Timeline for When choosing a numeric PIN, does it help or hurt to make each digit unique?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 8, 2017 at 21:50 | comment | added | daboross | @Michael I've got no idea about pin security, but binary searches really aren't applicable here. A binary search only ever makes sense if you get feedback on if a value is "bigger than" or "less than" what you've tried. I know of no pin system where the error message is "sorry, the password you tried was a larger number than the correct password" - the attacker only ever gets "is the right password" or "is not the right password" feedback. | |
| Apr 8, 2017 at 5:57 | comment | added | Jason C | 8068: The #1 most popular PIN of datagenetics readers. | |
| Apr 7, 2017 at 21:18 | comment | added | Jim Balter | ^ No, the point is that you don't understand what a binary search is or when it's applied. | |
| Apr 7, 2017 at 15:52 | comment | added | Michael | @JimBalter That was kind of my point... you can try to pick a PIN based on what scheme you think the attacker will use to try to guess PINs, but it falls in the old "outsmarted yourself" category. | |
| Apr 7, 2017 at 3:50 | comment | added | Jim Balter | @Michael Binary search has no applicability here. No, really, it doesn't. Think it through before responding. Finding a random PIN is O(n). A binary search is a O(logn) operation that starts with a known key and searches an ordered subset of the possible keys. If it's not a subset, then you can use direct indexing, which is O(1). "5000, 7500, 2500, 3750, etc." -- a binary search will only look on one side of the initial try or the other, not both. That's the whole point of binary search, | |
| Apr 6, 2017 at 20:07 | comment | added | Michael | The part about smart alecs reminds me of the old outsmart... I'll pick 5000 because it's right in the middle, so either end they start it will take them a maximum amount of time to hit it on average. But what if they use a binary search? They will start at 5000 and guess it in one go. Ok, so that would rule out 5000, 7500, 2500, 3750, etc. So I'll pick 4999 or 5001 as that is the longest average path for both a binary search and a linear search. But wait, suppose they start at the middle and do a linear search from there... etc. | |
| Apr 5, 2017 at 7:52 | history | edited | Rory McCune | CC BY-SA 3.0 |
added 252 characters in body
|
| Apr 4, 2017 at 18:06 | comment | added | Goose | a) and b) and unnecessary because the more important point is, even if attackers know not to try those, they'd still have no way to know how to guess your random pin in 3 attempts. | |
| Apr 4, 2017 at 15:15 | comment | added | smitelli | @RоryMcCune That DataGenetics article was a great read, thanks. | |
| Apr 4, 2017 at 13:09 | comment | added | Taemyr | " but that only applies ..." more importantly; it still leaves him with 9890 combinations to try. | |
| Apr 4, 2017 at 12:15 | comment | added | dave | READ THAT LINK. Sorry for shouting. | |
| Apr 4, 2017 at 11:45 | comment | added | techraf | I re-read your answer a few times and I cannot see the answer to the question "did I help or hurt myself by doing that?" - that would be perfectly ok, but in your comment you actually stressed the fact that you are addressing this very question. | |
| Apr 4, 2017 at 11:25 | comment | added | Rory McCune | Well with 8 digit PINs you're still at a stage where un-contrained brute-force is trivially easy, so you'd be assuming that lockout + not choosing common PINs would be the best defence. The answer to your question would depend on whether repeating digits were amongst the most common forms of 8 digit PIN, whether the attacker would be aware of the restriction before making an attack and whether the PIN is system or user generated. | |
| Apr 4, 2017 at 11:17 | comment | added | techraf | Ok, does it hurt or help the security to exclude repeated digits if the PIN was 8-digit long? | |
| Apr 4, 2017 at 9:35 | comment | added | Rory McCune | I guess I was evaluating it based on OPs last sentence asking if it helped or hurt their security. To me what's important in PIN security is not choosing a commonly used PIN. If there's no lockout you're stuffed anyway, so the only factor in your control is choosing an uncommon one not a random one. | |
| Apr 4, 2017 at 9:33 | comment | added | techraf |
True as it is, it still is a Q&A site. OP asked a question in which nothing suggests OP has any influencer on the lookout time. Also the question uses some math. If the question was about outsmarting the other party, then we can bid. I would state any sequence on the numerical pad making a pattern, look 1254, 7618 is much easier to match than 2776. But how to evaluate the answers then?
|
|
| Apr 4, 2017 at 8:21 | history | edited | Rory McCune | CC BY-SA 3.0 |
added link
|
| Apr 4, 2017 at 8:02 | history | answered | Rory McCune | CC BY-SA 3.0 |