Does Username + Password + Pin improve login security?

Question

I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current password OR use a "password reminder" feature that sends a one-time-login token to their e-mail address.

There is a request to add a numeric pin code (at least 4 digits) so that user's would authenticate with username+password+pin code. We would need to add the pin code into the account management form and, I guess, let users change the pin if they can remember their previous pin OR they use the one-time-login feature.

Three questions:

1. Does this actually help security in some way?
2. Is it more effective if the pin is on the main login screen or a second page in a multi-step form?
3. If we can easily enforce a password policy, (requiring a digit, special character, etc.) is that more or less helpful?

I'm interested in lots of perspectives here and will choose an answer that presents pros and cons to these strategies.

Answer 1

1) More authentication has all the Pros and Cons usually associated with it (more information is harder to hack, but harder to remember). With a pin, people are extremely likely to use birthdays and other easy to remember numbers, so social engineering might make it easier to break than a password or actual 2-factor.

2) Do you have other systems in place to prevent brute forcing? If not, you should place it on the primary page. XXXXXXXX#### is harder to guess than XXXXXXXX then #### (simple math: you'd have to guess "AAAAAAAA" 10^4 times before concluding moving on to "AAAAAAAB" in the first, but only have to do it once in the latter. Multiplication of possibilities versus addition). If so, perhaps some benefit is gained placing the PIN on page 2 because the PIN could be sent on a more secure line?

3) Password rules, while nice in principal, fail in practice for much the same reasons as seen in 1. Social Engineering, incrementation of passwords, and writing them down on a sticky note by your desk. There are plenty of other questions about best practices for password rules (I use 14 character passphrases generally), but all passwords are weak to social engineering and forgetful users.

Answer 2

Mathematically a 4 digit pin would improve security. However, this increase could be replicated by increasing the required length of a password by 4 characters.

This is not really a great solution, but it could be improved with (just an idea) the pin being given to them via SMS or email.

None of this is comparable to 2 factor authentication which works on the principle of being to hard to brute force in the allotted time.

Answer 3

A PIN is just a password -- a password which is restricted to digits and constrained in size, but a password nonetheless. PIN make sense in contexts where digits are natural, namely ATM systems and other payment devices which sport only small keyboards; similarly, mobile phones. For a Web site, this is much less relevant, since the user has a full keyboard with letters.

If you can make your users remember two passwords (even if one is a PIN), then security is correspondingly enhanced. The two passwords must be entered on the same page. To see why, imagine that you ask for twelve one-digit "passwords"; if your system allows entering the second digit only when the first digit is correct, then the attacker can easily guess the first digit by trying at most 9 times. Similarly, if you ask for the password and then the other password (the PIN) on successive pages, then the attacker can try to crack them separately, which is easier than cracking both of them simultaneously.

Password policies often backfire. Either they make the users choose passwords that are too complex for them to remember, and this increases helpdesk costs (or they overuse the password reset option, which is always a risk, email security being essentially void); or, more often, this antagonizes users, who then become active enemies, and that's not good at all. Angry users will reuse passwords, share passwords, write down passwords on stick-up notes, and many other things of unusual creativity. If you can force users to enter a password AND another password (even if the latter goes under the guise of a "PIN"), then I daresay that you have already password-policied them quite enough. Doing more would probably be counterproductive.

Answer 4

This is almost Two-Factor authentication. Two-Factor authentication is a great system that improves security. Usually this authentication system boils down to "Something you have" (a token) and something you know (a password). In the case of having a PIN and a Password, its really just two things you know which really isn't that helpful.

Using any Possession Factor would be a better choice than a PIN.

SMS seems to be the most common choice for a Possession Factor because it doesn't require infrastructure or for the customer to purchase an additional device.

Answer 5

Adding an additional pin which is functionally no different from a password doesn't give any real improvement to security

As I understand it you are proposing requiring users to provide a password and a pin number when they sign up. This is effectively no different from changing your password policy to require 4 numbers at the end of every password.

If user the controls both password and pin then authentication with:

• password: superdooperpassword
• pin: 1789

Is no different from:

• password: superdooperpassword1789

The only improvement is a slight increase in password complexity.

You are introducing a false sense of security by implementing something that looks a bit like two-factor authentication but is actually just one-factor authentication split over two input fields.

Look at it this way - if someone had asked you to change the login mechanism so that users have to enter the first half of their password in one field and the second half in another field would you have even asked this question?

It would be far more beneficial to security to introduce a strong password policy on the single password field.

Answer 6

Personally, I don't think this adds much security it would be better to enforce a password strength policy instead. If you have to proceed with this my thoughts are below on the pitfalls you may encounter.

If you have a multi-step form, it is harder to test and there is more room for logical flaws to be introduced. I would take into account the following.

• If there is a username, password or PIN mismatch, the system should not tell the user there was an authentication problem until the last stage of the form.
• On authentication failure the system should not inform the user which step in their form was incorrect.
• On authentication failure the system should send the user back to step 1 and force them to re-enter all their details (a small hit in usability for extra security).
• Do not make any assumptions about the step state from the step the user is at. For example, if the user is at step 2 in the form do not assume that the user has already completed step 1. They may have found a way to enter step 2 directly.
• Make sure that no data from previous steps is stored in plain text in hidden fields or cookies.

For the reasons above it is much easier to have the PIN entry on the same form page as the username and password, and arguably more secure due to less risk of introducing bugs. The only exception to this is if you were going to ask the user to enter say 2 digits from their PIN each time and so the system needs to know which user is attempting to login and a multi-step form will be required. In this case they must be randomly assigned 2 digit positions from their PIN to provide (e.g. 1st and 3rd), and the system must remember which 2 digit positions were presented for that user until a successful login takes place. Otherwise an attacker could simply restart the authentication process until they get 2 digits that they know. I would also make the system "forget" the 2 digit positions presented after a certain amount of time because if they persisted indefinitely an attacker could infer that they have not correctly guessed a username because no successful login has ever taken place to make the digit positions refresh.