5

Pins in other contexts seem to usually be only four or six characters long, but this seems to be vulnerable to brute force attacks. However, I am not very knowledgeable about this, so there may very well be a method to prevent this. Is there?

5

The R2B2 can guess a 4 digit pin (10,000 combinations) in about 20 hours, not taking into account the delay for entering a phrase after every 4 failed tries. When using a 6 digit pin (1,000,000 combinations) this will rise with a factor of +/- 100, making it about 2000 hours (about 83 days). A 8 digit pin (100,000,000 combinations) would again raise this even higher.

The question is, when using a 6 or 8 digit pin (the 4 digit is way to low imo), why not use a password? What is the added value of a pin when you could also use a 6 or 8 digit numerical password, besides having the intruder know he only has to try numerical values?

  • 3
    AFAIK the PIN feature is there to provide great usability (in trade of to lower security) for touch devices (phones/tablets). > In a world with increasingly strict password requirements—with > numbers, symbols, and capitalization—it can take upwards of 30 seconds > to enter a long, complex password on a touch keyboard. We have a > strong belief that your experience with Windows 8 should be both fast > and fluid, and that starts when you sign in. Source – bayo Jul 31 '15 at 9:13
  • 1
    Windows 10 said that pins were more secure than passwords, I think because pins cannot be used to access a computer from other devices or something. – Kelmikra Jul 31 '15 at 11:35
  • → Kyth'Py1k: I can't see (trust?) the real math behind this commercial Windows speech. – dan Aug 2 '15 at 2:35
  • @danielAzuelos What Microsoft is basically saying is that when/if an attacker cracks your pin, they can't use that to log in to your Microsoft Account, and thus, all of your Windows 10 pc's with that account. So yeah, it's not really more 'secure' at all. – David Zech Aug 13 '15 at 19:03
  • @DavidZech that's awkwardly phrased; am I correctly reading it as saying that a compromised pin exposes all data on a single device; but not anything protected by an MS account and stored elsewhere (as would be the case if the attacker logged in by compromising the associated MS account password)? Or is everything in the MS cloud also exposed, but local files on other computers using the MS account still supposed to be safe? – Dan Neely Sep 22 '15 at 20:55
3

First of all, Microsoft Windows allows you now to use PINs of any length. Secondly:

Microsoft has taken a new approach to thwarting brute force attacks with a challenge phrase. Essentially when a the PIN gets entered incorrectly four times in a row, users are sent to a different screen where they are required to enter a specific phrase. This ‘challenge phrase’ slows potentially malicious brute force entry and doesn’t freeze the device. While similar to a captcha method, the challenge phrase also prevents automated machines from entering popular PINs over and over.

Source.

  • 3
    After viewing @BadSkillz video, I found this solution to be very nice. Then I read the sequel of your linked article: "Currently there is a single challenge phrase of A1B2C3". Well, it's like a captcha with a single well-known answer. Why I am not so surprised? Aaah, Windows, how brilliant ideas can be ruined for I-don't-know-what-reason :( ... – WhiteWinterWolf Aug 2 '15 at 9:56
  • @WhiteWinterWolf I totally agree :) – user45139 Aug 2 '15 at 10:00
2

Windows logic behind using a PIN is it's easier to remember a PIN (numbers), so you won't have to write it down.

While this is correct, it doesn't make it more secure.

Just like with passwords (password, qwerty) the average user gets lazy. My guess is that most people will use PIN numbers that are 4 digits, and something familiar. DOB, bank card pin, family DOB, or simple patterns, 1234, 0000, 8008, 2580.

Windows has implemented some brute force protection, which helps prevent or at least slows down automated brute force attempts.

However, with my guess above, it will make manual brute force attacks by family members or non technical users with some information on the user much easier.

My advice

  • Use PINs longer than 4 numbers
  • Make it unique, no birthdays, funny body parts, keyboard patterns
  • Remember it, don't write it down
  • Disregard everything above and use a password

And to answer the title, a random number of digits thats easy to remember in your head, but also isn't 4.

The reason I say not 4 is that is the default number people think of with PIN numbers, and the reason I say a random number is for a little more obscurity.

e.g.: If you told someone your password is 20 characters long, they would attempt to brute force 20 characters. If you didn't, they would have to attempt 1-20.

Obviously the more digits you use, the harder it will be to guess/force, but there's also the debate over usability vs security.

1

The delay that Windows 10 adds for guessing PINs is an important factor. For Windows 10 desktop v1903, it seems to be that you can guess four PINs incorrectly, wait some period of time (starting from 0 seconds, then 30 seconds the second round, then 1 minute, then 2 minutes, apparently doubling each time), then have to type in the challenge phrase A1B2C3, then you can guess again, and then you'll have to restart the device to try again. (Note that it does have to be a cold reboot; if you try take advantage of fast startup by shutting down and booting, it'll still say you have to restart to try again.)

Say we can type in five PINs and type in the challenge phrase in 5 seconds, and rebooting takes 25 seconds (although it actually takes about 45 seconds for my Surface Pro 6). If the maximum lockout time is 99,999 minutes (although the link appears to be about passphrases, not PINs), we can guess 5n PINs in

if n ≤ 16: (0.5 + ∑₁ⁿ (0.5 + 0.5 × 2ⁱ) minutes.

else: (0.5 + ∑₁¹⁶ (0.5 + 0.5 × 2ⁱ) + (n - 16)(0.5 + 99,999)) minutes.

For a four-digit purely numerical PIN, we'd have to guess 5,000 PINs on average (10,000 total possible combinations), or n = 1,000, which is about 187.2 years.

If the maximum lockout time were instead 30 minutes (I haven't tested this enough to know what it really is), we can guess 5n PINs in

if n ≤ 4: (0.5 + ∑₁ⁿ (0.5 + 0.5 × 2ⁱ) minutes.

else: (0.5 + ∑₁⁴ (0.5 + 0.5 × 2ⁱ) + (n - 4)(0.5 + 30)) minutes.

For n = 1,000, this would be just over 21 days. Not terrible.

For a 6-digit numeric PIN (n = 100,000), this would be 5.8 years. For a 4-character alphanumeric PIN, not including capital letters (n = 167,961.6), this would be 9.74 years.

However, this is all assuming that no one (e.g., you) ever enters the correct PIN during the time period, which would reset the lockout period. If they're sneakily repeatedly trying PINs while you're not there, they could crack it in a somewhat shorter amount of time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.