How long should Windows 10 pins be?

Question

Pins in other contexts seem to usually be only four or six characters long, but this seems to be vulnerable to brute force attacks. However, I am not very knowledgeable about this, so there may very well be a method to prevent this. Is there?

Answer 1

The R2B2 can guess a 4 digit pin (10,000 combinations) in about 20 hours, not taking into account the delay for entering a phrase after every 4 failed tries. When using a 6 digit pin (1,000,000 combinations) this will rise with a factor of +/- 100, making it about 2000 hours (about 83 days). A 8 digit pin (100,000,000 combinations) would again raise this even higher.

The question is, when using a 6 or 8 digit pin (the 4 digit is way to low imo), why not use a password? What is the added value of a pin when you could also use a 6 or 8 digit numerical password, besides having the intruder know he only has to try numerical values?

Answer 2

First of all, Microsoft Windows allows you now to use PINs of any length. Secondly:

Microsoft has taken a new approach to thwarting brute force attacks with a challenge phrase. Essentially when a the PIN gets entered incorrectly four times in a row, users are sent to a different screen where they are required to enter a specific phrase. This ‘challenge phrase’ slows potentially malicious brute force entry and doesn’t freeze the device. While similar to a captcha method, the challenge phrase also prevents automated machines from entering popular PINs over and over.

Source.

Answer 3

Windows logic behind using a PIN is it's easier to remember a PIN (numbers), so you won't have to write it down.

While this is correct, it doesn't make it more secure.

Just like with passwords (password, qwerty) the average user gets lazy. My guess is that most people will use PIN numbers that are 4 digits, and something familiar. DOB, bank card pin, family DOB, or simple patterns, 1234, 0000, 8008, 2580.

Windows has implemented some brute force protection, which helps prevent or at least slows down automated brute force attempts.

However, with my guess above, it will make manual brute force attacks by family members or non technical users with some information on the user much easier.

My advice

• Use PINs longer than 4 numbers
• Make it unique, no birthdays, funny body parts, keyboard patterns
• Remember it, don't write it down
• Disregard everything above and use a password

And to answer the title, a random number of digits thats easy to remember in your head, but also isn't 4.

The reason I say not 4 is that is the default number people think of with PIN numbers, and the reason I say a random number is for a little more obscurity.

e.g.: If you told someone your password is 20 characters long, they would attempt to brute force 20 characters. If you didn't, they would have to attempt 1-20.

Obviously the more digits you use, the harder it will be to guess/force, but there's also the debate over usability vs security.

Answer 4

The delay that Windows 10 adds for guessing PINs is an important factor. For Windows 10 desktop v1903, it seems to be that you can guess four PINs incorrectly, wait some period of time (starting from 0 seconds, then 30 seconds the second round, then 1 minute, then 2 minutes, apparently doubling each time), then have to type in the challenge phrase A1B2C3, then you can guess again, and then you'll have to restart the device to try again. (Note that it does have to be a cold reboot; if you try take advantage of fast startup by shutting down and booting, it'll still say you have to restart to try again.)

Say we can type in five PINs and type in the challenge phrase in 5 seconds, and rebooting takes 25 seconds (although it actually takes about 45 seconds for my Surface Pro 6). If the maximum lockout time is 99,999 minutes (although the link appears to be about passphrases, not PINs), we can guess 5n PINs in

if n ≤ 16: (0.5 + ∑₁ⁿ (0.5 + 0.5 × 2ⁱ) minutes.

else: (0.5 + ∑₁¹⁶ (0.5 + 0.5 × 2ⁱ) + (n - 16)(0.5 + 99,999)) minutes.

For a four-digit purely numerical PIN, we'd have to guess 5,000 PINs on average (10,000 total possible combinations), or n = 1,000, which is about 187.2 years.

If the maximum lockout time were instead 30 minutes (I haven't tested this enough to know what it really is), we can guess 5n PINs in

if n ≤ 4: (0.5 + ∑₁ⁿ (0.5 + 0.5 × 2ⁱ) minutes.

else: (0.5 + ∑₁⁴ (0.5 + 0.5 × 2ⁱ) + (n - 4)(0.5 + 30)) minutes.

For n = 1,000, this would be just over 21 days. Not terrible.

For a 6-digit numeric PIN (n = 100,000), this would be 5.8 years. For a 4-character alphanumeric PIN, not including capital letters (n = 167,961.6), this would be 9.74 years.

However, this is all assuming that no one (e.g., you) ever enters the correct PIN during the time period, which would reset the lockout period. If they're sneakily repeatedly trying PINs while you're not there, they could crack it in a somewhat shorter amount of time.