We're using pin number for username retrieval process. Similar to a standard bank solution where a user must enter their ssn and account number to get their username. Is it necessary to expire this pin number after six months or some other time?

  • 1
    The necessity may depend on your threat model. – multithr3at3d May 22 '18 at 5:32

Unless there is a regulatory or compliance framework around your offering, expiring PINs or passwords is up to your organization. Usually, a company or organization will define this practice in their security policy. If your organization has one, that's where you should be looking for your answer.

That said, if you don't already have a security policy, take a look at NIST's security policy framework. They provide a rich example that you could apply to your organization.

In the specific case of asking a user to provide a "recovery PIN", there probably isn't much point to trying to expire it unless you're going to demand they change it periodically (this would be unusual.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.