Where to buy a safe

[Nosferatu]

Are you looking for a safe or a gun locker?

All the big box retail stores sell gun lockers. Find the one that fits your size and budget requirements. Don't worry about the name on the front, they are all pretty much the same.

If you're looking for an actual safe that will give some fire and theft protection, skip the big retailers and go to a local safe specialty shop. They will help you find the right one for you and will deliver and set it up in your house where you want it.

For just a few guns, any kind of locking cabinet is fine.

 

[orygun]

Try it. Go to Tractor Supply where they have Winchester safes on display, and follow my instructions. It tells you in the owner's manual what to do if you forget your combination, and the people at Tractor Supply damn well know it because that's how they changed the combination in the first place.

I will check it out.

 

[Koda]

Try it. Go to Tractor Supply where they have Winchester safes on display, and follow my instructions. It tells you in the owner's manual what to do if you forget your combination, and the people at Tractor Supply damn well know it because that's how they changed the combination in the first place.

Why would a store take the time to change the default combinations on all their safes? The Winchester instructions say your supposed to change the factory combination to your own, then if you forget yours you have to write them, prove your the owner, pay a fee to get a reset code specific to your serial number. I really doubt replacing the battery will reset to the old combination.

 

[trukinbear]

Why would a store take the time to change the default combinations on all their safes? The Winchester instructions say your supposed to change the factory combination to your own, then if you forget yours you have to write them, prove your the owner, pay a fee to get a reset code specific to your serial number. I really doubt replacing the battery will reset to the old combination.

Well Tractor Supply, where I bought my safe did indeed set the combination to their store default, which I promptly forgot, and that's the default combination from Winchester, and the instructions - they didn't even ask what model, much less the non-existent serial number or proof of purchase. To say I'm disappointed would be an understatement. Next time you're in Tractor Supply give it a try. I'd wager all the lookalike Chinese safes that look like them behave much the same.

 

[swoolley]

Well Tractor Supply, where I bought my safe did indeed set the combination to their store default, which I promptly forgot, and that's the default combination from Winchester, and the instructions - they didn't even ask what model, much less the non-existent serial number or proof of purchase. To say I'm disappointed would be an understatement. Next time you're in Tractor Supply give it a try. I'd wager all the lookalike Chinese safes that look like them behave much the same.

I am not sure I'm reading you correctly. Are you saying you left it with the default combination rather than follow the instruction manual that says to change it when you get it? I'm wondering what the concern actually is.

The only point for these safes is compliance with the newer Oregon statute (and some county ordinances) that require(s) locking up firearms in case they are stolen. Physical access to any safe usually leads to mechanical destruction in minutes unless you are spending over $10k. Cordless angle grinders changed the theft game.

 

[trukinbear]

I am not sure I'm reading you correctly. Are you saying you left it with the default combination rather than follow the instruction manual that says to change it when you get it? I'm wondering what the concern actually is.

The only point for these safes is compliance with the newer Oregon statute (and some county ordinances) that require(s) locking up firearms in case they are stolen. Physical access to any safe usually leads to mechanical destruction in minutes unless you are spending over $10k. Cordless angle grinders changed the theft game.

No, I'm not saying I left it at the default, but rather that it can be tricked into accepting the default long after you've set your chosen combination.

 

[FelixEstrella]

At the gettin' place.

 

[nammac]

My Liberty safe came from Costal. They frequently have decent sales on them.

 

[swoolley]

No, I'm not saying I left it at the default, but rather that it can be tricked into accepting the default long after you've set your chosen combination.

On some of these safes there is an override screw on them that you can remove to disable the factory override code. On others you need to send the serial number and a notarized request for a serial-specific override code. On some they have a master code and user codes, and so have two layers to be managed. I haven't seen a static override code for all safes in a line that wasn't documented. That would be called a "back door" and would be considered inherently insecure in the software world.

I've been involved in security for a very long time and I am for responsible full disclosure. That means after a private disclosure for up to 3 months (with a commitment to fix), I make a full public disclosure. I've made many vulnerability reports.

If you know of such a problem, you should go public with it. I'll go to Bass Pro Shops which probably has the same safe and try it out myself and also see if there's a way to replace their keypad and inside lock mechanism with an aftermarket replacement.

People need to be able to independently verify their own security, which is why I'm for full disclosure.

 

[joken]

I'm in Ophir. Which way should I go to find a decent gun safe.
TIA, Marian

Costco

 

[trukinbear]

On some of these safes there is an override screw on them that you can remove to disable the factory override code. On others you need to send the serial number and a notarized request for a serial-specific override code. On some they have a master code and user codes, and so have two layers to be managed. I haven't seen a static override code for all safes in a line that wasn't documented. That would be called a "back door" and would be considered inherently insecure in the software world.

I've been involved in security for a very long time and I am for responsible full disclosure. That means after a private disclosure for up to 3 months (with a commitment to fix), I make a full public disclosure. I've made many vulnerability reports.

If you know of such a problem, you should go public with it. I'll go to Bass Pro Shops which probably has the same safe and try it out myself and also see if there's a way to replace their keypad and inside lock mechanism with an aftermarket replacement.

People need to be able to independently verify their own security, which is why I'm for full disclosure.

On these particular Winchester safes, at least from Tractor Supply it appears to be a backdoor. I've already spoken with Winchester at the number provided by TS. They gave me these directions, without asking me for a model number, or proof of purchase. They did not have directions for changing the default. My solution is to remove the keypad assembly, and lock it in a secure safe - they'll either need a key, or bring their own keypad. I imagine every good 2nd story man has a bag full of them.

 

[trukinbear]

Use forceps, or needle nose pliers to unplug keypad

 

[swoolley]

Use forceps, or needle nose pliers to unplug keypad

View attachment 2287074 View attachment 2287075

They also have a coded cylinder key override with the code printed right on the lock. That it only shows 007 suggests maybe they have 15 unique codes and just stock them to mail out to people.

Honestly, that looks trivially drillable because it's a tubular lock.

I initially suspected they were saying that you maybe didn't get your new code saved properly and thus the default code should still be in nvram (non-volatile memory) and a power cycle will ensure it gets unstuck from a bad state that you can try again.

Were able to repeat the hack after you successfully programmed the code?

 

[orygun]

Use forceps, or needle nose pliers to unplug keypad

View attachment 2287074 View attachment 2287075

Or much better yet, buy a safe with a dial, not an electronic key pad.

 

[trukinbear]

They also have a coded cylinder key override with the code printed right on the lock. That it only shows 007 suggests maybe they have 15 unique codes and just stock them to mail out to people.

Honestly, that looks trivially drillable because it's a tubular lock.

I initially suspected they were saying that you maybe didn't get your new code saved properly and thus the default code should still be in nvram (non-volatile memory) and a power cycle will ensure it gets unstuck from a bad state that you can try again.

Were able to repeat the hack after you successfully programmed the code?

Multiple times, every time you remove the battery it forgets the combination you set, and reverts to the default. I've done it enough times that I don't trust the safe, plus just as you noted I saw the code on the lock cylinder, and came to the same conclusion as you.

 

[trukinbear]

Or much better yet, buy a safe with a dial, not an electronic key pad.

I was seduced by a sale price locally, vs a 300 mile trip to buy a real safe for 4x the price. They say you get what you paid for, and I obviously paid for a safe your 7 year old kid could crack.

 

[trukinbear]

I drove down across into California, and bought this in Crescent City. Ironically it's a 'California DOJ Certified' gun safe, which makes me wonder if the backdoor is intentional.

 

[swoolley]

Multiple times, every time you remove the battery it forgets the combination you set, and reverts to the default. I've done it enough times that I don't trust the safe, plus just as you noted I saw the code on the lock cylinder, and came to the same conclusion as you.

Yeah, this is crazy. I think you can open it and disassemble the lock inside the safe, taking pictures as you go, and take both front and back to a locksmith who can order you a Sargent and Greenleaf replacement.

 

[swoolley]

I drove down across into California, and bought this in Crescent City. Ironically it's a 'California DOJ Certified' gun safe, which makes me wonder if the backdoor is intentional.

https://oag.ca.gov/firearms/gunsafe says:

Shall have a locking system consisting of at minimum a mechanical or electronic combination lock. The mechanical or electronic combination lock utilized by the safe shall have at least 10,000 possible combinations consisting of a minimum three numbers, letters, or symbols. The lock shall be protected by a case hardened (Rc 60+) drill resistant steel plate, or drill resistant material of equivalent strength.

With only three decimal digits it's no more than 1000 combinations. if you have a parallel backup system weaker than the first, you can ignore the first system.

It's odd how they require case hardened steel plate of unspecified width, but you can use skinny mild steel for the safe itself of a specified width.

Seems meaningless to me, probably written by safe makers to make sales of cheap safes. They could just limit it to UL listed safes. But that is a made by insurers, not safe makers.

Politicians practice this art called "security theater" when making policy. It doesn't have to work outside of looking good for re-election prospects.

 

[FloridaGurl]

Costco

In Central Point some 140 miles from here?