I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:

Background: When the user downloads and installs the mobile app, they are asked to log in with username and password. After authentication is successful they are prompted to set a PIN for easier access to the app during the session lifetime.

1) The app session expires and the user needs to re-enter their username and password to "restart" the session.

  • Here I would presume to leave the PIN in place as this was not an action initiated by the user.

2) The user clicks "log out" in the app to kill their session manually.

  • Here I would presume the PIN should be removed as this was an explicit action by the user.

I understand that this may be viewed as "subjective", but I believe that there should be a best practice around this as this involves defining an average user's intent regarding security.

  • In my opinion, the best thing to do would be to just remove the pin every time. That is the most secure thing you could do.
    – RocketSEA
    Aug 27 '18 at 16:23
  • Can your clarify what you mean by "remove the PIN"? Do you mean remove from memory and re-prompt them, or reset the PIN and force them to choose a new one? Or something else? Aug 27 '18 at 16:31
  • @MikeOunsworth - "remove the PIN" would mean wiping it out from memory, yes. It would essentially kick off the same "first login" flow where the user logs in and is asked to create a PIN as if they did not have one before. Aug 27 '18 at 16:34
  • As a user, the behaviour that I expect with application PINs (for example on 2FA or banking apps) is that I set the PIN when I install the app, I need to enter the PIN every time I open the app, the app never forces me to change my PIN. Aug 27 '18 at 16:35
  • @MikeOunsworth in this scenario the session lifetime is not indefinite. If after, say 12 hours, the session expires and the user needs to re-enter their credentials as a "re-up" should the PIN persist? I see this as an implicit session expiration whereas I see the user manually clicking log out as explicit session expiration. Aug 27 '18 at 16:38

So you have a setup where the user needs to do full username / password authentication, but as a short-cut you allow them to use a PIN until the session expires.

I would follow the model used by the Keepass2Android client:

  • When you open the app (equivalent to your new session), you need to do the full authentication process.

Keepass2Android login screen

  • While the app remains open, but in the background, you can re-open it using a short-cut -- last 3 characters of your password, fingerprint scanner, etc (equivalent to your PIN, I think).

Keepass2Android still running in the background

Keepass2Android quick unlock screen

  • When you fully close the app, you will need to do the full login next time.

So following that model, I would have them enter one PIN at install, when opening a new session they must re-enter their full credentials, and while the session is open they may use the PIN.

I don't see any difference here between whether the session expired naturally or because they clicked Log Out. I also don't see any reason to ever force them to choose a new PIN; that seems like it's asking for usability problems ("What's my PIN again??") for minor-at-best security benefits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.