
Threat modelling case study: bicycles - mjohn
http://calpaterson.com/bicycle-threat-model.html
======
gruez
>In fact [both the U-lock and the cable lock] can by cut by an angle grinder,
which can be carried in a rucksack.

The recommendation by LockPickingLawyer[1] is to use a chain lock, because the
thick, hardened chains are non-trivial to cut with a bolt cutter, and it's
hard for an angle grinder to "bite" into the freely moving links.

[1]
[https://www.youtube.com/watch?v=SpVOTEOMRuE](https://www.youtube.com/watch?v=SpVOTEOMRuE)

------
paultopia
Just on bikes in particular, I also can't say enough good stuff about folding
bikes, especially if you have a private office. My commuter bike is a
Brompton: it's stupid expensive (around $1,500), but I literally can just fold
it up, carry it up a flight of stairs, and stick it next to my desk in my
office, and it's basically thief-proof. At home, it lives in a closet.

~~~
laurieg
I came in here to say the same thing. I've been riding my brompton for a year
and a half. I don't even own a bicycle lock. It is either in my apartment,
under my desk at work or being carried by me.

------
foxyv
You need active deterrence. I'm really looking forward to getting a Skunk
Lock.

[https://www.skunklock.com/shop/skunklock](https://www.skunklock.com/shop/skunklock)

~~~
kennywinker
Deploying chemical warfare against theft. We are 100% in the capitalist
cyberpunk dystopia the 90s predicted.

------
stefan_
I'm fully expecting e-bikes to get the radio code treatment, 2020 style.
Central motor an integral, welded part of the frame, mutual authentication
between battery, motor and headunit before a single joule of power is going
into the chain. Chip on board for the integral trust components, then
slathering on a few layers of coating on top. Rekey it all with the smartphone
of the owner every so often.

------
frabbit
Good stuff.

Needs to add another persona though: Smashing Sam who will knock you off your
expensive bike in order to steal it: [https://road.cc/content/news/e-bike-
stolen-after-rider-ramme...](https://road.cc/content/news/e-bike-stolen-after-
rider-rammed-van-driver-reading-276885)

Having had to cut through my own U lock with a portable angle grinder I can
verify that it is not too difficult. The cables are only for the snatch-and-
grab prevention.

Only minor nitpick is that Campagnolo make wheels and groupsets, not bicycles
themselves.

~~~
kennywinker
Skeptical that this is a widespread type of attack. Also, probably much easier
and lower risk of someone taking down your plates to just threaten you with a
knife/taser/lead pipe after you've unlocked your bike and then ride off.

------
MarkusWandel
There's a dig at Sheldon Brown's bike lock strategy, that I think shows
technology creep. At the time SB (who passed away quite a while ago) developed
his strategy, small, battery powered angle grinders weren't a thing. Now they
are so the threat model has evolved. Luckily I live in a relatively low-crime
area and ride relatively worthless bikes. Of course the one bike I ever had
that was worth something was... stolen.

~~~
upofadown
The idea behind the SB strategy is that the small U lock prevents the bike
from being ridden. So if you can cut just the cable you need a way to
transport it somewhere else other than by riding or ghost riding it. "Rucksack
Rupert" is not going to carry off the bike on his back and it is unlikely he
would add in the risk of a vehicle with recordable plates without upgrading to
an angle grinder.

So I think that the article is failing to entirely understand the threat model
in this particular case (or simply disagrees with it).

------
Finnucane
I always figured it was a matter of relative security rather than absolute
security: having a good enough lock that it was easier to take the other guy's
bike. Sorry, guy with cheap lock.

~~~
frobozz
Pretty much all security is relative.

However, it's not just about the better lock, but the apparent value of what
can be stolen.

You can have the best lock in the park, but if you have a brand new top-of-
the-market ebike and all the other bikes are rusty shitheaps with mismatched
pedals and tape hanging off the handlebars, yours is still going to be a prime
target.

