It's slightly "way more complicated". They occasionally forgot to update the key settings between messages, resent identical messages with different keys or encryption systems, or just chose easy to guess keys.

There was also a defect in enigma where no letters could be encoded as themselves. This meant that you could use knowledge of what was likely in a message at a certain location to rule out keys, since any letters in common disqualified the guess.