On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times, user must enter PUK. When wrong PUK is entered 10 times, SIM card is permanently disabled.

On the website, if wrong PUK is entered 10 times, user must contact customer support to unlock their account. To prevent abuse, user must enter their password first.

Will adding PIN/PUK as second password increase security? Should it be added?

  • 1
    So you would require password + PUK to access the site while password + wrong PUK would lead to a lockout after a while but wrong password + whatever would not lead to a lockout? Or in other words: correct passphrase leads to login, multiple attempts with slightly wrong passphrase to lockout and totally wrong passphrase would not change anything. I cannot imagine how the security will be improved by this. Apr 16 '19 at 19:57
  • If I understand correctly, the user would be asked for the PUK if they entered the wrong password 3 times? That's what the "Forgot Password" feature with recovery by email is normally for.
    – MPS
    Apr 16 '19 at 23:34
  • @MPS: if the PUK would really be only asked if the password is forgotten then an attacker can cause a quick lockout of a user by simply guessing a few times wrong. While this might save the password/PUK against brute forcing it also makes it impossible for the user to access his account. And if done enough times then the customer support will not be available for some time because he needs to deal with all the locked accounts. So essentially this would be an easy denial of service attack. Apr 17 '19 at 3:36

This would help prevent credential stuffing, but would only catch a couple edge cases and is not as effective as adding a 2nd authentication factor. The specific attack vector this would protect against:

  • A user uses the same password on your site and another site
  • The other site, like most, doesn't use a PIN to supplement authentication
  • The other site gets breached and leaks the user's password
  • An attacker uses the breach to attempt to log in to your site as that user
  • The attacker doesn't know your user's PIN, and ultimately can't log in

The biggest issue here is that 2fa covers this exact case, as well as significantly improving the security of your auth flow. There are a couple mobile applications that use a PIN in lieu of a password, as it's easier to type on a phone, but this doesn't seem to be applicable to your question.

There's no reason to use a PIN in addition to your auth flow - either just use a password field, or enable/require 2fa for your users.

  • 2
    This only works so long as this is not the majority of sites. Once a lot of sites think "oh PINs work well, look at the other site: they don't have issues with credential stuffing", it loses its effectiveness because now PINs will also be stolen. And if they are randomly generated, so they still can't be stuffed because they're unique to each site, then it is equivalent to just randomly generating a user password, or adding a random digit after the user's password, and not allowing the user to change it.
    – Luc
    Apr 16 '19 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy