I'm using a Junos Pulse Secure Access Service (Juniper Networks), which requires to enter a RSA PIN in addition to the password. I don't know if this is always the case or if it's a custom configuration. After entering both I get an email with a generated tokencode, which I have to enter.

The PIN isn't generated, it stays the same until I change it manually. There are no restrictions on when I have to change the PIN (besides on first login), therefore it's just something I have to remember like the password.

I don't think it makes the system more secure, so what is the RSA PIN used for? Could this be a misconfiguration which could lead to a security risk?

  • This is more of a poor-man's two-form-factor authentication. It would be up to the network admin to regularly update the PINs. It is more secure but not as secure as something like requiring RSA SecureID key that is automatically changing every so often, similar to what Google offers for their Gmail accounts. This service is just included with your Juniper as a "bonus". – Jack Bahou Feb 25 '16 at 12:36

There are several configuration for generating the PIN. If the admin has configured it to OnDemand Authentication only via user PIN so you are getting the the token code via email/sms. But it can be configured for various other options.

You can make a suggestion to the Authentication Manager to change the PIN change policy for forcing the user to change the PIN after a fixed duration or include the both security question/password along with the PIN+Token code.

The consideration taken is the for the lapse of security, no one will have access to both PIN and the token code delivery method with them at the same time. Which restrict the login attempt to just 3 for either wrong PIN or the token code.


It is a standard implementation. It does add an extra layer of security in the event of your primary password being compromised and the SecurID being removed from your possession (i.e stolen, or lost then found by a malicious third party), without the pin the token and/or account will be locked out after a few authentication attempts.

I do agree however that the risk of this is very low, which is a good a thing.

  • Sorry, I forgot to mention that I don't have a hardware token. – Christian Strempfer Jan 26 '16 at 9:32
  • Do you need to enter the pin before you reset it? Of so that provides another layer of security. – TheJulyPlot Jan 26 '16 at 16:54

The technique is called two-factor authentication, referring to the three fundamental factors of authentication: Something you have, something you know and something you are. While each of these can be compromised individually, the methods are different.

For example, if someone were able to find/guess you password (written down, leaked from another site, sniffed over the network), they'd still need access to the physical token in order to gain access. Similarly, the token is no good without your password, so a casual thief would also need to acquire your password.

The nature of the pins changing over time (usually something like a 10-15 second window) also improves their resistance to brute force attacks and replay attacks, as the same code doesn't work very many times.

  • Sorry, I forgot to mention that I don't have a hardware token. – Christian Strempfer Jan 26 '16 at 9:32
  • No, but it'll likely be a soft-token on a device (phone/laptop)? That's still something you have, considered to be a trusted device that you own. – Jozef Woods Jan 26 '16 at 10:12
  • I'll get a token via email, but that's different from the PIN. – Christian Strempfer Jan 26 '16 at 10:49
  • Hmm, if it's email based, then it's less like two-factor. Is it a corporate email, accessible only on certain devices? – Jozef Woods Jan 26 '16 at 10:57
  • I can access the email via web frontend. – Christian Strempfer Jan 26 '16 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.