Traditionally we control access to our houses with “something you have”: a key. This works pretty well, until you have a visitor arrive when you’re not home to give them a key. The traditional way to handle this is to hide a key (under the mat, in a flower pot, etc), turning this into “something you know” (the information about where the key is hidden).
I’ve talked to a few people recently who’ve been enthusiastic about swapping traditional keyed house locks out for combination locks, and while I do see the appeal they’re somewhat expensive and require batteries. But they’re definitely a more secure way to implement access conditional on “something you know” than hiding a key.
Another option to consider, however, is a combination key lock box, sometimes called a “realtor box”:
You set a combination on it, and then store a spare key inside. It is more hassle than a pure combination lock for access, but for a our house it works well. People generally carry their keys, but we still have a reasonably secure option if someone forgets theirs or a guest arrives while we’re out.
The primary access control for homes (for most of us) is social and legal, not mechanical. Locks are a statement of intent, and a Schelling line to make it very clear that uninvited entry is a violation (and usually a crime). Simply hiding a key is good enough in most cases, but it’s not tamper-evident, so doesn’t leave evidence if someone finds and misuses it. A lockbox is a fair middle-ground: it’s sometimes defeatable without evidence, and it’s possible for someone to steal or copy the key without knowing who, but mostly it’s sufficient.
I’m a BIG fan of modern networked electronic locks—they take a key, but also have a keypad with app-based settings, so you can give unique temporary codes to visitors, and track which codes unlock the door when. This makes unexpected use really stand out, and gives at least a chance to prevent problems and change the misused code.
They do require batteries—the Schlage ones at our house, cabin, and parents’ house take 4xAA, which last 7-12 months, depending on usage, and the app notifies long in advance of needing replacement.
These boxes are generally less secure than the locks the keys are meant to access, decreasing the overall security of the house. Combination boxes can often be opened or decoded quickly with a lower-skill attack than most pin-tumbler locks. An attacker then has direct access to the key, which can be used to make a copy.
Maybe that’s not a deal breaker, but it should be acknowledged.
Eyes open.
Is this actually true, for the low-end locks most people put on their houses? My understanding was they can generally be bumped quickly and easily?
Yes, but bumping requires a carefully modified key. These are tricky to get right, only fit one keyway each, and are often illegal to carry.
You could also use a picking gun for a low-skill attack, but they tend to be expensive and noisy.
On the other hand, decoding the kind of lock pictured in the post can sometimes be done without any tools at all, or may require a cut-off bit of metal from a soda can. And an alarming number of key safes (and, worse, gun safes) can be opened by inserting a bent wire between the lid and the case, and manipulating the locking mechanism directly. Once you know the easiest way in, no real skill is required.
Oh, and we can copy keys from a photo now, so an attacker doesn’t even need to put hands inside the box to silently compromise security.
In general, we should prefer to never protect a security device with a weaker security device.
IMO, a hidden realtor box is better than a hidden key, but a hidden key is better than a realtor box in plain sight.
The actual bar that a key management system needs to exceed is “harder than breaking a window”. Once breaking in through a window is easier, a sufficiently motivated attacker will just do that instead.
You can also put these boxes in a relatively less visually obvious place, for a marginal increase in security thru obscurity.
When using such a lock, I would recommend not choosing a repeated digit, simple increasing/decreasing pattern, year within the last 100 years, nor a date in the form MMDD. If you do, the possibility space for the lock is decreased by a factor of 20+.
On the other hand, if you don’t the space is decreased by a factor of 19⁄20 ;)
Another approach is to install a smart deadbolt or door lock with a keypad. We had a Schlage Connect for years. I liked that one because the keypad is capacitive. I recently switched it out for an Aqara U100 which also has a capacitive keypad but also supports Apple Home Key and fingerprints. In my experience changing a door lock is not too difficult if you’re handy.