1

PINs secured by TPM or similar hardware are secure even if short and only numeric because the TPM can throttle and lock after several attempts. I'm concerned about PIN reuse. I suspect most people are using the same PIN everywhere.

Should I generate my users PINs?

2 Answers 2

1

Yes, you should generate PINs for users, no matter if other authentication factors are used. Humans are bad at generating random numbers. And you cannot filter out the numbers that are not so random, because what is not random for particular user, e.g. birthday or some other fact related to particular person, can look pretty random for you and you will not filter it out.

See more detail here:

0

That depends on whether the PIN is the only factor used. For example, a key card and six-digit PIN are both required to authenticate. After 5 wrong entries, the card locks.

Which pins would you try?

So, even though the search space is small, it's unlikely an attacker will find the right PIN in 5 tries.

In this scenario, it would make sense to ban PINs like all repeated digits or predictable series like 123456, because an attacker would likely try those.


In scenarios, where the PIN is the only factor, then yes, generating them randomly is a good idea, since attack surface would be much larger.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .