UW Computer Security Research and Course Blog

With many people living off campus, biking is a popular method for getting to class in a timely manner.  Bikes can be quite expensive, however, and riders are usually forced to put them in a public location (for sake of convenience/necessity).  As such, there are some security measures that can be taken to deter thieves from stealing these expensive publicly-displayed commodities.  The most common (and only?) tool used to this end is a bike lock.  For those of you who don’t know, bike locks are basically some loop of metal that has a lock to break the continuity.  The two types I’m familar with are the U-shaped locks (with a bar across the top of the U containing a lock) and, more commonly, the snake of heavy cable that has a lock in the middle somewhere.  With bikes as prevalent as they are, keeping them from getting stolen is a high priority.
Assets and Security Goals

The bikes themselves are obviously the main assets here.  Not only do they represent a possibly sizeable investment, but they’re also a means of transportation for the user, and losing it can cause great inconvenience.

Adversaries and Threats

Adversaries are after one thing: the bike.  These could be fellow (if misguided) students that want the previously mentioned convenience of a bike, or they could simply be petty thieves seeking to sell the bike, complete or piecewise, to other unscrupulous individuals or stores.

Potential weaknesses

There’s a constant tradeoff between the attributes of weight, durability, and cost.  If you lower the weight, then either you decrease durability or increase cost.  As such, many bike locks exist that can simply be cut with tools that are easy to come by.  Worse, many people (bystanders) are apathetic and consider either that clearly the owner lost the key for their lock or it’s not their problem, if they see someone cutting through a bike lock.

Potential defenses

Cable locks are notorious for being easy to cut.  One can’t really make them thicker, because the cable is pretty long and the weight would increase very quickly.  However, a U-style lock, which has a smaller circumference, can stand to be made of thicker metal.  Additionally, these sometimes have serial numbers that enable the owner to order another key from the manufacturer in case they lose theirs.  One has to hope that the manufacturer performs adequate identity checking, lest a determined thief manages to acquire a key from the manufacturer for your lock.  Other ideas include something like an alarm that responds to an inductive current in the frame of the bike (i.e. bike is touch sensitive) or having multiple bike locks to slow down an adversary.

Risks

Obviously, one could simply say that the bike is at risk here, and it is.  But that’s not all that’s at stake.  Not only will you have lost the bike (a sizeable investment in itself), but you’ll have lost the expensive lock and possibly some “accessories” that you may have purchased for your bike, like a helmet (state law, yes?).  Plus there are aftereffects — a victim might have to report their bike stolen, be forced to alter their schedule, or, ultimately, be forced to purchase all new equipment.  Bikes are everywhere, and not everyone invests in adequate security leaving bikes (or front wheels..) just begging to be stolen.

Conclusion

Keeping anything in a public place is always risky.  One just has to hope that no one is gutsy enough to tempt fate by stealing something from a public place, but there are people who do it given the correct tools and adequate determination.  It may not be a big deal to lose a bike when you got the bike on a yard sale or as a hand-me-down, but there are also expensive carbon fiber bikes that individuals pay a good sum for.  Ultimately, as was described in class, “secure” is really not a boolean variable here, but a relative term.  There is nothing that you can do to make it absolutely secure — only something to make the theft time-consuming enough to deter most thieves.