And no one is interested in ‘fixing’ it near as I can tell, because it seems to work well enough most of the time, and is convenient for a number of parties. Weird huh?
What you are talking about are things like bump keys which exploit known physical limitations in those types of locks in general. There is no way to fix this other than switching to an entirely different internal mechanism.
What is being discussed here is the intentional disabling of existing security features within a locking mechanism which further reduces its effectiveness. This is regardless of the effectiveness of the class of lock overall.
An example would be going to the hardware store and buying a 7-pin tumbler lock but only 5-pins are installed. Yes, all tumbler locks are vulnerable to bump keys but an additional hidden (and fraudulent) act was performed which further compromised my wishes for a "more secure" tumbler lock.
In the case of cryptography, the locks are much stronger and there is vastly more at stake so it's important not to be too casual with the analysis. The 'fix' is to remove all doubt that any such malfeasance ever took place.
For instance, security pins are inexpensive and dramatically increase picking difficulty while not impacting costs by more than a few cents/unit (at most!) or maintenance concerns by any noticable amount.
The all plastic logout/tagout masterlock [https://www.amazon.com/Government-Safety-Lockout-Padlock-Zen...] for instance has all security pins and is a real challenge to pick for most folks (including myself!), and makes it much harder to bump too. It isn't sold as high security. It's cheap, but also has a brass core and brass security pins, etc. so it's not like the core is skimping on things, or could be a major cost. The total (retail!) cost of the lock is a fraction of the 'high security' locks, even though those locks are much much easier to pick and bypass.
The masterlock 'high security' pro series locks didn't have any security pins at ALL and were super easy to pick (or bump, likely) up until VERY recently. By very recently, I mean I just saw it when I checked out their current lineup - and a year or two ago they definitely did not have it!. It looks to have a SINGLE spool pin in it. They're now heavily promoting it as 'bumpstop' tech. I'm guessing LPL or similar finally made some sort of impact, or maybe word of mouth after contractors have all their shit stolen.
Similar locks sold by the 'American Lock' brand (same ownership now) has always had at least one security pin, usually 3 in even their most basic padlocks for as long as they've existed I believe. 100 years?
And that isn't even talking about bypasses which maybe fit what you're describing better. Many of the common commercial and residential locks sold today still have trivial bypasses or decoding that can be done with some practice in seconds by tools sold online. Such as this bad boy [https://www.amazon.com/Master-Lock-M40EURDNUM-Combination-M4...]
And that is just the tip of the iceberg. Is it fraudulent? Eh... there is no real concrete definition for 'high security'! And fraud doesn't include 'mere fluffery' either.
Masterlock certainly isn't claiming TR/TL-30 ratings on any of their stuff!
These issues however have been widely known about in some cases for 50-100 years or more. For instance, doing some random googling I ran across this patent [https://patents.google.com/patent/US917365A/en] for pin within sleeve technology to work around that whole basic pin-tumbler picking issue (from 1908!), and at least according to this random website, spool pins were invented in 1865 by Yale himself, shortly after the first pin/tumbler locks were invented [https://www.art-of-lockpicking.com/security-pins/]!
The patent expired so long ago, it is absolutely laughable to not use them, and it's definitely ridiculous for a pin-tumbler lock to not have at least ONE! If not have all but one of them spool or similar!
I have a hard time seeing how that is any different than selling a secure system with an 80 bit crypto key where the 'secret algorithm' nukes all but a handful of the bits in a predictable way. Or like in the case of well known lock bypass exploits, where there isn't a way to poke the low level protocol to get it to set a known key value and let you take over.
I think what you're getting at cryptography wise, is that unlike most physical locks, the vast majority of cryptographic usage is for data that there is no plausible way to have any confidence the cyphertext wasn't read by some unknown (and actively malicious) party. Bits can be copied perfectly, and stored essentially indefinitely without degradation and at low cost.
And often, where the data is even public (or public like - with no way to control access). And no plausible way to have confidence that it hasn't been copied and someone isn't working on it right now.
And no plausible way to have confidence that this wasn't being done on a massive scale, to nearly everyone, all at once. Even if someone picks a lock to an ATM, for instance, someone has to physically be there and spend actual time when they are at risk to pick it. And there are security cameras and usually some kind of guard or bystanders that can visually identify when something weird might be happening and intervene. That dramatically changes the actual risk profile and ability to extract value.
The majority of situations tech wise, there is no equivalent. It's relatively easy to splice into an underground fiber link going into/out of a datacenter with no one noticing and 'pick' every lock going by and extract whatever you want from it with no one being able to tell for years. If ever.
Frankly, there are also many reasons to be suspicious (or even know for sure!) that is actually being done, right now, by many parties. Some of which definitely don't have the data's 'owners' interests in mind. Most/All, if we're being honest, at least for them as individuals.
Luckily, most of us don't seem to have anything worth stealing (individually), though in aggregate is another matter. And it would be a VERY tempting and VERY difficult to pass up target to not 'steal' all the interesting secrets from Congress and other powerful parties 'in the interest of national security' for instance. Especially the things not on official government computers.
So I guess what I'm saying is - yes, it is absolutely critical to have good crypto. And yes, unlike a padlock guarding a shed, it has dramatically higher risks if it isn't actually a good lock - especially as we use it for banking, commerce, gov't, identity, etc). Especially since we need to be sure it will be good for the foreseeable future, because unlike a cheap padlock we decide to swap out when we figure out it's shit, someone can attack it and get what it was protecting potentially years or decades in the future.
It's also in many parties interests to come up with reasons why people shouldn't have it (at least unless they're friendly/they like them), and there are a lot of market reasons why people won't notice or won't care until the problem is impossible to ignore and the damage is already occurring.
A back door
Or the numerous 'high security' locks with trivial bypasses?
Or, just buy the replacement on amazon I guess [https://www.amazon.com/tsa-key/s?k=tsa+key]
Frankly, it's probably better to just use a random re-usable zip-tie. At least then you won't figure out you lost your 'key' somewhere inconvenient.
[https://www.amazon.com/Master-Lock-Padlock-TSA-Accepted-4683...]
https://www.amazon.com/Pack-Approved-Luggage-Locks-Travel/dp...
But good point. I haven't bothered with one in a long time.
There is no government conspiracy to compromise lock security, except in the specific case of "TSA locks"
But the gov't also doesn't care to make it better except when it helps them (when they definitely could and frankly should if they cared for individuals rights or protection!), because the current situation is very convenient for them.
And if you think cops (or federal agents) don't occasionally 'take a peek' where they aren't supposed to look using that to their advantage (both physical locks using lock picking sometimes, but usually bypasses and the like, and crypto), we've got a LOT of evidence to contradict that. Some circumstantial, some, uh... not. [https://nypost.com/video/lock-picking-cops-charged-after-kic...]
They're usually not doing it while their body cameras are on though.
Assuming they're not that dumb, if they find something juicy, they'll of course figure out a way to come back with a warrant and bust the door down so they can admit the evidence, or 'luckily' show up a the right time to catch someone during a 'routine traffic stop' or similar. Assuming they're being above board. [https://en.wikipedia.org/wiki/Parallel_construction]
Being able to come up with Probable Cause on anyone is actively taught and a prized skill at most Police Academies.
They're definitely not the only one, but they're well known. [https://armypubs.army.mil/epubs/DR_pubs/DR_a/ARN31725-AR_380...] is the current (unclassified) standard I believe, Chapter 6 Section II, which points to the 'DoD lock program' [https://exwc.navfac.navy.mil/DoD-Lock-Program/], including their list of approved lock hardware [https://exwc.navfac.navy.mil/DoD-Lock-Program/Security-Hardw...]. Which has many interesting things there.
A classic 'common' example for a commercial safe that needs to be insurable to store significant quantities of cash or jewelry would be one of the group 1R models from the 8500 series [https://sargentandgreenleaf.com/product/8500-series/]
Every lock manufacturer has somewhere in their files a mapping of key codes, manufacturing codes, etc. to the information necessary to duplicate keys or unlock the combination lock for the default combination as it shipped, with VERY few exceptions, all of which are quite expensive. It's required for manufacturing, QA, and after-sales support. Those expensive models all generally require professional lock smiths.
In most cases with combination locks, this allows them to take the serial # (or for 99% of the safes most individuals ever interact with just model number) and know the combination it shipped with. Most folks never change it.
With keyed locks, it allows them to take the key code (usually a 4-8 digit number/alpha string) and produce an identical working version of the key without ever seeing or touching the key. Sometimes these codes are stamped directly on the lock. Sometimes they're stamped directly on the key. For better locks, it will not be present or impossible to access without compromising or unlocking the lock first. Generally, the better the lock the more inconvenient it is and impossible to non-destructively 'fix' if someone loses the key or combo.
It's almost always trivial to decode a key to get that info, and tools are made to do it for almost all types of locks.
Licensed lock smiths with relations with the manufacturer can acquire most (or all) of that information. Usually literal paper code books. Some of this info of course leaks and gets integrated into software.
Some of it gets controlled by the manufacturer so that the locksmith needs to provide per-customer info and they look it up directly, to control distribution.
Those 8500 series locks have resettable combinations, and any competent locksmith will change it as a matter of course before they let a customer use it. But things slip through the cracks, people get lazy, etc.
Many locks (truck/car keys, house keys, etc.) never get changed from whatever they came as from the factory/in the box, and aren't trivially changeable either.
[https://www.youtube.com/watch?v=pqr8lJWlFH0][https://lockcod...
For some examples of what i'm talking about.
It's niche info, so unless you know what you're looking for, Google isn't likely to give you much anything useful.
However, just like Code Signing keys [https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern...], they're bread and butter type targets for any intelligence agency for obvious reasons. Any such agency that HASN'T acquired such information from the big players is... well not competent at their job. Near as I can tell.
And no, no one has told me anything classified. This is all public knowledge. I just get curious sometimes being around those MOS 35 types occasionally, and I like to research random things.
The book came from a friend of a friend of a friend and was really a stack of photocopied pages from a book. Photocopied so many times that many of the combinations were blurry beyond legibility.
When it did work though it was incredible.
It's harder than LPL makes it look though.
Drilling and cutting shows signs of entry. Picking usually doesn't (at least not unambiguously or in a way a typical person will notice). Despite the old detective novels claiming otherwise.
And replacing the core (which I often do!) requires knowledge and (minor) capital outlay that most folks just don't have.
Notably, out of the box in the US, the locks generally 'work'. Everything is low density, there are alternative means of defending oneself against day to day criminal acts (guns), and generally a gov't that ignores folks - until they come down with unstoppable force on specific targets. There is not (yet) pervasive oppression like a Stasi/East Germany, China/Hong Kong, Gestapo/Reich Era Germany, Franco/Spain, etc.
Notably, European and Asian residences have dramatically higher lock standards and stronger doors.
Both regions are denser, and also have significant history of gov't unrest and a history of much more, shall we say, 'uncomfortable' relations between the gov't and the population. Doing a 'no knock raid' on a residence in any European or Asian city is going to look a lot more like this [https://www.youtube.com/watch?v=wqN7KpcpBLU] for instance than in the US where it's a solid kick and they're in. (random click-baity youtube video, you've been warned!)
I suspect both regions have real, practical security concerns + the population is willing to pay for them because culturally they've learned.
Most American ones at the moment, haven't/don't have those concerns yet. And that is convenient for many parties.
Most people don't have anything worth stealing by anyone who has something to lose. And anyone who doesn't have anything to lose might as well just mug you outside your front door or bash a window in anyway.
[https://therecord.media/senate-dea-bill-targets-end-to-end-e...]