2 added 247 characters in body
source | link

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site.

Here is the user flow:

  1. User visits the site for the first time in a new browser and enters username & password at prompt.
  2. User is prompted to create a 4 digit pin.
  3. On future visits to the site from the same browser only the user can authenticate just by entering the 4 digit pin.

Debugging Facebook in a web browser, I can see that the server returns a new "nonce" after the user sets the PIN and after each successful PIN based login. This nonce is stored in the browser. When the user attempts a PIN based login, the stored nonce and PIN are sent to the server for validation.

What I don't know is what's likely happening on the server.

  1. What might the server be storing? A hash of the nonce + PIN?
  2. How might the server be validating PIN login attempts?
  3. Are there any reference implementations for a system like this that I could look at?
  4. Assuming that the content stored in the browser is not taken by an attacker, is it possible for this system to be at least as secure as traditional username/password authentication? If not, what kind of attack would it be more vulnerable to?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site.

Here is the user flow:

  1. User visits the site for the first time in a new browser and enters username & password at prompt.
  2. User is prompted to create a 4 digit pin.
  3. On future visits to the site from the same browser only the user can authenticate just by entering the 4 digit pin.

Debugging Facebook in a web browser, I can see that the server returns a new "nonce" after the user sets the PIN and after each successful PIN based login. This nonce is stored in the browser. When the user attempts a PIN based login, the stored nonce and PIN are sent to the server for validation.

What I don't know is what's likely happening on the server.

  1. What might the server be storing? A hash of the nonce + PIN?
  2. How might the server be validating PIN login attempts?
  3. Are there any reference implementations for a system like this that I could look at?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site.

Here is the user flow:

  1. User visits the site for the first time in a new browser and enters username & password at prompt.
  2. User is prompted to create a 4 digit pin.
  3. On future visits to the site from the same browser only the user can authenticate just by entering the 4 digit pin.

Debugging Facebook in a web browser, I can see that the server returns a new "nonce" after the user sets the PIN and after each successful PIN based login. This nonce is stored in the browser. When the user attempts a PIN based login, the stored nonce and PIN are sent to the server for validation.

What I don't know is what's likely happening on the server.

  1. What might the server be storing? A hash of the nonce + PIN?
  2. How might the server be validating PIN login attempts?
  3. Are there any reference implementations for a system like this that I could look at?
  4. Assuming that the content stored in the browser is not taken by an attacker, is it possible for this system to be at least as secure as traditional username/password authentication? If not, what kind of attack would it be more vulnerable to?
1
source | link

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site.

Here is the user flow:

  1. User visits the site for the first time in a new browser and enters username & password at prompt.
  2. User is prompted to create a 4 digit pin.
  3. On future visits to the site from the same browser only the user can authenticate just by entering the 4 digit pin.

Debugging Facebook in a web browser, I can see that the server returns a new "nonce" after the user sets the PIN and after each successful PIN based login. This nonce is stored in the browser. When the user attempts a PIN based login, the stored nonce and PIN are sent to the server for validation.

What I don't know is what's likely happening on the server.

  1. What might the server be storing? A hash of the nonce + PIN?
  2. How might the server be validating PIN login attempts?
  3. Are there any reference implementations for a system like this that I could look at?