9

Building on the theme presented in this previous question, does Window's current PIN input userflow break standard password security practices?

Behavior: When the user inputs the correct number of digits in the PIN, Windows displays an error message stating that the PIN is incorrect. For example, if the user has an 8-digit PIN, inputting 8 digits will automatically read the input. This is in sharp contrast to other operating systems that require the user to press Enter or otherwise submit the input.

Problem: Bad actors trying random PINs will immediately know how many digits are in the current user's PIN, namely whether it's 4 characters, the minimum, or more. While that information alone may not pose a security risk, repeated surveillance of the user entering their PIN might help an actor narrow down pin candidates.

Comments: Is there any reason that Windows has chosen to automatically submit the numeric input instead of having the user press Enter?

Improve this question
3
  • 6
    Reason? User experience. I'm not sure it is more than that.
    – schroeder ♦
    Commented Nov 22 at 9:49
  • 4
    "repeated surveillance of the user entering their pin might help an actor narrow down pin candidates" - it's game over anyway if the surveillance can see the keyboard. Putting much work into defending against the narrow attack scenario where the attacker has a view of the screen but not the keyboard seems a bit of a waste of time. Especially if you're using a touchscreen!
    – Steve Jessop
    Commented Nov 22 at 17:12
  • 1
    Windows 11 requires the availability of a Trusted Platform Module (TPM) and ties the PIN to the device through the TPM. So the PIN is just a second factor (something you know) besides access to the device (something you have). Treating it like an independent password doesn't make a lot of sense.
    – Ja1024
    Commented Nov 22 at 19:58

4 Answers 4

Reset to default
20

You are trying to compare a password and a PIN. PIN security conventions are that PIN lengths are not a secret. Password conventions are that a password length should be secret (with mins and maximums potentially exposed or learnable).

PINs are a different security measure with different compensating controls. They are controlled by the local hardware, not a central authorisation function, and have hard-coded controls to prevent brute force attacks.

So, don't compare the two things as the same.

Improve this answer
6
  • 2
    You make a very good point there. Not only is it trivial to compare PINs to passwords because they are fundamentally different, but of course they have different uses that wouldn’t work if swapped. Like how using a PIN on a web app wouldn’t be secure, and using a full blown password on say, a mobile phone, would be prioritising security over usability too much, for your average user at least.
    – security_paranoid
    Commented Nov 22 at 10:07
  • 4
    I agree, except that personally I'm not sure about saying that a PIN is not a password. It's a kind of password, used in specific contexts which reduce the need for some of the best-practices around passwords. It's not like it would actually be a problem for me if you knew that my gmail password was exactly 13 characters long, or that my laptop PIN was exactly 6 characters long (in fact each is longer).
    – Steve Jessop
    Commented Nov 22 at 17:02
  • 1
    But sure, if for example you stipulate that a password by definition is a secret memorised by a human, who transmits it (perhaps encrypted) over the internet to a server on which it is hashed and compared to a stored hash -- then a PIN is not a password. Last resort of a scoundrel, I know, but Wikipedia has a very broad definition that a password is "secret data, typically a string of characters, usually used to confirm a user's identity" -- which means PINs and passphrases and for that matter a code sent to your phone by SMS, would all be passwords. With hugely different constraints.
    – Steve Jessop
    Commented Nov 22 at 17:04
  • 2
    @SteveJessop passwords and PINs are used for different purposes and different controls. That makes them categorically different, even if both are in the universe of "secrets", but "poodles are dogs, not all dogs are poodles"
    – schroeder ♦
    Commented Nov 22 at 17:48
  • 1
    @schroeder: true, but an actual literal old-school password, as in "halt! who goes there! state the password!" also is used for different purposes and different controls. I don't think it therefore follows that passwords are not passwords. They're just very weak passwords ;-) Absolutely agree of course that a different purpose leads to a different best practice. The key point is that "standard password security practices" do not apply here for good reason. Whether that's because a PIN is not a password or because it's not typical of passwords doesn't matter that much.
    – Steve Jessop
    Commented Nov 22 at 17:50
15

Hiding the length of a PIN is only security through obscurity, which doesn’t really add much anyway, considering that a 4-digit PIN has 10,000 combinations (a 6-digit 1,000,000, and an 8-digit a whopping 100,000,000.)

Brute force is also made even harder because, as pointed out, Windows PINs are hardware backed, and have rate-limiting in place to, well, limit the amount of (incorrect) attempts.

Plus, while there are many practical examples of where PIN lengths can be determined, in many cases, the PIN length is explicitly shown. One example of this is on iPhones, as shown in the below picture. Obviously, the PIN in the image is four digits long.

iPhone login screen.

So to answer your question, no, the current Windows PIN setup does not break standard password security practices, just by having the PIN length able to be determined.

Improve this answer
10
  • 5
    In addition the PIN is hardware backed, so brute force is supposed to be handled by hardware enforcing time outs or fail to password after a number of attempts.
    – vidarlo
    Commented Nov 22 at 9:50
  • 3
    @MXMLLN but sorry, why would that make a difference? I guess if you had physical access to a laptop for more like months, then you could hypothetically, yes, brute force the PIN. But then I think you’d have bigger problems.
    – security_paranoid
    Commented Nov 23 at 11:10
  • 1
    @SteveJessop or just swap to an 8 digit PIN and you win either way! You either get a secure computer, or a sibling that lives longer than anyone ever has! :D
    – security_paranoid
    Commented Nov 24 at 0:47
  • 2
    @MXMLLN: yes, there are contexts where access to the hardware is basically "game over" because it's relatively easy to install hardware keyloggers and whatnot, between the keyboard and all the secure stuff. But your young siblings probably don't have that, so PINs do work to control access to a multi-user system. Similarly with companies that don't give their employees admin access to their laptops. They trust the employee's integrity enough not to physically set up the laptop to capture an admin password, but not their competence enough to avoid doing something stupid.
    – Steve Jessop
    Commented Nov 25 at 1:16
  • 1
    @security_paranoid in my view it's the same for a password and PIN, it's not security by obscurity, it's better to not reveal/leak information. You can actually have the same hardware backing on a password (TPM does not have a "PIN" concept), I would still be annoyed if my password's length was displayed, and I would still not consider it security by obscurity. The fact that hardware backed PINs may be somewhat secure is irrelevant to whether showing a PIN/password length is security through obscurity.
    – user1532080
    Commented Nov 25 at 12:46
5

PINs are already much "weaker" in that sense than best-practice passphrases should be. Yes, it's true that leaking the length of the PIN weakens it somewhat. Encouraging users to pick 4- or 6- decimal digits weakens it astronomically more. If a general-purpose password was that bad then it really would not matter in the least whether the length is leaked or not -- your password is cracked already. That's not the justification for why Microsoft leaks the length, but the point is Microsoft is not even slightly applying password best-practice to PINs.

The reason it's OK for Microsoft to leak the PIN length is the same as the reason it's OK for PINs to be so absurdly weak, when considered as passwords. It's used in a context where brute force attacks are defended differently. General-purpose passwords need to defend against brute force on leaked files containing password hashes. Obscuring the length is the least part of this, but it's there in the advice anyway. I think probably the general advice is designed such that protocols should give away nothing at all about the content of the password, no matter how little practical help that information really would be to the attacker.

Windows 11 PINs do not defend at all against brute force on leaked hashes, because their threat model says they don't need to. They defend against brute-force attempts to enter the PIN into the device by first requiring possession of the physical device to even start, then limiting the rate of guesses, and then eventually locking out the PIN and requiring a "proper" login, using whatever online security you have enabled (typically password and 2FA).

You can always re-assess general best practice in the context of a specific threat model, and this is what Microsoft has done. PINs AFAIK started with bank cards, where they are similarly weak and with similar justification (or actually with rather less justification prior to chip and PIN).

That said, my work laptop (which the IT department configured) doesn't leak the length of my PIN to someone who is guessing it. I have to hit "enter" at the end of it. So I think there must be some policy you can apply if you disagree with Microsoft's assessment, at least in enterprise contexts.

Improve this answer
3
  • You also make a very good point there, that the PINs shouldn’t need to defend against leaked hashes- it’s disk encryption and physical security’s job to take care of that. And the other thing you must take into consideration is that with a PIN, the likelihood of it being attempted to be brute-forced is drastically lower than a password, because an attacker must physically access the machine.
    – security_paranoid
    Commented Nov 22 at 21:14
  • Oh, and, PIN hashes can be a lot stronger I believe, because limiting processing power for one measly PIN isn’t really a concern.
    – security_paranoid
    Commented Nov 22 at 21:16
  • 3
    (+1) The main of having to hit “enter” is that it gives you the ability to correct the last digit if you know you mistyped without retyping the whole PIN or triggering the rate limitation count.
    – Relaxed
    Commented Nov 23 at 9:44
1

There is one case when knowing the PIN length helps the attacker: if your PIN is in the list of most common PINs then it helps the attacker narrow down the PINs to try, and possibly find the right one before any rate-limiting measures kick in (if you have one of the top 3 most common PINs for that length, notably).

But if you have one of those PINs you're doomed anyway: it may take a little bit more patience, but the attacker will find the PIN.

If you do have a more secure PIN, then the number of tries becomes too large given the limits on the number/speed of inputs, even on a 4-digit PIN.

NB: if the attacker knows anything about you also avoid the usual things like birth dates.

Improve this answer
2
  • I'm certain that 4-digit and 6-digit PINs are often prediposed to be dates, especially between 1940 - 2025
    – MXMLLN
    Commented Nov 25 at 14:02
  • @MXMLLN See the (excellent) analysis in the linked document. As I said, one should avoid those: if the attacker knows you, they should try PINs based on your birth date (e.g. for 4-digit pins, 4-digit year, and 2+2 day+month) among the very first (probably just after 1234, 0000 and 1111). If you have such a weak PIN, knowing the PIN length helps the attacker more or less divide the "easy" search space by 3. But if you have a more decent PIN which doesn't appear in the top 20 and isn't birth-date related, the hardware-assisted rate limiting should make it so 4, 6 or 8 digits are all hard.
    – jcaron
    Commented Nov 25 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .