#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice I found these steps a little hard to follow, even though I've been shown how to do this before. In step two, you're finding the wheel that is hardest to turn and then turning it until you feel a gate? And then for step three you go on to the next hardest and so on?
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice Concerning manufacturing defects being a weak spot in locks: does this mean there may be expensive locks, manufactured with high-precision techniques from premium-quality materials, which are a lot harder to pick? Or would they not exist because the economics of the threat model don’t make sense (and, after all, an attacker could just cut them)?
-
@alice I found these steps a little hard to follow, even though I've been shown how to do this before. In step two, you're finding the wheel that is hardest to turn and then turning it until you feel a gate? And then for step three you go on to the next hardest and so on?
@eruonna yes. As a wheel settles into a gate, much like with lockpicking, it'll change which one is binding most. Your job is to find the next most "bindy" wheel.
-
@alice Concerning manufacturing defects being a weak spot in locks: does this mean there may be expensive locks, manufactured with high-precision techniques from premium-quality materials, which are a lot harder to pick? Or would they not exist because the economics of the threat model don’t make sense (and, after all, an attacker could just cut them)?
@acb there are certainly night quality locks with tighter tolerances and fewer flaws, but there are diminishing returns on the effectiveness, and at some point (which is different for each company) the cost outweighs the added security.
For Master lock, that cost is pennies
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
Sometimes it's not 0000, but it's just as obvious.
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
This one happened to still be the default "000” combo (I *very* rarely change the combos on love locks, because I think the combo is part of the charm).
You can see that this one required a button press instead of pulling the shackle to open. It works the same way, but force needs to be applied to the button instead of the shackle.
Some locks also use sliding mechanisms, so the shackle isn't directly connected to the wheels.
With some indirect designs, it's easier to use a small wire or lockpick to slip into the lock housing and apply pressure directly to the mechanism.
-
@flipper YALP?
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice fingers and feeling around, you say..
-
This one happened to still be the default "000” combo (I *very* rarely change the combos on love locks, because I think the combo is part of the charm).
You can see that this one required a button press instead of pulling the shackle to open. It works the same way, but force needs to be applied to the button instead of the shackle.
Some locks also use sliding mechanisms, so the shackle isn't directly connected to the wheels.
With some indirect designs, it's easier to use a small wire or lockpick to slip into the lock housing and apply pressure directly to the mechanism.
@alice what are you listening(?) or feeling(?) for when spinning the dials? I watched a couple trying to listen for a cue, but couldn’t hear anything obvious.
Edit there’s a post above this one. Should go read that first
-
This one happened to still be the default "000” combo (I *very* rarely change the combos on love locks, because I think the combo is part of the charm).
You can see that this one required a button press instead of pulling the shackle to open. It works the same way, but force needs to be applied to the button instead of the shackle.
Some locks also use sliding mechanisms, so the shackle isn't directly connected to the wheels.
With some indirect designs, it's easier to use a small wire or lockpick to slip into the lock housing and apply pressure directly to the mechanism.
@alice what's the rationale behind taking the love locks? I mean I dont really have an opinion either way. But im curious as I imagine some (probably many) of them would be upset and I can generally understand why (sentimental value and such) but im curious about the other side of the exchange.
-
@alice fingers and feeling around, you say..
@matildalove apropos of nothing... I was once with a group of school friends, playing Smash¹ with this girl. A few rounds later, while watching a couple other people play, she leans over and says, “I was distracted by you fingering the controller.”
Ended up having an impromptu sleepover at her place that night.
¹ the Nintendo kind
-
@matildalove apropos of nothing... I was once with a group of school friends, playing Smash¹ with this girl. A few rounds later, while watching a couple other people play, she leans over and says, “I was distracted by you fingering the controller.”
Ended up having an impromptu sleepover at her place that night.
¹ the Nintendo kind
@alice my "raised with terrible communication skills" ass is taking notes :3
-
@alice what are you listening(?) or feeling(?) for when spinning the dials? I watched a couple trying to listen for a cue, but couldn’t hear anything obvious.
Edit there’s a post above this one. Should go read that first
@NineIsntPrime it's rare you'll get an audio cue with these locks, but you're feeling for "wiggle" or "play".
If a wheel is binding and not in any gate, it'll be rubbing against the shackle's warding (those nubs that stick out in the diagram).
If a wheel is binding and in a false gate, it'll have a little play to it—like maybe ¼ of a number in either direction (it varies a lot by brand and quality).
If a wheel is in a true gate, it'll move by often up to ½ a digit in either direction (again, it varies a lot by brand and quality).
You're trying to get a feel for which state is which by comparing it to the other numbers and wheels as you go.
Sometimes it's really obvious, but sometimes it can be really hard to tell, and you'll have to do some elimination to find the right code.
For instance, say you've got 3 wheels, numbered 1-10 each.
Wheel 1: T(5), F(1,3,7,9)
Wheel 2: T(1), F(3,5,7,9)
Wheel 3: T(2), F(1,3,5,7,9)
You're trying to get to 512, the true combo. The lock currently reads "392", and you're pretty sure wheel 3 is correct (on 2), but wheels 1 & 2 both feel like they're in less wiggly gates. So you advance wheel 1 or 2 (whichever feels stiffest) until it feels like it's in a gate again. Now let's say the lock reads "592". Wheel 1 & 3 now feel pretty similar, and wheel 2 is binding harder. You advance wheel 2 past 0 and around to 1 again—it pops open.
-
@alice what's the rationale behind taking the love locks? I mean I dont really have an opinion either way. But im curious as I imagine some (probably many) of them would be upset and I can generally understand why (sentimental value and such) but im curious about the other side of the exchange.
@smolbrain they cause damage to structures both from the weight and the contact corrosion. Most cities consider them graffiti or abandoned property, some consider them illegal additions to city property.
Regardless, they get cut off and scrapped, if they don't rust away first.
I preserve them before that happens.
Sadly, a month or two ago, the city came through and killed a few hundred of them before I got to them. At least with me they'll be used to teach lockpicking, kept care of, and eventually end up in a museum.
-
@smolbrain they cause damage to structures both from the weight and the contact corrosion. Most cities consider them graffiti or abandoned property, some consider them illegal additions to city property.
Regardless, they get cut off and scrapped, if they don't rust away first.
I preserve them before that happens.
Sadly, a month or two ago, the city came through and killed a few hundred of them before I got to them. At least with me they'll be used to teach lockpicking, kept care of, and eventually end up in a museum.
@alice awesome!! Thank you that actually helped a lot. I had some neg connotations with pulling love locks. But with that perspective I can really appreciate what you do!! Thank you for taking the time to explain!!
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice I did something like this to my child's bicycle's chain lock once. It's a lock with a changeable code and she told someone the code and someone else overheard and changed it. I had it open pretty quick and set a new code.
(This is the bike's second lock. There is also one with a key that is attached to the bike - the lock, not the key - that is probably not that much better but does need very different techniques. I am a firm believer in 'the secret to keeping your bike safe is to ensure it's locked up better than the one next to it', if a bike thief really wants a bike they'll take it anyway but they will also go for least effort. In a Dutch bicycle parking there is always a bike with only a lock that doesn't attach it to anything, so the trick is making sure yours isn't that one.)
-
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice
I use pull-picking to show colleagues how it's not the locks, but the social contract keeping society together (also about the existence of lock-picking, and that it's within their reach) ^_^ -
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice
I discovered how to do that by myself years before getting into lockpicking
Didn't always seem to work, I guess it was because of false gates 🤭 -
#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
@alice i did this when i was like 11 in math class and only now do i realize it was probably supposed to be a math exercise not thievery exercise
