Is secondary password (e.g.: pin) necessary?

Question

I find some cases (especially in online games) that a software or website asks users to enter an additional password, such as 4 or 6 digit pin numbers, in addition to their original password. Most of the cases, pin is prompted immediately after users successfully logs in with their username and password.

Is this really necessary?
Does an additional password makes the site or software more secure?
In what scenarios that it is needed to use an additional password?

EDIT:
Thank you for all your answers.
But what I really mean by "pin" is a secret code that has the same usage / behavior as a password.
The "pin" is secret, can be changed by user, and probably hashed & stored in a database the same way like a password does.

Here's one example I encountered in an online game:
When a user enters/runs the game for the first time, the game prompts to enter a "pin" consists of 4 digit numbers. This pin can be changed later.
The pin is always used whenever another time the user logs in, and is prompted after the user enters his/her username and password.

Answer 1

In certain implementations, yes, however it is susceptible to the same flaws single-factor passwords have. This renders the extra steps virtually useless.

In general there are three types of factors:

1. Something you know
2. Something you have
3. Something you are

Because a password and reusable pin rely on the same mechanism of knowing something, they can easily both be defeated with the use of a key-logger or other social engineering tactic. The pin would increase the crack-time of a brute force attempt, however it would not completely mitigate the risk of a brute force attempt as a two-factor authentication standard would.

In my experience, often times the pin input field is introduced only after the password is verified. A 6 pin code is easily broken once the initial password is discovered by using the password to gain access to the pin page and brute forcing through less than a million possible number combinations. However, input fields that require the password and the pin code appended together to verify credentials can vastly increase the time to break a password. A password that requires 8 alpha numeric characters hashed with md5 will require just over 113 years to go through all combinations.(http://calc.opensecurityresearch.com/) A password that appends 8 alpha-numeric characters and a 6 alphanumeric pin together increases the calculation time to over 84 trillion years.

If the pin is generated from a physical token with a constantly updating number, you increase the security because you will need both a password and the token to login. Best practices would dictate using true two-factor security and not rely on single-factor security.

Answer 2

I believe what you are referring to is a one-time password (OTP). The 4 or 6 digit code may be sent via SMS or is displayed on a physical token device and is unique for every login.

Does an additional password makes the site or software more secure?

The OTP provides additional security because apart from knowing your username/password, an adversary needs to possess the token or your phone, thus increasing the security. This form of security is known as 2 Factor Authentication (2FA). The first factor is something that they know, e.g. password. The second factor is something they possess, e.g. token.

Is this really necessary? In what scenarios that it is needed to use an additional password?

There is no straight forward rule on when it is necessary. It depends on the level of security you need. Bear in mind that implementing an OTP incurs an increase in inconvenience since the user must now type in the OTP everytime he logs in. In general, OTPs are normally used only for applications requiring higher security such as Internet Banking, whereas other lower risk activities such as signing into StackOverflow does not require an OTP.

Edit:

In this case, the PIN provides a second layer of security but its effect is minimal. E.g. If user reuses his password across multiple sites, then an adversary can login to his account but cannot proceed further since he only knows the password but not the PIN.

However, there are instances where PINs can be set to protect a subset of the features. One of the games that I played in the past allowed you to create multiple characters per account and protect each character with a different PIN. This will allow you to 'share' only one character with a friend.

Answer 3

It's more secure than a password, but it's less secure than a really long password. Suppose that the password must be a minimum of 8 alpanumeric/symbolic characters and the PIN must be 8 digits. That is less secure than a password that must be at least 16 alphanumeric/symbolic characters. The reason is that once an attacker guesses the short password, he knows it and can then brute force the PIN. In the case of a single, long password, he has no idea how close he's come to guessing it.

Answer 4

a PIN or second "known" shared secret. and especially if this is derived from a single time use methodology (like an SMS token or google Autheticator for example) it adds a great deal of additional protection. without that, it helps against password reuse 'hacks' (e.a. a user reuses his/her password. and that password gets "stolen" and now the thief who does have the password still does not have acces to the Software due to not knowning the PIN.)

---

After edit of question:

the PIN is in this case a "second" thing you know. and its designed to make it harder to abuse the game system through malicious means. often password harvesters only look for the password and loginname and do not know about the pin they should also harvest and send to collectors. And from an API viewpoint. just having the username and password still does not give you access to the API and run your own client (this should be protected through other means as well). As for in browsergames. Its part of the never ending fight against the "bad-guys" and it adds a layer of "difficulty" when guessing account information.