Timeline for When choosing a numeric PIN, does it help or hurt to make each digit unique?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 9, 2017 at 16:18 | comment | added | Nat | "Entropy is a property of the password generation method, not the password." Entropy is a property of the attack surface, not the password generation method. This conceptual mistake leads to a very poorly reasoned defense of including "1111" when that's literally the very first PIN most attackers will try. See @Tgr's comment for a better characterization of the entropy. | |
| Apr 8, 2017 at 6:06 | comment | added | techraf | @Jojodmo Please quote the relevant sentence from the answer that made you think I would do so. | |
| Apr 8, 2017 at 6:05 | comment | added | Jojodmo | So, if you wanted an 4 digit pin number for your car, and the random pin generator chose "1111", you would use that? If we're talking about brute forcing where pins are guessed at random, you're right that it wouldn't make any difference, but in the real world using "1111" would be a lot like always leaving your car unlocked. | |
| Apr 7, 2017 at 15:32 | comment | added | Kevin | As you say, entropy is a property of the password generation method, and when the most common method for generating PINs is by human choice, it is worthwhile to avoid the most common passwords. If I write a program for generating a random password of random characters of a random length, I have really good entropy in theory, but if that program spits out "password" by chance, it is still a good idea to discard that result since the attacker won't know or care that I generated it randomly | |
| Apr 6, 2017 at 13:49 | comment | added | Sobrique | I would also note - observation is a factor. It's much easier to tell that you press the same key 4 times, and which key it is than if you're pressing several. | |
| S Apr 5, 2017 at 11:11 | history | mod moved comments to chat | |||
| S Apr 5, 2017 at 11:11 | comment | added | Rory Alsop♦ | Comments are not for extended discussion; this conversation has been moved to chat. Any further comments should be made there - any made here will be deleted. | |
| Apr 4, 2017 at 7:40 | comment | added | Tom Bowen | While the sequence "1111" is just as likely as any other, I would propose that it is a sequence more likely to be guessed by attackers, and therefore you'd be more secure if you avoided it. | |
| Apr 4, 2017 at 1:29 | history | edited | techraf | CC BY-SA 3.0 |
added 206 characters in body; added 2 characters in body; deleted 1 character in body; added 1 character in body
|
| Apr 4, 2017 at 1:17 | history | edited | techraf | CC BY-SA 3.0 |
added 85 characters in body; deleted 6 characters in body; added 11 characters in body; added 20 characters in body
|
| Apr 4, 2017 at 1:11 | history | answered | techraf | CC BY-SA 3.0 |