Combination Lock Boxes

[-]Dagon2y93

The primary access control for homes (for most of us) is social and legal, not mechanical. Locks are a statement of intent, and a Schelling line to make it very clear that uninvited entry is a violation (and usually a crime). Simply hiding a key is good enough in most cases, but it's not tamper-evident, so doesn't leave evidence if someone finds and misuses it. A lockbox is a fair middle-ground: it's sometimes defeatable without evidence, and it's possible for someone to steal or copy the key without knowing who, but mostly it's sufficient.

I'm a BIG fan of modern networked electronic locks - they take a key, but also have a keypad with app-based settings, so you can give unique temporary codes to visitors, and track which codes unlock the door when. This makes unexpected use really stand out, and gives at least a chance to prevent problems and change the misused code.

They do require batteries - the Schlage ones at our house, cabin, and parents' house take 4xAA, which last 7-12 months, depending on usage, and the app notifies long in advance of needing replacement.

[-]kithpendragon2y73

These boxes are generally less secure than the locks the keys are meant to access, decreasing the overall security of the house. Combination boxes can often be opened or decoded quickly with a lower-skill attack than most pin-tumbler locks. An attacker then has direct access to the key, which can be used to make a copy.

Maybe that's not a deal breaker, but it should be acknowledged.

Eyes open.

[-]jefftk2y50

Combination boxes can often be opened or decoded quickly with a lower-skill attack than most pin-tumbler locks.

Is this actually true, for the low-end locks most people put on their houses? My understanding was they can generally be bumped quickly and easily?

[-]kithpendragon2y40

Yes, but bumping requires a carefully modified key. These are tricky to get right, only fit one keyway each, and are often illegal to carry.

You could also use a picking gun for a low-skill attack, but they tend to be expensive and noisy.

On the other hand, decoding the kind of lock pictured in the post can sometimes be done without any tools at all, or may require a cut-off bit of metal from a soda can. And an alarming number of key safes (and, worse, gun safes) can be opened by inserting a bent wire between the lid and the case, and manipulating the locking mechanism directly. Once you know the easiest way in, no real skill is required.

Oh, and we can copy keys from a photo now, so an attacker doesn't even need to put hands inside the box to silently compromise security.

In general, we should prefer to never protect a security device with a weaker security device.

[-]nim2y30

IMO, a hidden realtor box is better than a hidden key, but a hidden key is better than a realtor box in plain sight.

The actual bar that a key management system needs to exceed is "harder than breaking a window". Once breaking in through a window is easier, a sufficiently motivated attacker will just do that instead.

[-]RamblinDash2y33

You can also put these boxes in a relatively less visually obvious place, for a marginal increase in security thru obscurity.

[-]Jim Hays2y10

When using such a lock, I would recommend not choosing a repeated digit, simple increasing/decreasing pattern, year within the last 100 years, nor a date in the form MMDD. If you do, the possibility space for the lock is decreased by a factor of 20+.

[-]jefftk2y20

On the other hand, if you don't the space is decreased by a factor of 19/20 ;)

[-]Michael Friis2y10

Another approach is to install a smart deadbolt or door lock with a keypad. We had a Schlage Connect for years. I liked that one because the keypad is capacitive. I recently switched it out for an Aqara U100 which also has a capacitive keypad but also supports Apple Home Key and fingerprints. In my experience changing a door lock is not too difficult if you're handy.

LESSWRONG
LW

LESSWRONG
LW

17

Combination Lock Boxes

17

17