Are there any best practices for storing app specific PINs (e.g. 6 digit PIN that isn't part of the device lock screen) on mobile devices (Android/iOS)? I know several banking and authenticator apps do this. Seems like bcrypt with a reasonable work factor (OWASP recommends 10) is still quite easy to crack given a 6 digit PIN. Are there better ways to store it? For example, are there ways to store it in TEE/StrongBox/Secure Enclave (other than using the device lockscreen) such that any potential attacker will not have access to the PIN, even with runtime instrumentation tools such as Frida?