2 ms·

> Our study found there is little benefit to longer 6-digit PINs as compared to 4-digit PINs. as a basic rule of thumb, any paper on cybersecurity that does no

> Our study found there is little benefit to longer 6-digit PINs as compared to 4-digit PINs. as a basic rule of thumb, any paper on cybersecurity that does not start the discussion with a reference attack vector and listed assumptions is probably garbage. a charitable interpretation would be that they left out such details in the leading summary, but those details matter more than the actual findings. if im an IT manager and trying to decide how to lock phones, an accurate threat model is more important than the mitigations. good mitigations against the wrong threat is much, much worse than bad mitigations against the correct threat EDIT: woops! i did the bad thing thats ruining society and read the web article instead of the paper. the paper has a whole section on picking a threat model. i dont have time to read the whole thing, but my skimming seems to be that the list length of actually used 4 digit pins is of comparable size to 6 digit pins, which is surprising but the paper still feels a little bit published-for-the-sake-of-publishing

saagarjha 7y ago
> i did the bad thing thats ruining society and read the web article instead of the paper I feel like reading the site that presents the paper shouldn’t really count…
- dahart 7y ago
  The site, not the paper, got posted. If the site shouldn't count, maybe we shouldn't post paper summary sites? Even though lay-person/marketing summaries of papers, and popular reporting summaries very often mess up academic results, or even just leave out details, personally I feel like having some hidden requirement to read through and understand the complete academic sources behind any article is onerous and might be unreasonable, especially if the paper is technical and inaccessible to a lay audience. I appreciate it when someone like @kryogen1c recognizes and admits their gut reaction was based on incomplete information, that's as valuable to me as hearing comments that research and understand the sources.
mgalka 7y ago
> as a basic rule of thumb, any paper on cybersecurity that does not start the discussion with a reference attack vector and listed assumptions is probably garbage. Actionable guidance for real world decisions is not the objective of academic research. The objective is to expand the human knowledge base (which hopefully translates to something practical at some point). If the authors have the domain expertise to weigh in on PINs, but not on attack vectors, then that is what they should do. Let someone else draw the conclusions for IT managers.

saagarjha 7y ago

> i did the bad thing thats ruining society and read the web article instead of the paper I feel like reading the site that presents the paper shouldn’t really count…

dahart 7y ago
The site, not the paper, got posted. If the site shouldn't count, maybe we shouldn't post paper summary sites? Even though lay-person/marketing summaries of papers, and popular reporting summaries very often mess up academic results, or even just leave out details, personally I feel like having some hidden requirement to read through and understand the complete academic sources behind any article is onerous and might be unreasonable, especially if the paper is technical and inaccessible to a lay audience. I appreciate it when someone like @kryogen1c recognizes and admits their gut reaction was based on incomplete information, that's as valuable to me as hearing comments that research and understand the sources.

mgalka 7y ago

> as a basic rule of thumb, any paper on cybersecurity that does not start the discussion with a reference attack vector and listed assumptions is probably garbage. Actionable guidance for real world decisions is not the objective of academic research. The objective is to expand the human knowledge base (which hopefully translates to something practical at some point). If the authors have the domain expertise to weigh in on PINs, but not on attack vectors, then that is what they should do. Let someone else draw the conclusions for IT managers.