🅰🅻🅸🅲🅴 (🌈🦄)#LearnLockpickingWithAlice lesson 10: Decoding combination locks by "Pull-Picking".
There are a lot of types of combination locks out there, but one of the most common is also one of the easiest to open—no tools necessary.
So, today I'm going to talk about popping locks with nothing but some fingers and a little feeling around.
Almost every example of this style of combination lock uses a series of 3-4 wheels, with 10 numbers or letters arranged around each one (though a rare few have fewer positions per wheel, or a fifth wheel).
From the exploded diagram, you might already be able to see the design flaw. When you pull on the shackle, it pulls on the wheels, and—much like with traditional picking—we can exploit manufacturing defects to give ourselves more information about the solution to our puzzle. To get a feel for this, try interlacing the tips of your fingers, then lift one hand so the sides of your fingers press into each other. The pressure is distributed between all your fingers, but some take more than others. Now fold your middle finger in, so it's no longer in contact with its counterpart; the pressure is distributed between the remaining fingers. This is like the wards on the shackle pressing against the wheels. Once a wheel is set correctly, the remaining tension on the shackle is redistributed to the remaining incorrectly set wheels.
But there's a catch.
Lockmakers add smaller "false gates" along the wheel to trick you into thinking you've got the right combo when you don't.
This means each wheel can be in one of three states: not in a gate, in a false gate, or in a true gate. Our goal is to get all of them set to their true gates.
Remember earlier when I mentioned manufacturing defects and design flaws? Well, in a perfect world (for the locks) all the wheels would be perfectly cut and uniformly shaped, and the false gates would be indistinguishable from the true one. That's not the case.
False gates will always be narrower or shallower than the one true gate on each wheel, and wheels will always be slightly irregular. This means that the pressure won't distribute perfectly between each wheel, and that the false and true gates "feel" different.
Okay, enough origin story—how do you decode one of these?
Step zero: try all zeroes...no really, it's like "password123", you don't think anyone is that bad at security, but they are. Like really bad. If it's a love lock, try the current or previous year too.
Step one: pull the shackle like you're trying to open the lock. If you find you can't turn a wheel, release a little tension until you can.
Step two: find the wheel that is hardest to turn—it'll feel like it's scraping a little, or it'll lock into place and have a small amount of wiggle to it, but won't go past the next number.
Step three: cycle through wheels, repeating step two until all of them feel like they're in *a* gate. If a wheel is in a gate, it'll have a small amount of play before it bumps into the ward on the shackle—with a false gate, this *may* be almost no wiggle, with the true gate, it may move by a good half-a-position in either direction before it bumps the edge.
Step four: if it feels like all the wheels are in *a* gate, but the lock isn't open, find the wheel with the least play in it, remember the number, and try rotating it until you find another gate. Once you either come back around to that number, or find a more wiggly one, check the next least wiggly wheel.
Each wheel may have up to N-1 false gates, but will only have 1 true gate, so learning to tell the difference is the key to decoding.
When you watch a professional do this, you'll usually notice them rapidly cycling wheels, wiggling each wheel frequently. It's not a matter of trying a ton of combos quickly, but more about calibrating your feel for the gates. Every lock is a little different, but they all have tells if you listen.
Hacker News
Dr. Folke Bernadotte 🇪🇺
Inautilo
openSUSE Linux
novaTopFlex
Dantali0n 
Philo Sophies
N-gated Hacker News