1

I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:

Background: When the user downloads and installs the mobile app, they are asked to log in with username and password. After authentication is successful they are prompted to set a PIN for easier access to the app during the session lifetime.

1) The app session expires and the user needs to re-enter their username and password to "restart" the session.

  • Here I would presume to leave the PIN in place as this was not an action initiated by the user.

2) The user clicks "log out" in the app to kill their session manually.

  • Here I would presume the PIN should be removed as this was an explicit action by the user.

I understand that this may be viewed as "subjective", but I believe that there should be a best practice around this as this involves defining an average user's intent regarding security.

Improve this question
5
  • In my opinion, the best thing to do would be to just remove the pin every time. That is the most secure thing you could do.
    – Rocket
    Commented Aug 27, 2018 at 16:23
  • Can your clarify what you mean by "remove the PIN"? Do you mean remove from memory and re-prompt them, or reset the PIN and force them to choose a new one? Or something else?
    – Mike Ounsworth
    Commented Aug 27, 2018 at 16:31
  • @MikeOunsworth - "remove the PIN" would mean wiping it out from memory, yes. It would essentially kick off the same "first login" flow where the user logs in and is asked to create a PIN as if they did not have one before.
    – Ryan Mendoza
    Commented Aug 27, 2018 at 16:34
  • As a user, the behaviour that I expect with application PINs (for example on 2FA or banking apps) is that I set the PIN when I install the app, I need to enter the PIN every time I open the app, the app never forces me to change my PIN.
    – Mike Ounsworth
    Commented Aug 27, 2018 at 16:35
  • @MikeOunsworth in this scenario the session lifetime is not indefinite. If after, say 12 hours, the session expires and the user needs to re-enter their credentials as a "re-up" should the PIN persist? I see this as an implicit session expiration whereas I see the user manually clicking log out as explicit session expiration.
    – Ryan Mendoza
    Commented Aug 27, 2018 at 16:38

1 Answer 1

Reset to default
1

So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.

I would follow the model used by the Keepass2Android client:

  • When you open the app (equivalent to your new session), you need to do the full authentication process.

Keepass2Android login screen

  • While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).

Keepass2Android still running in the background

Keepass2Android quick unlock screen

  • When you fully close the app, you will need to do the full login next time.

So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.

I don't see any difference here between whether the session expired naturally or because they clicked Log Out. I also don't see any reason to ever force them to choose a new PIN; that seems like it's asking for usability problems ("What's my PIN again??") for minor-at-best security benefits.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .