"Practical Lock Picking" by Deviant Ollam

• Nearly all of the locks that you are likely to encounter on a day-to-day basis stem from just a few basic varieties, and the mechanisms inside all of these devices operate in almost the exact same manner.
• The overwhelming majority of locks that are in use today, particularly in North America, are either pin tumbler locks or wafer locks.
• Typical office doors, desk drawers, filing cabinets, and access panels will usually be equipped by default with lower quality locks because they are the easiest to mass produce, the simplest to service, and the most economical to replace or rekey should the need arise.
• The pin tumbler mechanism is one of the oldest lock designs in existence and is still widely used today.
• There are two primary large pieces that comprise the bulk of a pin tumbler lock: the housing and the plug. These are the two items that can easily be seen from an exterior perspective and are thus the most understood.
• The plug of a pin tumbler lock is constructed from a cylindrical billet typically made of brass, although occasionally steel is used in high-quality models.
• Blade style keys have bitting cuts along their thin edge.
• The plug is milled with a small lip around the front-facing edge. This serves a dual purpose, in that it prevents the plug from sliding inward through the lock housing and at the same time precluding a potential attacker’s insertion of material that could penetrate the front of the lock and interfere with the operation of the pin tumblers within.
• The rear section of the plug is also typically milled with either a grooved notch or given a threaded end to accommodate a retaining clip or screw cap, respectively.
• The shape of the slot for the key is called the keyway profile. The primary reason for using more than a simple rectangular slot is the need to help seat and align the key as it is inserted into the lock.
• A number of tactics for defeating a lock are feasible only if the attacker has a supply of blank keys that can be inserted into the keyway.
• It’s not a locks job to hold something shut. It is our deadbolts, our padlock shackles, and other similar hardware that actually provide the means by which things remain shut.
• If you disassemble a lock, pay particular attention to the means by which the turning of the plug translates into turning of other components deeper inside the device. You might just notice a means by which force can be applied that opens a door without ever having to turn the plug at all.
• It is not uncommon for small additional chambers or holes to be fabricated near the front face of the plug. These are subsequently filled with ball bearings or ceramic inserts that can frustrate and impede drilling attacks.
• Key pins ride against the user’s key during normal operation of the lock.
• The differing sizes of pins in a lock correspond directly to the different cuts that are seen when observing a key.
• The lock cylinder does not interact directly with the latch but instead provides some means for preventing the handle from turning.
• When a user inserts the proper key into a lock, the key pins ride along the edge of the key’s blade. The blade travels into the lock until the key comes to rest either by its tip encountering the rear of the keyway or by the key’s shoulder coming to rest on the front face of the lock.
• When the proper key has been fully inserted into a lock, a unique phenomenon can be observed…all of the pin stacks will have been pushed into exactly the right position such that the split between the key pins and driver pins (known as the pin shear line) will be aligned across the edge of the plug, in effect becoming one with the plug’s own shear line. When the pin stacks are all in this perfect position, there is nothing obstructing the plug from turning.
• The key pin sizes (and the corresponding depths of the bitting cuts on the blade of the key) only appear in regular, evenly spaced intervals.
• Bitting depths can be measured and are frequently described by manufacturers by the use of a bitting code, which locksmiths can use to fabricate new keys even if the original keys are not present.
• The numbers in a bitting code correspond to how deeply a particular cut should be made into a key at a given position. The larger the number, the deeper the cut. On the bitting code of a typical pin tumbler lock the numbers represent the cuts made from the shoulder proceeding towards the tip.
• The stamping of codes on keys is quite common.
• When all of the pin stacks in a lock have been pushed to the proper position (when all of the shear lines are aligned with the edge of the plug) the lock can be opened.
• Wafer locks don’t have a large lock body surrounding the plug which would be required if it had pin stacks.
• When the lock is at rest, the wafer prevents the plug from turning by hanging “down” into the “lower” channel of the housing. Lifting of the wafer makes it clear the lower channel, thus allowing rotation of the plug. However, the lifting cannot be indiscriminate; if raised too far, the wafer’s other protruding edge will extend into the “upper” channel, thus blocking movement of the plug.
• While most wafers in a lock are equidistant from one another, often times a special “control wafer” is separated by a greater than normal distance from the rest of the wafer pack.
• Nearly all mechanical locks have weaknesses that make them susceptible to picking attacks.
• Mechanical imperfections lead to security weaknesses.
• Imperfections cause the following critical situation to arise: when rotational force is applied to the plug of a lock, the mechanisms designed to prevent turning (pins, wafers, etc.) do not all experience the same degree of force.
• Most of the time, the force is borne by very little of the lock’s internal mechanism. In many cases, a single pin stack (whichever pin stack is the most misaligned and closest to the wall of the housing in whichever direction the plug is being turned) will bind, while the other pins simply sit in their chambers without making any significant contact with any surfaces at the shear line.
• The one constant that can usually be counted upon is for a lock to have a specific binding order.
• The overall process of applying tension, lifting, and clicking into position is called setting a pin, and is the basis of all pin tumbler lock picking.
• When picking a lock, the first step is the application of tension (by means of rotational force upon the plug) with a tension tool.
• A tension tool should be applied as gently as possible when lockpicking is attempted.
• The bulk of all pick tools are either lifting picks or raking picks.
• While there is nothing inherently wrong with having more than one finger on the tensioner, it’s rarely called for…and is often a sign that you may be applying too much force.
• Placing a single finger, often the index finger, on the tension tool and pressing downward is often the best course of action.
• I highly recommend that people attempt to localize the tip of their finger and apply pressure further out towards the end of the tension tool.
• I cannot stress enough just how little tension is required when you are picking a lock.
• If a pin stack is raised too much then not only will the driver pin be out of the plug, but the key pin will be as well, at least partially. If the key pin becomes stuck in the shear line (and thus begins to be held by the friction of binding force) there is no easy way to bring it back down and out of the way.
• Rake picks are typically designed to that their working surfaces are wide enough to contact multiple pin stacks simultaneously.
• They [rake picks] are used by scrubbing back and forth, in and out of the lock, so that the pick jostles the pins into a wide variety of positions.
• While fluctuation and variation of your pressure upon the tensioner is not a normal part of lifting picking, it is quite common during the raking of a lock.
• The half-diamond [pick] is uniquely suite to exploring locks, helping you gather information in places where you cannot use your eyes to observe, and must instead rely on what you can learn simply with your hands.
• If you wish to learn just how many pin stacks are in a given lock, grab your half-diamond tool and insert it into the keyway upside-down, with the pointed tip facing away from the key pins. With the pick far away from the pin stacks (keep it at the “bottom” of the keyway if possible), insert it until you feel an obstruction at the rear of the plug (the tailpiece or cam or a blocking plate will be what you are striking with the tip of your pick). Now, lift the half-diamond upwards, attempting to raise all of the pin stacks evenly at the same time. When you have all pins raised as high as possible (much of your pick tool will now be riding against the top of the keyway), slowly begin to withdraw it from the lock. Make sure it is traveling completely horizontally. As the tool’s tip begins passing the pin chambers while it is being removed from the plug, the pin stacks that had been pushed up will come snapping back downward due to pent up spring pressure above them. You can clearly hear (and sometimes feel) this snap effect. Count the snaps, and you will have determined how many pin stacks the lock contains.
• All told, the half-diamond could be thought of as the least specialized and yet potentially the most useful pick in your toolkit.
• Think of the tensioner as the tool that actually picks the lock.
• Most car doors and vehicle ignitions are double-sided wafer locks.
• A juggler [key] can be thought of (more or less) as a rake and a tensioner all in a single piece of material.
• Jigglers are an amazing addition to any lockpick kit.
• Lifting, raking, and jiggling are the predominant styles of attack you will use…regardless of what tools you happen to have in your kit.
• If you want to become a highly skilled lockpicker, there is nothing that can take the place of dedicated, consistent practice.
• My favorite training aid in the field of lockpicking is a set of progressively pinned locks.
• Lockpicking is all about feel…the only way you’re going to “see” what’s going on inside the lock is with your hands.
• Start with a progressive lock containing a single pin in the chamber closest to the key way. Pick this lock using progressively less turning tension each time. What you want to feel is the distinction between a nonbonding pin stack, and a binding pin stack.
• Learning to distinguish between a binding and a nonbonding pin stack is perhaps the most essential aspect of becoming a skillful lockpicker.
• Move onto a progressive lock with two pin stacks. Can you distinguish the binding bin stack? Observe the behavior of the lock as you set the first pin at the shear line.
• Try practicing with your eyes closed so you can really pay attention with your ears and hands and help you not to rely exclusively on visual evidence.