  Three.
[27:31.060 --> 27:36.260]  You don't really need to explore the one and the three, because that would involve a single depth master, which would be bad.
[27:36.580 --> 27:42.480]  You don't really need the friggin' two either, because if you're confident you've been filing a few times now, you kind of know what your filing is doing.
[27:42.920 --> 27:44.900]  So you can honestly start this one at four.
[27:45.520 --> 27:46.960]  Why waste your effin' time?
[27:48.020 --> 27:48.820]  Try this.
[27:49.020 --> 27:50.720]  Much more efficient range to explore.
[27:51.740 --> 27:52.980]  Alright, this key is prepared.
[27:53.740 --> 27:54.540]  Alice goes in.
[27:54.880 --> 27:55.960]  Tries it in the lock.
[27:56.300 --> 27:56.900]  Doesn't turn.
[27:57.480 --> 28:01.820]  By the way, has Alice walked to any other office yet in this process?
[28:02.420 --> 28:02.900]  No.
[28:03.880 --> 28:04.780]  Takes the key out.
[28:05.120 --> 28:06.780]  File this position down a little bit.
[28:06.940 --> 28:07.620]  You got a five cut.
[28:08.240 --> 28:09.120]  Try this in the lock.
[28:10.180 --> 28:10.920]  Whoa, come on.
[28:11.280 --> 28:12.160]  Whoa, open!
[28:12.860 --> 28:14.440]  That's always nice to hear, isn't it?
[28:14.520 --> 28:16.100]  You say, open, when you get a lock open.
[28:17.260 --> 28:18.520]  So now, what do we got?
[28:19.360 --> 28:22.480]  Alice says the pins have to be at the edge, and it's probably like this.
[28:22.700 --> 28:24.000]  She knew her own depth.
[28:24.220 --> 28:25.580]  She found a depth below it.
[28:25.720 --> 28:27.120]  I would call that good.
[28:27.900 --> 28:29.200]  Let's explore these guys.
[28:29.360 --> 28:30.640]  We're gonna find things out about them.
[28:31.460 --> 28:32.980]  This is pretty dialed in here.
[28:33.180 --> 28:34.640]  Again, why waste your time?
[28:34.740 --> 28:36.420]  You can always go back later.
[28:36.420 --> 28:40.400]  You can always go back with another key if you really think you screwed something up.
[28:42.080 --> 28:42.360]  So, alright.
[28:43.020 --> 28:45.080]  Would we need to explore the sixth depth on this?
[28:45.700 --> 28:46.400]  I wouldn't.
[28:46.740 --> 28:47.160]  No.
[28:47.620 --> 28:50.020]  I mean, there's a chance, but again, bad idea.
[28:50.260 --> 28:50.860]  How about a seven?
[28:51.040 --> 28:51.680]  I wouldn't.
[28:51.940 --> 28:52.940]  Move the hell on.
[28:54.580 --> 28:55.620]  Prepare the fourth key.
[28:55.620 --> 28:57.120]  You guys already know what's going on.
[28:57.280 --> 28:59.440]  What you found so far, give it a zero.
[28:59.920 --> 29:01.000]  Round it out with what you know.
[29:01.700 --> 29:02.700]  Sweep this range.
[29:03.040 --> 29:04.540]  This, of course, violates max.
[29:04.600 --> 29:07.140]  As long as it's not getting stuck in the door, we're not gonna tell anyone.
[29:08.260 --> 29:10.420]  So, there is a third depth here.
[29:11.400 --> 29:14.280]  If you know that, you could always skip the two and the four.
[29:14.440 --> 29:16.160]  So, you could just go one, five, six, seven.
[29:16.800 --> 29:17.400]  Why not?
[29:17.620 --> 29:20.480]  Like, again, stay away from single away values.
[29:21.200 --> 29:22.640]  So, start off with the one.
[29:23.000 --> 29:23.740]  Throw it in the lock.
[29:23.880 --> 29:24.340]  Does it work?
[29:24.620 --> 29:24.980]  No.
[29:25.460 --> 29:26.220]  Start off next.
[29:26.380 --> 29:29.060]  If you really wanted, you could go to the value you know.
[29:29.240 --> 29:30.580]  Again, just to test your filing.
[29:31.160 --> 29:32.960]  Doesn't hurt to make sure you're filing correctly.
[29:33.320 --> 29:33.900]  Yay, it opened.
[29:34.000 --> 29:34.820]  I was expecting that.
[29:36.060 --> 29:36.420]  Alright.
[29:36.540 --> 29:37.020]  So, we got it.
[29:37.200 --> 29:38.420]  I would file down again.
[29:38.420 --> 29:40.360]  I'd skip and go down to five.
[29:40.940 --> 29:41.900]  Try it in the lock.
[29:42.780 --> 29:43.060]  Nope.
[29:43.860 --> 29:44.420]  You say, alright.
[29:44.840 --> 29:45.900]  File down to a six.
[29:46.540 --> 29:47.540]  Try that in the lock.
[29:49.600 --> 29:50.360]  The seven?
[29:50.520 --> 29:54.600]  I mean, I know that Deviants said they sometimes use seven in master systems with KwikSet.
[29:54.700 --> 29:55.760]  Let's try the seven.
[29:56.660 --> 29:56.960]  F*ck!
[29:58.220 --> 29:59.580]  So, now, you got a problem.
[29:59.960 --> 30:00.800]  Now, you're like, damn it!
[30:00.860 --> 30:05.020]  That friggin' guy told me to be all efficient and I'm skipping values like a maniac.
[30:05.340 --> 30:06.040]  And, damn.
[30:06.760 --> 30:07.420]  WTF, mate.
[30:08.580 --> 30:09.920]  Well, maybe that's the facts.
[30:10.380 --> 30:11.540]  And, maybe that's not.
[30:12.320 --> 30:15.120]  Sometimes, you have, you know, chambers that just aren't mastered.
[30:15.700 --> 30:19.260]  You might question whether you filed correctly, but I would just question the lock.
[30:19.520 --> 30:21.100]  Maybe position four is not mastered.
[30:21.700 --> 30:22.960]  Give it a little, alright, there's my value.
[30:23.060 --> 30:24.680]  Give it a little question mark on your paperwork.
[30:24.940 --> 30:26.800]  Come the hell back to it later if you have a problem.
[30:27.800 --> 30:29.620]  So, this is what we think we got so far.
[30:29.860 --> 30:34.200]  Maybe three, the same value that was on her change key, might just be the master value.
[30:34.200 --> 30:35.500]  Might just be the only value.
[30:36.520 --> 30:38.360]  So, we've got to prepare a fifth key, right?
[30:39.320 --> 30:42.500]  What we know, what we want, sweep the range.
[30:43.240 --> 30:44.320]  Sweep the leg, Johnny.
[30:44.800 --> 30:44.960]  Alright.
[30:46.980 --> 30:48.880]  Prepare, because again, I'm going to skip the zero.
[30:49.320 --> 30:50.940]  There's probably never a zero value.
[30:51.880 --> 30:54.980]  Of course, if you want to, you know, it doesn't hurt to take a second to try it.
[30:55.220 --> 30:58.480]  It's always easy to file instead of trying to glue shavings back on a key.
[30:58.560 --> 30:59.960]  You can't put a key back together, right?
[31:00.240 --> 31:02.920]  So, maybe you try it, maybe you don't, but start at the one if you want.
[31:03.400 --> 31:04.340]  Stick it in the lock.
[31:04.540 --> 31:05.200]  What happens?
[31:05.420 --> 31:05.700]  Whoa!
[31:06.340 --> 31:06.680]  Open!
[31:06.960 --> 31:08.760]  That was a quick hit on that lottery.
[31:09.240 --> 31:11.100]  That is a heaping bowl of win.
[31:12.180 --> 31:15.020]  Because you have probably got this whole system now.
[31:15.340 --> 31:17.040]  You have probably decoded it all.
[31:17.160 --> 31:20.140]  You know that there's another value out here, but you don't give a shit about it.
[31:20.580 --> 31:21.900]  You could sweep the rest.
[31:22.080 --> 31:23.880]  You could say, maybe there's intermediate mastering.
[31:24.080 --> 31:25.220]  I don't know what's going on here.
[31:25.340 --> 31:26.060]  Let's keep filing.
[31:26.200 --> 31:26.740]  The hell with that.
[31:27.220 --> 31:30.800]  I would just start throwing this key in a lot of doors and start seeing what the hell it does.
[31:32.000 --> 31:35.980]  Maybe you make a nice fresh cut copy of it if you have access to a code cutting machine.
[31:36.280 --> 31:39.000]  If you don't, you'll be walking around with a key that looks like this.
[31:39.300 --> 31:49.320]  A little suspicious if someone's walking right up to you, but again, unless they're looking that closely, this is the first time you will ever be walking around to a door that's not yours.
[31:49.320 --> 31:50.360]  If you're trying this.
[31:51.000 --> 31:53.580]  So now, Alice can walk around and wham, wham, wham, wham, wham.
[31:53.900 --> 31:56.160]  Every door in the building open to her.
[31:56.360 --> 31:57.120]  Not with picking.
[31:57.400 --> 31:58.500]  Not with crouching.
[31:58.700 --> 31:59.780]  Not with looking over her shoulder.
[31:59.880 --> 32:01.300]  Just walk up to the door.
[32:01.680 --> 32:02.440]  Act like you belong.
[32:02.540 --> 32:03.640]  You guys know social engineering.
[32:03.880 --> 32:04.860]  You're on the phone.
[32:05.200 --> 32:05.560]  What?
[32:05.780 --> 32:07.600]  They can't put me on the 905?
[32:07.600 --> 32:10.140]  Have you told them about my frequent flyer miles?
[32:10.500 --> 32:12.160]  Alright, I'm going to the meeting.
[32:12.820 --> 32:14.120]  Just breeze right in.
[32:14.220 --> 32:16.240]  If you've got a key, no one's going to question that shit.
[32:18.200 --> 32:19.780]  Absolutely easy to do, man.
[32:20.200 --> 32:24.940]  The only thing you're going to really screw yourself on with hand filing is not being noticed by security.
[32:25.060 --> 32:27.000]  Unless you're filing at your desk.
[32:27.060 --> 32:27.920]  Don't do that.
[32:28.660 --> 32:29.200]  You know.
[32:29.980 --> 32:31.560]  One time we did in a meeting room.
[32:31.780 --> 32:34.960]  Like we just got tired of running back down to the lobby bathroom in this one building.
[32:35.060 --> 32:35.540]  We were penetrating.
[32:35.660 --> 32:37.040]  We just sat in a meeting room.
[32:38.100 --> 32:38.500]  Sometimes...
[32:38.500 --> 32:39.420]  It's a great story.
[32:39.680 --> 32:41.540]  I wish I'd actually take credit for this.
[32:41.800 --> 32:43.060]  Like looking like you belong there.
[32:43.280 --> 32:45.520]  I knew a person who breezed in with a briefcase.
[32:45.520 --> 32:48.200]  And it was full of like family photos and a coffee mug.
[32:48.380 --> 32:49.720]  And they just sat at a cubicle.
[32:49.920 --> 32:51.500]  And put all their stuff out.
[32:52.540 --> 32:53.760]  And like nobody questioned.
[32:53.840 --> 32:55.640]  They went back each day for a week.
[32:56.000 --> 32:58.460]  And they had like a card from the wife.
[32:58.740 --> 33:00.360]  And no, we just took a meeting room.
[33:00.500 --> 33:02.360]  And I was in there like filing, filing.
[33:02.600 --> 33:04.580]  Bobik's like on his machine pwning a network.
[33:04.760 --> 33:07.320]  And some guy comes in and is like, Oh, I thought this room was free.
[33:07.500 --> 33:08.760]  And we're like, no, we're in here.
[33:08.840 --> 33:14.080]  We had it blocked off on the calendar on the internal website that I hope this company has that I'm referencing.
[33:16.300 --> 33:17.420]  So yeah, the only...
[33:17.420 --> 33:18.980]  You're not going to get noticed unless you're crazy.
[33:19.100 --> 33:22.400]  The only problem with filing you may actually have is what I call canyoning.
[33:23.660 --> 33:25.220]  Canyoning is going to get your keys stuck.
[33:25.220 --> 33:30.060]  You see, understand why if the key, the pins are riding up the front blade nice and easy.
[33:30.180 --> 33:33.840]  If they drop in, getting that key back out, that's going to be harder.
[33:34.860 --> 33:37.340]  So again, this is the internals of Alice's lock.
[33:38.300 --> 33:43.500]  These little marks, if you can see the white lines, they represent the mastering depths that Alice has discovered.
[33:44.000 --> 33:45.920]  You can have an alternate lock in the system.
[33:46.040 --> 33:47.840]  I think this is Bob's lock, if I recall.
[33:47.840 --> 33:50.680]  And again, the key you just discovered, it'll work in there.
[33:50.800 --> 33:54.220]  It should work in every door, if it's the top master key that you've decoded.
[33:55.420 --> 33:57.440]  So super winner is you, man.
[33:57.640 --> 34:00.060]  Like, this is easy stuff to pull off.
[34:00.220 --> 34:01.780]  And most locks are vulnerable.
[34:02.440 --> 34:03.920]  Can you mitigate against this?
[34:04.060 --> 34:04.740]  I mean, sort of.
[34:05.120 --> 34:08.440]  There's the idea of restricted keyways or restricted blanks.
[34:08.440 --> 34:14.120]  All that means is that the keyway profile, the actual shape, has been patented or copyrighted.
[34:14.220 --> 34:17.340]  It's under protection in basically in the art.
[34:17.700 --> 34:24.820]  So manufacturers of blank keys who aren't the company who make the lock, those blanks can't get on the market as easily.
[34:25.020 --> 34:28.560]  You can still mill blank keys with a machine called an easy entry machine.
[34:28.560 --> 34:31.820]  It just reads the side profile of keys and starts milling them.
[34:32.060 --> 34:34.340]  A lovely story, I don't think I have a photo of it.
[34:35.020 --> 34:44.080]  The easy entry company got, you know, they didn't get into some trouble, but their clients who are locksmiths, they said, hey, we're going to start telling these locksmiths that they're violating, you know, restricted blank rules.
[34:44.360 --> 34:48.140]  If they start copying people's blank, you know, making keys, that's our profile.
[34:48.480 --> 34:50.580]  So easy entry, wonderful German company.
[34:51.980 --> 34:54.140]  Their billets of metal that go in, they're called Rolex.
[34:54.560 --> 34:58.220]  The billet of metal had two holes here and a hole in it, and it would mill down the side.
[34:58.480 --> 35:00.380]  So if you have, they said, all right, here's what we're going to do.
[35:00.380 --> 35:06.500]  If you have a profile and it's restricted, so the lock might have a ward of metal here and a ward of metal here.
[35:06.920 --> 35:12.140]  So if you want to mill a key, make a blank, that would be a cut here and a cut here.
[35:12.680 --> 35:14.200]  And they said, no, no, no, that's restricted.
[35:14.340 --> 35:14.840]  You can't do that.
[35:14.940 --> 35:20.440]  So easy entry said, all right, turn on, you know, like special copy beater f*ck you mode.
[35:21.260 --> 35:22.160]  And it'll do this.
[35:22.300 --> 35:27.260]  It'll go, a cut here, cut here for no reason, a cut here and a couple more here.
[35:29.040 --> 35:30.160]  And it's a new shape.
[35:30.900 --> 35:37.080]  And the Rolex that they start shipping, the blanks, they have a hole here, hole here, and a nice smiley face right on the key.
[35:37.620 --> 35:40.360]  So they're like, oh yeah, you got that restricted blank.
[35:42.700 --> 35:47.340]  But in truth, you know, you don't mitigate this just by restricting the metal that's out there.
[35:47.340 --> 35:48.880]  People getting blanks can happen.
[35:49.140 --> 35:51.100]  You should have secondary monitoring systems.
[35:51.160 --> 35:54.100]  You should have door open sensors if you have a big proper building.
[35:54.240 --> 35:56.600]  You should be auditing when people can come and go.
[35:56.860 --> 36:07.820]  You can have completely separate zones in your building where just the mastering of one really top tier floor that has nothing to do with the bidding cuts or the mastering pins of anywhere else in the building.
[36:08.040 --> 36:09.560]  Separate ring keys entirely.
[36:10.060 --> 36:15.100]  But essentially, if you really want to be highly awesome, you can move away to other badass lock designs.
[36:15.100 --> 36:17.020]  Just move away from plain pins.
[36:17.740 --> 36:18.920]  Sidebar-based locks.
[36:19.440 --> 36:22.960]  Examples would be the Asa Twin, the Schlage Primus.
[36:23.160 --> 36:27.060]  These are all systems that interact with extra elements on the key.
[36:27.260 --> 36:30.460]  That, yes, it's possible to attack some of these, but it's harder.
[36:31.080 --> 36:34.120]  It's certainly harder than just, you know, sitting there with a hand file.
[36:34.260 --> 36:36.100]  You're not going to make sidebar cuts.
[36:36.100 --> 36:50.080]  Now, there's a little iffiness here in the fact that if you have a sidebar-based system like this in one door of a building, and that door is mastered, it's probably likely that the same sidebar is in every other door in that building.
[36:50.540 --> 37:00.860]  There are some companies who've made ways around this, but for the most part, if you have access, if you are the authorized user of a door and you have that key, it may leak a lot of information out at you that you can use.
[37:01.980 --> 37:04.120]  Some locks have only a sidebar.
[37:04.260 --> 37:08.520]  So you have this awesome wafer-based lock from the Austrian company EVA, whom we love.
[37:08.700 --> 37:12.440]  This is their 3KS, their three-curve system, uses these sliders.
[37:13.200 --> 37:16.260]  Rotating disc locks are excellent in this regard.
[37:16.660 --> 37:20.960]  Rotating disc locks have a little wheel pack that essentially is like a miniature safe.
[37:21.200 --> 37:26.700]  A bunch of wheels all have to be turned exactly right so that gates or notches line up, a bar drops in.
[37:26.840 --> 37:27.940]  It's a beautiful design.
[37:27.940 --> 37:30.800]  You can master rotating disc systems.
[37:31.060 --> 37:35.240]  You can actually build extra wafers, blank wafers when you put the stack together.
[37:35.440 --> 37:39.020]  We don't have to get into the whole functioning of how these locks work.
[37:39.140 --> 37:45.380]  But when you build the pack up, you can put blank wafers in some lower level locks.
[37:45.600 --> 37:48.000]  You can actually make the system masterable.
[37:48.340 --> 37:50.940]  Now, not every locksmith out there knows how to do this.
[37:51.600 --> 37:55.000]  There is one locksmith, you know, here at HOPE who actually can.
[37:55.000 --> 37:58.680]  If anybody goes downstairs and talks to the guys at the security snobs.
[37:59.020 --> 37:59.820]  Anybody know Mitch?
[37:59.960 --> 38:01.360]  Have you seen Mitch's security snobs booth?
[38:01.480 --> 38:02.400]  Him and Sam are down there.
[38:02.940 --> 38:03.360]  Talk to them.
[38:03.420 --> 38:04.480]  Mitch is an Abloy dealer.
[38:04.640 --> 38:05.580]  He's a full disclosure.
[38:05.760 --> 38:06.500]  He's a friend of ours.
[38:06.860 --> 38:08.180]  We don't mind throwing in business.
[38:08.300 --> 38:11.040]  He's one of the only people who can build Abloy systems like this.
[38:11.360 --> 38:14.580]  But he can build you a secure, you know, mastered Abloy system.
[38:14.580 --> 38:18.400]  One in which even if someone, you know, steals the low level lock.
[38:18.560 --> 38:20.200]  Like I have a lot of locks I use when I travel.
[38:20.480 --> 38:22.220]  Someone could take the lock and just cut it open.
[38:22.400 --> 38:26.140]  And it's not going to leak out the full top master level codes.
[38:26.480 --> 38:28.040]  Because you understand that too, right?
[38:28.320 --> 38:32.820]  Like if Alice were not so finesse minded, she could just rip the doorknob off.
[38:33.160 --> 38:34.180]  And dump all the pins.
[38:34.240 --> 38:37.200]  She could measure the pins and just get all the bidding codes right there.
[38:38.540 --> 38:41.120]  But again, you're not going to do that with a rotating disk system.
[38:41.260 --> 38:43.880]  You're not also going to have an easy time of it with a magnetic base lock.
[38:44.220 --> 38:49.320]  The Miwa company in Japan uses these amazing magnetic sliders on the, you know, that work with the key.
[38:49.920 --> 38:54.340]  The, again, Ewa company in Austria, boy, the best magnet base lock I've ever seen.
[38:54.340 --> 38:55.600]  You may have heard us talk about it.
[38:55.640 --> 38:57.540]  The MCS, the magnetic code system.
[38:58.040 --> 38:59.540]  It's got this amazing key, right?
[38:59.780 --> 39:05.060]  And you see, it says, oh wow, look at this little wavy track on the side and these big magnetic paddles.
[39:05.060 --> 39:08.140]  So they must be like, maybe there's some norths and souths in there.
[39:08.640 --> 39:10.860]  There is, just not the way you think there are possibly.
[39:11.420 --> 39:14.840]  This key has these, you know, big round dots on both sides.
[39:14.860 --> 39:17.620]  And a lot of people see it and they say, cool, magnetic lock, right?
[39:17.700 --> 39:20.000]  I mean, which, how often do they switch north and south?
[39:20.720 --> 39:21.720]  They do a lot.
[39:22.100 --> 39:29.160]  Because each one of those disks is a discrete zone of north-south that is rotated into different axial positions.
[39:29.540 --> 39:31.480]  And flipped opposite on the other side.
[39:32.080 --> 39:37.960]  The internal workings of the lock have mini rotors that spin to allow fingers of a sidebar to drop in.
[39:38.380 --> 39:45.220]  Do you think that the plug wall, by the way, in the keyway has to be open in any way for that to work?
[39:45.460 --> 39:45.940]  No.
[39:46.180 --> 39:47.320]  It's a sealed system.
[39:47.680 --> 39:49.840]  The magnetism just radiates out through the housing.
[39:49.840 --> 39:55.520]  It's a beautiful lock, resistant against dirt, fouling, corrosion, resistance against all kinds of attacks.
[39:55.900 --> 39:57.860]  Trying to make, you know, keys that are restricted.
[39:58.080 --> 39:59.120]  I mean, how are you going to make this key?
[39:59.340 --> 40:04.840]  Our German friends made a fake key once by using tiny chunks of neodymium and a key.
[40:04.940 --> 40:09.520]  They kind of set it up and glued it into place and they got it to open one time after reading the real key.
[40:09.680 --> 40:12.200]  And I think one of the magnets might have popped off in the lock.
[40:12.200 --> 40:13.120]  I don't know how well that worked.
[40:14.080 --> 40:19.560]  But, I mean, like, no, seriously, the guys in SSDev, they're just like, boom, these are my balls.
[40:19.640 --> 40:20.260]  We're awesome.
[40:20.980 --> 40:25.620]  It was amazing to see it happen, but it's still, it's not a practical attack in the real sense.
[40:25.720 --> 40:27.200]  I mean, that's a damn secure system.
[40:28.600 --> 40:33.420]  So, again, beautiful stuff is out there, but most locks aren't like this.
[40:33.540 --> 40:35.140]  Most locks are just plain pins.
[40:35.560 --> 40:41.420]  And if you want to try to attack them, well, I don't want you to do this in a building where you're not supposed to be doing this.
[40:41.420 --> 40:43.780]  So, why don't you do it here at HOPE?
[40:44.300 --> 40:46.320]  We have a new contest for you at HOPE.
[40:46.760 --> 40:48.660]  We have some interesting things for you.
[40:49.040 --> 40:55.740]  You're going to start to see, starting tomorrow, these pillars appear around different spots in the con space.
[40:56.000 --> 40:56.960]  There's going to be four of them.
[40:57.600 --> 40:59.600]  And these towers have locks in them.
[41:00.340 --> 41:02.360]  Please just believe me when I tell you.
[41:02.460 --> 41:05.400]  This is not me throwing you dumb misdirection and false info.
[41:05.740 --> 41:08.180]  Each lock is the same lock in every tower.
[41:08.660 --> 41:10.980]  Why did I do it three times in each tower?
[41:10.980 --> 41:15.600]  Because some numbnuts is going to file the key wrong and get it stuck or break something.
[41:15.760 --> 41:18.120]  I didn't want the contest to come crashing down when that happened.
[41:18.380 --> 41:20.140]  So, I built the locks three times.
[41:20.600 --> 41:23.620]  That said, please don't f*ck up my locks during this contest.
[41:23.920 --> 41:25.040]  People will get mad at you.
[41:25.680 --> 41:26.860]  I will get mad at you.
[41:27.420 --> 41:31.280]  But these locks represent part of a master keyed system.
[41:31.400 --> 41:33.740]  There's going to be tower A, B, C, and D.
[41:34.180 --> 41:39.340]  By the way, these towers, which are all wood, could really use some weight on the back of them to hold them up.
[41:39.500 --> 41:40.680]  If you are buying...
[41:40.680 --> 41:41.920]  How many people have the Club-Mate here?
[41:42.460 --> 41:43.360]  Club-Mate, yeah!
[41:44.540 --> 41:48.380]  If you have the empties to those, bring them back down to the guys in the mezzanine level.
[41:48.520 --> 41:49.380]  Give them to them.
[41:49.460 --> 41:50.780]  They're going to put them in cases for us.
[41:50.780 --> 41:55.740]  We're going to use that to weigh down the pieces of wood, if you could be so kind.
[41:56.620 --> 41:58.660]  But you'll see these towers around the grounds.
[41:59.500 --> 42:02.340]  There's going to be a box of keys that we have.
[42:02.920 --> 42:05.660]  There is a small buy-in to this contest.
[42:05.940 --> 42:10.180]  There's a lot of different ways that you can kick in money to help support TOOOL, but I'll explain in a minute.
[42:10.440 --> 42:16.540]  But for a very small buy-in price, probably five bucks, you can reach into this bin and pull out a key.
[42:17.400 --> 42:23.440]  And the reason we are charging is to dissuade people from trying to brute the attack by just trying to keep getting all the keys.
[42:23.760 --> 42:24.840]  Pwn all the keys!
[42:25.320 --> 42:30.620]  Because if you compare a bunch of different keys, you can start to already get information about a master keyed system.
[42:30.740 --> 42:32.600]  You can start, hey, this looks a little close to that one.
[42:32.840 --> 42:34.820]  So we're trying to dissuade people from doing that.
[42:34.940 --> 42:38.880]  Now, if you want to be like Big Joe Moneybags, whatever, you can just keep throwing fives at us.
[42:39.300 --> 42:43.620]  We're not going to let you see what you're grabbing, so you might just pull out five letter A's and be like, shit!
[42:44.660 --> 42:46.200]  That might happen, but you know.
[42:46.740 --> 42:47.860]  You get yourself a key.
[42:48.020 --> 42:49.760]  You can do it with one key if you want.
[42:50.260 --> 42:51.420]  Find where it works.
[42:51.780 --> 42:53.200]  Find the lock tower that works.
[42:54.100 --> 42:55.500]  Get yourself some blanks.
[42:55.860 --> 42:56.680]  Blanks are a buck.
[42:57.060 --> 42:58.520]  Come on, anyone can cough up a buck, right?
[42:59.820 --> 43:01.020]  There are key gauges.
[43:01.260 --> 43:02.320]  I think they are here.
[43:02.440 --> 43:04.320]  They should be delivered to the hotel under my name.
[43:04.360 --> 43:05.120]  I have to go ask.
[43:05.820 --> 43:08.680]  There will be key gauges if people want to buy them to work on them.
[43:08.740 --> 43:09.260]  That's fine.
[43:09.360 --> 43:10.200]  You can't buy them all.
[43:10.200 --> 43:13.460]  There will be a couple reserved in the village for people to do this for free.
[43:13.880 --> 43:15.200]  You can decode your key.
[43:15.460 --> 43:16.580]  Start building yourself a chart.
[43:17.700 --> 43:20.500]  There are hand files for you to file down.
[43:20.720 --> 43:24.420]  Set up keys, exploratory keys, start sweeping with the keys.
[43:24.660 --> 43:31.160]  If you don't trust your filing skills, or if you want to, you know, get a little extra help, there was one other thing I threw in my luggage on the way here.
[43:33.140 --> 43:36.420]  Yes, we did bring an Ilco Ultracode machine with us to HOPE.
[43:37.500 --> 43:44.820]  It might be really noisy, so don't applaud yet until the Statler guys have like thrown a lot of stuff at us for making too much noise in a radio booth.
[43:45.300 --> 43:47.040]  But we will code cut you a key.
[43:47.440 --> 43:50.040]  Again, you want to brute force this entire contest?
[43:50.040 --> 43:51.140]  You can fund TOOOL.
[43:51.440 --> 43:53.840]  Like, throw money at TOOOL, we'll cut you a bunch of keys.
[43:54.120 --> 43:54.320]  Whatever.
[43:54.780 --> 43:56.640]  TOOOL's non-profit and we could use the help.
[43:57.840 --> 43:58.860]  But you go around.
[43:58.860 --> 43:59.940]  You say, alright, I got my key.
[44:00.040 --> 44:00.600]  I'm going to try it.
[44:00.660 --> 44:01.300]  Do this, do that.
[44:01.500 --> 44:01.960]  Try it again.
[44:02.060 --> 44:02.660]  Run it back down.
[44:02.840 --> 44:04.020]  Why do I say run it back down?
[44:04.200 --> 44:06.300]  Well, because the key machine is going to live in the village.
[44:06.640 --> 44:15.620]  And we're going to impose a rule that if the staff here will work with us, and if you can, you know, point it out to someone else, no filing of keys outside of the village.
[44:16.840 --> 44:28.660]  So, much like in an office where you don't want to look suspicious, if other teams see you like trying a key, filing a key, trying a key, if they snap a photo of you filing a key outside of the village, you are DQ'd.
[44:29.240 --> 44:30.180]  You are disqualified.
[44:30.360 --> 44:31.300]  You are not covert.
[44:32.540 --> 44:37.160]  So, running back down to the village, file a key, measure a key, run back up wherever the thing is, try the key, run back down.
[44:37.300 --> 44:39.980]  There's going to be a lot of hackers losing some weight this weekend, hopefully.
[44:42.040 --> 44:50.020]  If you think you figured out the top master key, you could double check yourself and run around to the other locks that you found.
[44:50.140 --> 44:50.940]  Hey, it's working here.
[44:51.080 --> 44:51.340]  Awesome.
[44:51.720 --> 44:58.820]  But this big lock board with these three, which again, I promise you, they're all the same, is going to be in the lock pick village at our front table.
[44:58.960 --> 45:04.500]  If you walk up the first three teams to give us keys, boom, boom, boom, that start to turn these locks.
[45:04.780 --> 45:08.740]  If the key goes in and turns, by the way, we ask you to keep it in there so no one else is sneaking a peek.
[45:09.160 --> 45:10.000]  You get prizes.
[45:10.360 --> 45:11.020]  What prizes?
[45:11.060 --> 45:12.240]  We haven't figured it out yet.
[45:12.240 --> 45:20.580]  I'm going to go by the, you know, top of my head and say, free admission to HOPE next year that TOOOL will pay for, $100 credit in the village, $50 credit in the village.
[45:20.700 --> 45:21.040]  Sound good?
[45:21.140 --> 45:21.560]  What do you think?
[45:24.420 --> 45:24.920]  All right.
[45:26.880 --> 45:28.580]  Thank you, Babak, for missing your flight.
[45:28.780 --> 45:30.640]  I just made that rule up out of my ass.
[45:31.920 --> 45:33.880]  The director's vote by proxy was that one.
[45:35.400 --> 45:35.980]  So, yeah.
[45:36.640 --> 45:37.440]  Are you going to win?
[45:37.440 --> 45:38.020]  Are you going to try?
[45:38.160 --> 45:38.540]  I don't know.
[45:38.620 --> 45:39.400]  I think you can.
[45:39.640 --> 45:41.740]  I think you could totally pull this off.
[45:41.740 --> 45:44.080]  If you do, that would be awesome.
[45:44.260 --> 45:45.280]  We would really love that.
[45:45.400 --> 45:47.020]  We want to see people trying this out.
[45:47.120 --> 45:50.500]  How many people have ever actually done an escalation attack like this?
[45:51.260 --> 45:52.380]  Not too many hands.
[45:52.520 --> 45:56.260]  And you probably did it in college or something where you're trying to get in other dorm rooms and stuff like that.
[45:56.340 --> 45:56.520]  Yeah.
[45:56.900 --> 46:03.840]  So, we wanted this contest because we think it is kind of material that, even though people have talked about, not a lot of people have done.
[46:04.180 --> 46:06.740]  So, that's why I came up with this little game, you know.
[46:07.040 --> 46:09.060]  TOOOL is all about games and public fun.
[46:09.060 --> 46:12.180]  TOOOL is, you know, all about just teaching the community.
[46:12.380 --> 46:14.720]  We love all these locks board groups that are showing up.
[46:14.800 --> 46:16.660]  We love all the friends that we're making.
[46:16.880 --> 46:20.680]  If you've seen any of the groups here that aren't even TOOOL, go by.
[46:20.800 --> 46:21.220]  Say hi.
[46:21.400 --> 46:22.020]  See what they do.
[46:22.180 --> 46:22.880]  See where they'll be.
[46:23.020 --> 46:24.880]  Maybe they're visiting another con near you.
[46:25.320 --> 46:29.800]  We do say that, you know, TOOOL is the only non-profit in the scene as far as we know.
[46:30.000 --> 46:31.360]  TOOOL, we make our own equipment.
[46:31.600 --> 46:37.000]  We put anything we get just back into the organization because we want people to try this.
[46:37.000 --> 46:38.900]  We want people to have fun with this.
[46:39.240 --> 46:41.280]  So, how many people think they might try this?
[46:42.100 --> 46:42.740]  All right.
[46:42.780 --> 46:45.440]  I am going to have to cut some more starter keys.
[46:45.980 --> 46:47.820]  Because I only have about five per lock.
[46:47.960 --> 46:50.060]  But, you know, I'll just start working that ultra code tonight.
[46:50.320 --> 46:51.960]  We're setting this all up tomorrow.
[46:52.220 --> 47:00.080]  We don't want any locks out at night because even though y'all look pretty trustworthy, I don't want anyone banging the locks apart, reading the pins, and cheating everyone out.
[47:00.080 --> 47:07.460]  I want this first time that we ever, you know, have our game of Escalator Action to be really, really good and to work well.
[47:07.780 --> 47:09.960]  All right, old Nintendo players, get the Taito reference.
[47:10.780 --> 47:12.880]  Yeah, so I hope this will be fun.
[47:13.140 --> 47:20.320]  Maybe it'll be a giant train wreck, but I think everyone here is polite enough to try to not just brute force and, I mean, don't just damage force anything.
[47:20.520 --> 47:23.320]  Please be respectful to everyone else who wants to play the game.
[47:23.780 --> 47:25.080]  And we'll see how this goes.
[47:25.420 --> 47:29.280]  Other than that, we'll be downstairs in the village all day tomorrow, all day on Sunday.
[47:29.480 --> 47:31.400]  Ray is going to be down there after his cuff talk.
[47:31.640 --> 47:34.020]  He's going to give lessons, and I appreciate you listening.
[47:34.300 --> 47:35.160]  Thank you so much.
[47:40.490 --> 47:41.990]  The question was, what time is it starting?
[47:42.110 --> 47:42.790]  We'll call that noon.
[47:45.570 --> 47:47.410]  No bumping is the question, and that is correct.
[47:47.610 --> 47:48.370]  Please, no bumping.
[47:48.610 --> 47:51.350]  Although, like, bumping, like, it would damage the locks.
[47:51.470 --> 47:52.710]  But other than that, you're not going to learn anything.
[47:53.290 --> 47:54.810]  You know, oh, look, I bumped it.
[47:54.950 --> 47:55.270]  Awesome.
[47:55.270 --> 47:55.370]  Awesome.
[47:55.530 --> 47:56.210]  What are the values?
[47:56.430 --> 47:57.210]  They're not all nine.
[47:57.210 --> 47:58.150]  I'll tell you that right now.
[48:00.710 --> 48:01.170]  Any other?
[48:01.270 --> 48:01.450]  Yes.
[48:05.080 --> 48:06.020]  I think they want to hear you.
[48:06.100 --> 48:08.720]  I'll repeat, but if you want to come up, they like it when you use the mic.
[48:09.800 --> 48:13.280]  That also helps them graduate and gauge, you know, who's waiting for questions.
[48:14.260 --> 48:14.920]  It's not going to work?
[48:14.920 --> 48:15.040]  It's not going to work?
[48:15.040 --> 48:15.320]  It's not going?
[48:16.420 --> 48:17.120]  A little more?
[48:17.420 --> 48:18.000]  A little more?
[48:18.340 --> 48:18.600]  Maybe.
[48:19.760 --> 48:21.320]  I think you had the right plan to start.
[48:21.520 --> 48:25.340]  Just keep talking into it, and we'll see if the mic level comes up.
[48:25.340 --> 48:26.340]  And then I can hear you, though.
[48:26.640 --> 48:27.400]  I can hear you.
[48:27.480 --> 48:27.880]  Just keep talking.
[48:28.040 --> 48:32.340]  If you just explain MAX again, what it stands for and exactly what it is.
[48:32.440 --> 48:32.840]  Yes.
[48:33.180 --> 48:35.740]  So the question is about MAX, M-A-C-S.
[48:36.000 --> 48:37.780]  What is that exactly going on there?
[48:38.100 --> 48:43.400]  Again, as I say, it's not usually a concern of people outside of the exact field of locksmithing.
[48:43.400 --> 48:55.960]  But MAX, or maximum adjacent cut specification, is the maximum possible differential between two values of bidding on a key or in a lock in chambers right next to one another.
[48:56.300 --> 49:00.900]  MAX values have to be not completely different because of a couple reasons.
[49:01.140 --> 49:12.460]  Primarily, imagine if, you know, a really tall cut, a really, you know, tall pin up here, a really deep cut here, we're right next to one another, the key would either be produced one of two ways.
[49:12.660 --> 49:16.260]  A key being produced by a fixed wheel, you know, notched cutting blade.
[49:16.420 --> 49:18.880]  We go wham, wham, wham with a nice broad hit.
[49:19.080 --> 49:19.760]  A big V hit.
[49:20.340 --> 49:27.260]  Well, this deep cut is going to start colliding in to the space over here that would possibly not even make this cut possible.
[49:27.380 --> 49:28.100]  I mean, the cut is gone.
[49:28.600 --> 49:39.100]  Or, if you narrowed up that V so that you could have like a two next to an eight, well now you've got such a deep canyon wall that you run into that problem of trapping or canyoning.
[49:39.420 --> 49:46.980]  Now, that's avoidable to some degree by having pins that are better made, pins that have a nice sharp tip that'll help to ride in and out.
[49:47.240 --> 49:54.880]  That's why Schlage locks, for example, the second most common lock in the U.S., Schlages have a higher max differential that's permissible than Kwiket.
[49:55.920 --> 49:59.720]  Kwiksets and many of their clones are made with pins that are just a little more rounded.
[50:00.240 --> 50:06.140]  It's easier on the operator, it's less likely to have fouling errors and things, but it does reduce your max potential.
[50:06.500 --> 50:09.080]  It doesn't mean that you can't get a key in and out.
[50:09.320 --> 50:15.880]  It doesn't mean that if you're hand filing, you might not have a really narrow ledge for where your pin's supposed to sit, but it's still kind of there.
[50:16.200 --> 50:20.620]  But it's in the real world, I mean, it's not a good idea to build a system that violates max.
[50:20.780 --> 50:21.800]  Does that make it a little clearer?
[50:22.380 --> 50:22.760]  Excellent.
[50:23.820 --> 50:24.600]  Anyone else?
[50:25.360 --> 50:25.980]  Yes, sir.
[50:26.720 --> 50:27.360]  And then you.
[50:27.740 --> 50:29.440]  I'm guessing you're gonna sell blanks.
[50:29.560 --> 50:31.660]  The question was, are we going to sell blanks?
[50:31.740 --> 50:32.740]  Yep, blanks are a buck.
[50:33.320 --> 50:36.520]  We pass the savings on to you, because cheaper than Home Depot.
[50:36.720 --> 50:37.540]  We got them from a...
[50:37.540 --> 50:40.980]  Again, hopefully those have been delivered by ProLock or somebody.
[50:41.160 --> 50:43.660]  I'm gonna go run down to that desk before they...
[50:43.660 --> 50:44.980]  How long's the line?
[50:45.180 --> 50:47.060]  Is this just, you know, is the line...
[50:47.060 --> 50:49.980]  Did those people actually stay here, or is that a tourism thing in New York?
[50:49.980 --> 50:53.040]  Like, come see the line at Hotel Penn's lobby and just...
[50:53.040 --> 50:54.340]  Honey, I rode the line.
[50:54.500 --> 50:55.020]  It was awesome.
[50:55.140 --> 50:55.780]  Let's do it again.
[50:55.800 --> 50:57.340]  Because I don't know where these people are going.
[50:57.740 --> 50:58.100]  Yes.
[50:58.200 --> 50:59.380]  I'm gonna check to find them.
[50:59.480 --> 51:01.020]  We will have blanks until we run out.
[51:01.200 --> 51:02.020]  We'll just run the game.
[51:02.920 --> 51:04.060]  There was a question over here.
[51:04.660 --> 51:05.520]  Or there wasn't.
[51:05.680 --> 51:05.900]  Yes.
[51:07.120 --> 51:07.440]  Hmm?
[51:07.500 --> 51:08.060]  That was my question.
[51:08.100 --> 51:08.800]  That was your question.
[51:08.940 --> 51:09.200]  All right.
[51:09.900 --> 51:10.380]  Yes.
[51:10.560 --> 51:11.440]  Aside from...
[51:14.660 --> 51:15.360]  Very good.
[51:15.940 --> 51:20.260]  Aside from here, where can one encounter tool meetings and the like?
[51:20.520 --> 51:25.100]  Well, if you visit tool.us, you will find there's a chapter...
[51:25.100 --> 51:27.400]  All the chapters are listed on our meetings page.
[51:27.640 --> 51:29.720]  There are meetings here in New York.
[51:29.720 --> 51:34.620]  There is a meeting regularly held on the third Wednesday, I want to say, of the month.
[51:34.920 --> 51:37.780]  It's held in Washington Heights at a lovely little bar called La Kayla.
[51:38.760 --> 51:42.060]  Dave Hollander, the owner there, is an awesome person who just reached out to us.
[51:42.120 --> 51:43.700]  He said, hey, you're those tool guys, right?
[51:43.800 --> 51:45.240]  Like, I think it's f*cking cool what you do.
[51:45.440 --> 51:46.380]  Do you want to just...
[51:46.380 --> 51:47.100]  He didn't use that language.
[51:47.220 --> 51:48.180]  He's a nice professional man.
[51:49.080 --> 51:51.400]  Sorry to all the moms and dads who brought your kids to my talk.
[51:51.560 --> 51:52.840]  This is a grown folks' language.
[51:54.560 --> 51:54.880]  Yeah.
[51:55.240 --> 51:57.920]  So, I mean, Dave said, hey, you want to come to like our bar?
[51:57.920 --> 51:58.780]  Like, we have this...
[51:58.780 --> 52:01.160]  It's like a bar slash restaurant slash art gallery.
[52:01.340 --> 52:02.400]  It's a nice mixed space.
[52:02.620 --> 52:03.340]  And we just...
[52:03.340 --> 52:03.840]  We sit in there.
[52:04.880 --> 52:06.040]  Tuesday is when it is.
[52:06.280 --> 52:06.560]  Okay.
[52:06.880 --> 52:07.240]  All right.
[52:08.060 --> 52:10.960]  So, yes, we have a chapter in Philly where I'm from, chapter in Boston.
[52:10.960 --> 52:14.120]  If you came up there, chapters peppered all around and the list keeps growing.
[52:14.260 --> 52:16.780]  And I'm getting the five, so I'll do you and maybe one more question.
[52:17.080 --> 52:18.660]  What's the maximum length of the pin?
[52:19.140 --> 52:21.060]  The maximum length of the pin.
[52:22.640 --> 52:23.940]  Oh, that I'm going to use.
[52:24.300 --> 52:27.560]  I will work within the tolerance ranges of the lock.
[52:30.060 --> 52:30.600]  Say again.
[52:32.160 --> 52:32.960]  Are there not...
[52:32.960 --> 52:35.560]  I will tell you, because you're going to see it as soon as you see the keyways.
[52:35.560 --> 52:36.260]  You'll figure it out.
[52:36.520 --> 52:38.560]  Yes, these are Schlage locks in the system.
[52:38.560 --> 52:42.280]  So, they operate down to a nine depth is the maximum depth in these locks.
[52:44.020 --> 52:45.420]  Was there another hand anywhere else?
[52:47.900 --> 52:48.340]  All right.
[52:48.460 --> 52:48.740]  Oh, yes.
[52:48.840 --> 52:49.240]  Go ahead, sir.
[52:49.760 --> 52:51.000]  What typeface is that?
[52:51.740 --> 52:53.100]  What typeface is that?
[52:53.240 --> 52:53.580]  Right there.
[52:53.840 --> 52:54.700]  It's nice, isn't it?
[52:55.740 --> 52:56.760]  It's called acid.
[52:58.060 --> 53:01.460]  The only thing that sucks about it is it has shit punctuation.
[53:01.820 --> 53:04.840]  So, like, those slashes are not acid.
[53:04.900 --> 53:06.640]  I had to, like, format them in a different font.
[53:06.640 --> 53:08.040]  And this is a weird spacing.
[53:08.280 --> 53:09.860]  So, they're like Verdana or something else.
[53:10.020 --> 53:10.620]  But I reduced this.
[53:11.100 --> 53:13.780]  One of these days, I'm just going to, like, get a type editor and fix.
[53:13.840 --> 53:15.300]  Let me get, like, acid, our version.
[53:16.040 --> 53:16.560]  But, yes.
[53:16.660 --> 53:17.380]  The tool logo.
[53:17.560 --> 53:21.460]  The tool logo has Andy Standard is our fun little jaunty thing.
[53:21.600 --> 53:24.180]  And then acid is the thing we use in all of our presentations.
[53:24.180 --> 53:25.020]  Very cool.
[53:25.340 --> 53:27.600]  You know, you don't often get a typography question like that.
[53:27.680 --> 53:28.080]  That's awesome.
[53:29.000 --> 53:32.400]  If you're a font geek, by the way, has anyone seen a documentary called Helvetica?
[53:33.400 --> 53:33.800]  Wonderful.
[53:34.100 --> 53:36.060]  Isn't that a beautiful little story?
[53:36.360 --> 53:38.280]  Like, shit that you never think about every day.
[53:38.400 --> 53:39.280]  You see text everywhere.
[53:39.520 --> 53:40.760]  Go check that shit out.
[53:41.680 --> 53:42.680]  There was one more question.
[53:43.440 --> 53:44.280]  No, there wasn't.
[53:44.340 --> 53:45.080]  I was making that up.
[53:45.760 --> 53:46.080]  Ray.
[53:47.280 --> 53:49.000]  How many people saw this man once again?
[53:49.100 --> 53:49.660]  Big hand for Ray.
[53:57.530 --> 53:58.170]  I'll repeat.
[53:58.390 --> 53:58.930]  There's no mic.
[53:58.930 --> 53:59.330]  It's gone.
[53:59.490 --> 54:03.610]  I just want to shamelessly announce my workshop down in the village now.
[54:03.830 --> 54:04.050]  Yes.
[54:04.570 --> 54:04.890]  So...
[54:08.170 --> 54:08.610]  Yes.
[54:12.200 --> 54:12.940]  Oh, really?
[54:13.120 --> 54:15.760]  Instead of filing back...
[54:15.760 --> 54:17.660]  Oh, Ray is pointing out.
[54:18.100 --> 54:21.540]  So, Ray is doing his workshop at the top of the hour in eight minutes.
[54:22.000 --> 54:23.780]  Ray is from Spotsfrunder der Stratechnik.
[54:24.020 --> 54:25.700]  His English is way better than my German.
[54:25.760 --> 54:26.720]  I just murdered that one.
[54:27.080 --> 54:27.540]  But, yes.
[54:27.560 --> 54:28.760]  Ray from SSDev.
[54:29.080 --> 54:30.580]  They made that setup key.
[54:30.700 --> 54:32.200]  That key for the MCS.
[54:32.200 --> 54:39.160]  And they said it's actually really fun to try to decode master key to another systems because you can just rotate the magnets on the key.
[54:39.620 --> 54:40.480]  That's pretty badass.
[54:40.480 --> 54:40.980]  And if...
[54:40.980 --> 54:43.160]  That would be a little above their pay grade for a contest.
[54:43.320 --> 54:44.960]  But maybe we'll do that at the next LockCon.
[54:47.020 --> 54:47.720]  I think...
[54:47.720 --> 54:48.700]  I think we're getting the light.
[54:48.840 --> 54:49.760]  I think that's gonna be it.
[54:49.960 --> 54:50.780]  Thank you all for listening.
[54:50.960 --> 54:51.620]  Come down to the village.