1

I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. Are there security risks that make this a bad idea?

  • 3
    Well a phone number is no secret, so effectively your passcode is the fact that "your phone number is the passcode". And the real questions is, if that is safe. – bayo Aug 15 '15 at 10:04
  • @bayo15 answered it as targeted as possible: Not secret! – dan Aug 15 '15 at 14:59
  • If it's known data about you, it isn't a password or pin. Just that simple. It's why all those secondary security questions are suspect. If it can be found on your facebook page or is known by your friends, business contacts, etc. it isn't secret. These are the first things somebody skilled in "social engineering" will try. – Fiasco Labs Aug 15 '15 at 16:23
  • If it wasn't insecure, it probably is after you posted this question. – Neil Smithline Aug 16 '15 at 2:25
  • @NeilSmithline Yeah, I changed it already to something else. – Nzall Aug 16 '15 at 9:35
3

Your phone number is documented in a large number of places - your friends, your family, your employer, maybe even your Facebook profile and G+ profiles. Many of these people know your phone number. Some of them may even know it from memory.

The equivalent would be writing your password down in an email and sending it to your contacts list - you're not advertising the fact that it is your password but the information is out there and significantly easier to find than a password or PIN that you have memorized (which would require intimidation or torture to get it out of you, or brute force/exploiting a vulnerability to bypass).

1

Using your phone number as your PIN code exposes you mainly to password (PIN) guessing attack. Your phone number is not a strong knowledge factor. People you know and trust, and thus they know you could be the first ones to guess your password. There are so many users who use their phone number as a password to their social/messaging accounts which thing is a bad practice.

0

If an hacker can tell that the passcode is as long as a phone number, he is likely going to try that. This to me is the same as using your pets name, road name etc. This is not secure in my opinion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.