# Are six digit temporary numerical pins secure enough for online accounts?

There is a popular money transfer service built by Square, cash.me, that uses a peculiar login system:

2. Receive a six digit numeric temporary pin via email or phone number
3. Enter pin on website
4. If pin is correct, the user is logged in

After this, the user can view transaction history. If the user knows the CCV code for the saved debit card, they can even send money to another user (limited at a few hundred dollars).

While they have pretty aggressive rate limiting, this appears to be vulnerable to a distributed attack. While they claim that they will cover unauthorized charges, it seems like users' account information is not very secure. For a modern product released in 2011, does this make any sense, compared to a more traditional password-based approach?

• Are there unlimited tries for the pin, i.e. unlimited both in number of tries and in time? Commented Oct 27, 2016 at 18:09
• No. It is rate limited to five tries or so. Commented Oct 27, 2016 at 18:15
• Not enough info - I can't find anything about retries or key life. And without those, we can't do the math. Number of possible keys is obvious - 10^6. If it lasts 2 minutes and limits you to ten tries in that two minutes, well, that's pretty safe.. If it lasts a week and you can run through a significant portion of the keyspace in that time, it isn't. Commented Oct 27, 2016 at 18:16
• @user128907 If it is 5 tries, then the chance of any particular code being found is 0.0005% - which is pretty small. Assuming they can't harvest these transfers in bulk and try them, Square is probably right to consider this a reasonable risk. Commented Oct 27, 2016 at 18:20
• Possible duplicate of Is a 6 digit numerical password secure enough for online banking? Commented Oct 27, 2016 at 21:27

## Depends on the attack vector

Some examples:

Hackers steal 45 million passwords. The six-digit PIN mechanism is immune to this sort of attack, because the PINs are generated on the fly and presumably have a short lifespan. There is nothing to steal.

How I'd hack your weak password. The six-digit PIN mechanism is immune to this sort of attack, because the user does not choose them, and they cannot be inferred from demographic information.

Brute force cracking. The six-digit PIN mechanism is not immune to this sort of attack, but the hacker only has a 1 in 1,000,000 chance of getting it right. Depending on the lockout mechanism that it uses, the hacker may have 3-5 chances, which still offers very poor odds.

On the other hand, you are in a less comfortable position if

2. A hacker steals your mobile phone
3. A hacker is able to intercept your email because it was not sent securely
4. A hacker is able to intercept your SMS, somehow....

## There may be other, hidden security mechanisms

Payment processors tend to have additional security mechanisms that you can't even see. For example, your payment may end up going through a risk engine and will get blocked or sent to escalated auditing if it appears fraudulent (i.e. if someone is sending a lot of small transactions to one place, or if the IP address is in Syria, for example).

## Who is at risk?

It may ease your mind to know that the security mechanisms in payment processors' sites are not so much there to protect you as they are to protect them. They are the ones who have to come up with the money if any of your funds are stolen. Your personal liability is limited to \$50.

• Did you intend your second link (How I'd hack) to be different from the first one (Hackers steal 45M)? Commented Oct 31, 2016 at 6:56

The problem with SMS as an authentication factor is that there are a number of methods to subvert it. Firstly, there are a number of design flaws in the SS7 network that allow the spoofing and redirecting of SMS messages. Secondly, if your phone is compromised (e.g. malware apps), then your received messages can be leaked.

This paper (http://www.mulliner.org/collin/academic/publications/mulliner_dimva2013.pdf) published in 2013 goes into far more detail about the security problems with SMS.

Mind you, Square maintains a PCI-DSS level 1 certification that has various requirements for securing PII and CC data. But that doesn't mitigate against the vulnerabilities inherit in SMS, though.

There are 1 million possibilities to form the right 6 digit pin considering they use the numbers from 0 to 9. So an attacker has a 0.000005% chance to guess the pin.

If login is made via mail or phone and the site doesn't ask for password, then consider it as half of a two-factory authentication. So the attacker should crack the e-mail account or steal the phone.