5 ms·

> Go passwordless. Did you know—for improved security and a simple sign-in experience, you can sign in with your face, fingerprint or PIN How on earth would a

> Go passwordless. Did you know—for improved security and a simple sign-in experience, you can sign in with your face, fingerprint or PIN How on earth would a 4-6 digit PIN be more secure than my 20+ character password ? In the end, an PIN is just another password. They may employ a million iterations to their KDF, but 6 digits is still a lot easier to bruteforce than 20 characters. As for the rest, fingerprint and face, they're not secure. Convenient yes, secure no.

PieUser 6y ago
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password https://docs.microsoft.com/en-us/windows/security/identity-p...
- 8fingerlouie 6y ago
  Oh, so a (Windows 10) PIN is more or less like a password, allowing PIN (Password) policies to make complex PINs including letters and punctuation... Explain to me again how this is better than just a password ?
gbba 6y ago
PIN is probably not the best term they could've chosen since the term implies it should be a number. However in this case, the Windows 10 "PIN" can actually be a longer password.
- soylentcola 6y ago
  Like a personal identification npassword? Seriously, though, PIN implies a number for a reason (even if people don't think about it or say things like "PIN number"). They should expect confusion if they refer to a password as a PIN.
- 8fingerlouie 6y ago
  >However in this case, the Windows 10 "PIN" can actually be a longer password. So why is it better to have a longer PIN instead of a longer password ? If a PIN is just another password with the same length/complexity requirements as a regular password, why should i bother ?
ToFab123 6y ago
> How on earth would a 4-6 digit PIN be more secure than my 20+ character password ? Because a 4 - 6 digit PIN you can remember, while a 20+ character password you write down and in many cases store insecurely. Some even store it on a post-it note next to the keyboard.
- 8fingerlouie 6y ago
  Still doesn't change the fact that a 4-6 digit pin is a lot less secure. As for remembering 20+ character passwords, "Correct Horse Battery Staple" (https://xkcd.com/936/ https://xkcd.com/936/) is a fine method for passwords. It doesn't have to be serial port line noise.
fowl2 6y ago
Because that PIN can only be used on that device, whereas your password can be used from anywhere. Think of it like 2FA where one of the factors is physical possession of the device.

PieUser 6y ago

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password https://docs.microsoft.com/en-us/windows/security/identity-p...

8fingerlouie 6y ago
Oh, so a (Windows 10) PIN is more or less like a password, allowing PIN (Password) policies to make complex PINs including letters and punctuation... Explain to me again how this is better than just a password ?

gbba 6y ago

PIN is probably not the best term they could've chosen since the term implies it should be a number. However in this case, the Windows 10 "PIN" can actually be a longer password.

soylentcola 6y ago
Like a personal identification npassword? Seriously, though, PIN implies a number for a reason (even if people don't think about it or say things like "PIN number"). They should expect confusion if they refer to a password as a PIN.
8fingerlouie 6y ago
>However in this case, the Windows 10 "PIN" can actually be a longer password. So why is it better to have a longer PIN instead of a longer password ? If a PIN is just another password with the same length/complexity requirements as a regular password, why should i bother ?

ToFab123 6y ago

> How on earth would a 4-6 digit PIN be more secure than my 20+ character password ? Because a 4 - 6 digit PIN you can remember, while a 20+ character password you write down and in many cases store insecurely. Some even store it on a post-it note next to the keyboard.

8fingerlouie 6y ago
Still doesn't change the fact that a 4-6 digit pin is a lot less secure. As for remembering 20+ character passwords, "Correct Horse Battery Staple" (https://xkcd.com/936/ https://xkcd.com/936/) is a fine method for passwords. It doesn't have to be serial port line noise.

fowl2 6y ago

Because that PIN can only be used on that device, whereas your password can be used from anywhere. Think of it like 2FA where one of the factors is physical possession of the device.