## GE AccessPoint Combination KeyBox not as secure as it looks

I was a bit disappointed when I received a combination key box that I ordered for a spare key outside of the house. It’s not as secure as I expected.

The lockbox, a GE Supra AccessPoint Combination KeyBox model S5, works by means of a settable combination, that is adjusted using a plastic key, “turning on” each number.

By default, there is no combination set. Simply sliding the lock release downward allows you to open the key safe. There is a plastic removable sleeve that fits onto the door of the lock. Removing this key reveals 10 inset knobs that rotate, one for each number on the pad.

Rotating the knob 180 degrees (one half circle) turns the adjacent number on the front of the keypad to the “on” position. When a number is in the “on” position, it must be pressed in order to allow the lock to open. You can set 1 through 10 numbers to on, so your combination can be 1 number up to 10 numbers long.

Opening the lock requires that you press every button that is in the on position, without pressing any additional buttons.

For instance, If I turn on the 1,0,2, and 3 numbers. Then “1023” must be pressed without pressing any other number. This will allow the lock release to actuate.

The only problem is, you are setting a combination, and not a permutation. This means the numbers can be pressed in ANY order, and the lock mechanism will still release. This greatly reduces the amount of possible combinations, and therefore the security of the device.

In my previous example, the following permutations would unlock the KeyBox:

1023, 1032, 1230, 1203, 1302, 1320

0123, 0132, 0321, 0312, 0213, 0231

2013, 2031, 2103, 2130, 2310, 2301

3012, 3021, 3120, 3102, 3210, 3201

So one 4 digit combination can be opened with 24 different sequences. And this got me thinking. How secure is this lock, and how many possible combinations are there?

After trying to figure the math out for myself, to no success, I found a great site with just what I was looking for. Combinations and Permutations, at Mathisfun.com, had just the answer. I found out that a combination is any sequence that is NOT in order. (why do they call the rotatable number locks combination locks?)

Using the formula at that site, I’ve come up with the answer to how many combinations exist in this lock. It reads, for a 1 number combination (if you were only to turn on 1 number), there are 10 possible combinations (numbers 0 through 10).

1 | 10 |

2 | 45 |

3 | 120 |

4 | 210 |

5 | 252 |

6 | 210 |

7 | 120 |

8 | 45 |

9 | 10 |

10 | 1 |

So, If I were to set my lock to a 4 digit combination, there would be 210 possible 4-digit combinations for this lock. Notice that the number of possible combinations drop as you pass the middle point. This is because a 1 number combination (where you only have to press 1 button to open the lock) is the same as a 9 number combination, since you only have to NOT press 1 button to open the lock.

Given this, you can see, and naturally tell, that a 5-digit combination is the most secure combination, as there are the most amount of permutations in a 5 digit combo using 10 possible choices. In fact this holds true for any number. The most amount of permutations you can get given X choices is by selecting X/2 numbers in the permutation.

Now, in the interest of fairness, assuming the thief does not know how many numbers you’ve selected, he’d have to try all variations of all amounts of combinations to open the lock. This means that there are a total of 1,023 different combinations that can be set on this given lock. This number is derived by adding up all the combinations that can be used for each combination length.

1,023 combinations is certainly enough to stop someone for a while, but it’s not as great as you’d expect.

If you were to setup a recorder or listen for the amount of “clicks” (each button press) it takes someone to open the box, you could effectively reduce the security of the box by over 75%, assuming you didn’t just break it open.

FYI for anyone that has the Accesspoint with 1-10+A+B (so twelve buttons) the numbers are as follows.

1 12

2 66

3 220

4 495

5 792

6 924

7 792

8 495

9 220

10 66

11 12

12 1

Thanks, Robert!