12

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just wondering how secure that is. I have the following questions:

  1. Does Windows 10 only allow a small number of pin attempts and then require a full password? Is it possible to enable this type of functionality?
  2. If my disk is not encrypted does it matter if I use a password or a pin?
  3. In general is it advisable to turn this login feature on or stick with password based login?

This question addresses a portion of Question 1, but not completely.

  • 6
    possible duplicate of How long should Windows 10 pins be? – BadSkillz Aug 14 '15 at 11:03
  • While that questions asks about the length of PINs, this question is about this login method in general - whether it's advisable to turn it on in the first place. I believe the two questions are different. – Borek Bernard Aug 14 '15 at 11:41
  • 2
    Those answers and comments also addressed the possible security risks, i.e. after 4 failed pin attempts you need to enter "A1B2C3" before you can do another try and how the pin won't let an attacker get you password for you MS account. – BadSkillz Aug 14 '15 at 11:58
6

PIN numbers do not replace passwords. A password is still required. PINs allow you to have a very strong password with the convenience of being able to quickly unlock your device.

PIN numbers in Windows 10 are not really included to increase the security of that specific device. In order to configure a PIN number on a device you must first log into that device using your Microsoft account and then configure a PIN number - the PIN number only unlocks the device you've set that PIN number up on, meaning that if the PIN number is compromised the attacker only gains access to that machine, not to your other devices, not to your Microsoft account.

As per one of the moderators on the Microsoft Answers question "PIN makes Windows LESS, FAR, FAR, LESS secure":

  • The PIN can only be used on the physical device it is set up on
  • PIN login only allows 4 incorrect attempts before you're challenged
  • After 1 more failure, you must restart the machine
  • After going through the above process a couple of times the PIN is blocked

Essentially this is a convenience feature, allowing you to a use a very strong password for your account and a much easier password for unlocking your devices. Entering the PIN number also requires physical access to the device, so brute forcing it would be time consuming and require manual input.

  • 3
    "PIN numbers in Windows 10 are not really included to increase the security of that specific device" My worry is whether they decrease the security or not. For example, if Windows only allowed 5 PIN attempts and then disabled this login feature, I wouldn't really feel any less secured. However, if the attacker can try as many times as they wish it will be significantly simpler for them to brute force the login. (Still inconvenient for them but at least possible; it's virtually impossible to brute-force my main password.) – Borek Bernard Aug 14 '15 at 11:40
  • The comment from that MS link is very interesting pertaining to malware and keylogging... although one wonders how long it will be before that long password is captured for Office etc. anyway and thus of no real concern as a real protection at login. – Dave Oct 23 '15 at 21:15
0

And if my disk is not encrypted maybe it generally doesn't matter whether I have pwd or PIN?

I don't have enough reputation to comment, so I'm writing an answer. If you are not using disk encryption it doesnt matter are you using password or PIN. If someone wants your information, he will restart your computer and put a LiveUSB with Ubuntu (for example) and he will have access to all your information and download it easily.

  • 1
    Ok that answers part of the question. How about if I have full disk encryption turned on? Does allowing PIN login lower my security then? – Borek Bernard Aug 14 '15 at 11:56
  • I really don't how this system works. If it gives you only 3-5-7 PIN attempts it's good, but if you can make as many you want, it's really bad. I prefer using strong and long passwords, I can't trust to PIN number. Anyone can see which 4-6 digits are you typing (if it's near you). – Kasmetski Aug 14 '15 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.