Breaking Dakine Ski Locks

      by Tom Canich <tom@canich.net>
               2020-02-03

  DISCLAIMER: This article discusses a technique to discover the
  combination to a lock.  This information is presented purely for
  educational or entertainment purposes, and as a warning to Dakine owners
  that their locks may not provide adequate protection.  I do not condone
  theft.  If you choose to use this information to deprive others of their
  property that is on you (and I personally consider you to be an awful
  person).

  A family member had forgotten the combination to his lock.  The lock in
question is a bright green, plastic bodied Dakine 4-dial combination lock
with retractable steel cable.  This is an inexpensive lock used for
securing skis to a rack or similar applications.  The combination is
entered by 4 plastic 10-digit wheels.  Each wheel is labeled 0-9 providing
10,000 combinations between 0000 and 9999.  After he had exhausted the few
combinations he thought right, we spent some time attempting to brute force
the combination starting at 0000...a few hundred tries later we weren't
making any progress.

  During this process I noticed that one wheel was sitting higher than the
others.  When I rotated that wheel to another position it lowered back into 
line with the other wheels.  I also observed that when the wheel was in the
high position it could be pushed into the lock body.

  I played with the other wheels and noticed they also had "high spots" in
their rotation.  I speculated that the play in the combination wheels had
something to do with tumblers in the mechanism.  Curious, I set each wheel
to the physically-elevated position and tried to open the lock.  No luck.
Next, I tried pressing in on all 4 wheels while operating the release
mechanism.  This also didn't yield any results.

  After a few minutes contemplation I hit upon a potential solution and set
about testing my idea.  I dialed each wheel to the opposite position from
the elevated position: if 5 rides high, I dialed that wheel to 0; a
high-riding 4 is set to 9, 3 to 8, 2 to 7, and so forth.  After each wheel
was set to the anti-high position I tried the lock release.  Voila!  The
cable released.

  Was his lock defective by giving away the combination this way?  Was the
excessive play in the combination wheels unique to this device?  Another
relative has the exact same lock and the combination is known to him.  We
borrowed it and noted the same play in the combination wheels.  Applying
the same technique we quickly discovered his combination in minute or two.

  The play in these wheels is not likely intentional, however it does
appear to be the result of the lock design or manufacturing process.  This
makes these locks easily breakable by any thief without the use of tools.
If your purpose in using a lock is to provide deterrance rather than
security, the Dakine may be a good choice; for actual security a different
model should be selected.

  I hope this document is interesting and provides some help to those who
have this lock.  To reiterate: I do not condone theft and share this
information only to educate or entertain.  You are responsible for how you
use this knowledge.

  I'd appreciate your comments.  If you own a Dakine lock and test this
technique please let me know if it works, or does not.

(c) 2020 Tom Canich <tom@canich.net>