Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A website make me choose a 4 digit PIN code and then the authentication is done by substituting each digit with the corresponding letter from a randomly generated picture.
How secure is this type of authentication? What are the possible benefits from this solution in comparison with classic password authentication?
It's not secure, because there are only 26 ^ 4 possible solutions. This can be brute-forced. If the picture includes capitals, we can increase this, but even 52 ^ 4 is a very small search space.
I'm assuming that it gives you a different picture at every logon attempt, but that does not effectively make the search space smaller.
However, there is one advantage to this scheme - it prevents replay. You will enter a different letter combination every time, so if an eavesdropper intercepts your input, they can't use that combination again.
Unfortunately, that assumes that the attacker gets your input but not the picture. This is an unlikely scenario, an eavesdropper (whether MITM or shoulder-surfing) is likely to get both. It does offer a little protection if all the attacker has is a keylogger on your system.
So, this is an interesting idea to prevent replay, but poorly executed.
This is not secure, an attack would only take 10^4 * (number of attempts for a captcha) attempts.
You would go through the options (0000 - 9999) and then try to read the digits at the locations.
For the amount of attempts at a captcha, it would seem you may not need that many according to I’m not a human: Breaking the Google reCAPTCHA. Assuming a difficulty that is similar to reCaptcha and Facebook gives us an estimate of around 80% accuracy in 19 seconds.
That gives us 10, 000 * 19 * 2 seconds for a ~96% chance of getting it correct in ~105 hours.
The attack could be parallelized, which would bring this down further.
