0

So one of the problems with password is that users reuse them or use some weak password. For the latter, even enforcing pattern does not work as users will simply go for something like P@ssw0rd1 that is easy to guess.

So instead of a user or email and password login, why not a pin and password? The pin will be generated during sign up (It can be as complex as the webmaster makes it to be and not necessarily a 6 digit pin like your bank card).

This way, even if the user decides to make a simple password, the account will always be protected by a secure and unique passphrase whether the user likes it or not.

6
  • 2
    While this does protect against specific attacks, PIN and Password are both "Something you know". Adding other factors, such as "Something you have" or "Something you are" makes the authentication more robust. That's why companies are moving towards MFA instead. Feb 27, 2020 at 6:38
  • 1
  • Using the PIN to determine a number of SHA2 rounds before feeding the KDF would make it more complex to reverse with off the shelf solutions like john and cat...
    – dandavis
    Feb 27, 2020 at 19:05
  • 1
    @dandavis Security by obscurity silliness. If you're writing professional software and have passwords that protect anything of significant value, then you should just assume that a hacker is at least a little professional and so knows enough to (easily) adapt to that change... Or that they can learn. Or pay someone else to do it. Even if you're hacked by a total script kiddie, they could post a data dump publicly or sell the same information to someone who can tweak a few lines of code. Feb 28, 2020 at 0:38
  • @FutureSecurity: Sure, there will always be someone better, but obscurity isn't the point, adding work is. If you have both a pin and pw, the suggested concatenation of the two makes for a much more precise/targeted match rule (just digits at the end) for rippers. While the sha rounds themselves aren't very expensive, appending that to the password instead of a few PIN digits produces more work to be done.
    – dandavis
    Feb 28, 2020 at 1:35

1 Answer 1

3

Some banks actually do this. The issue is the same as with just generating a random password for the user and not allowing them to input one. They will inevitably write it down. Also, using a pin as username frustrates targeted attacks but for short pins and large sites, attackers can pick a random pin and chances are it will belong to some user. You would need to make it longer to be effective.

Finally, if the pin is ever leaked, it can be difficult to change, if it acts as the username.

At the end of the day, pin and password are the same type of authentication: using something the user knows. Therefore anything you can do with a pin, you can also do with a password, just append the two for a longer password. Using it as username unnecessarily complicates things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.