Starting My Lockpicking Journey

I want to preface this by saying that lock picking does not necessarily mean that it's going to be used to break into any place, but it's just another tool to understanding security. Just as cybersecurity is not only used for hacking but also pentesting to better understand vulnerabilities, lock picking is used to understand the risks and bypasses of physical locks.

For a while now, I've had an interest in this sport. Through mostly watching entertainers like LockPickingLawyer and McNally on YouTube, it was and still is very interesting to learn about different locks, how they work, and what vulnerabilities they have. Many locks are susceptible to comb picking and raking, but practically all of them are vulnerable to single-pin picking.

The basic way a pin-tumbler lock works is that within the cylinder, there are usually 5–7 pin slots with two pins each that stop the core from rotating along the shear line. Once all of the pins are aligned properly at the shear line, there are no pins actively blocking the rotation, and the lock core turns freely.

If all the key pins can be pushed above the shear line simultaneously, then the lock is vulnerable to comb picking.

My kit came with two primary types of picks: a rake and a short hook. A rake is similar to a brute-force attack where it rapidly vibrates and jostles many different pin combinations at once. Locks defend against this by using security pins with spool or serrated geometry, as well as tighter machining tolerances.

Single-pin picking (SPP) is most similar to a timing side-channel attack: it slowly recovers the "password" (the key bitting) one "character" (pin) at a time. Due to microscopic manufacturing imperfections, pins bind in a specific sequence. Using single-pin picking, you identify the binding pin, lift it until it clicks onto the shear line, and move to the next.

One of the most important rules in physical security and lock picking circles is to never let the internet see your keys. A key is essentially a plaintext password in physical form. If an attacker has a clear photo of your key, they can determine the pin depths, decode the bitting, and 3D print or file a duplicate key in minutes.

Looking at the key tells us that the lock uses standard pin depths rather than disc-detainer or dimple mechanisms, providing a clear reference for what the internal heights look like while picking.

Although it was about $25 for the lock and tools, having a transparent acrylic lock is tremendously useful for developing muscle memory and learning how feedback feels through the tension wrench.

I've been able to open it consistently now even with my eyes closed, so my next step is picking up a standard brass Master Lock to test those skills on a real opaque lock without visual aids!

Until next time,
Gohith Reddy