4 ms·
The remediation is human and pw/pin policy: make sure users pick a good pin and that they're not using it anywhere else.
by 1letterunixname 4y ago
The remediation is human and pw/pin policy: make sure users pick a good pin and that they're not using it anywhere else.
- eptcyka 4y agoWhen it comes to 4 or 6 digit pins, its almost impossible to ensure that no pin has been used before. At 8 digits, you might as well be using diceware anyway.
- TylerE 4y agoAt least by not allowing 4 you get rid of the two most common lazy date formats (and YYYY)
- eptcyka 4y agoDoes it matter if you can bruteforce a 4 digit pin in a day, if there's no TPM guarding it?
- lxgr 4y agoNothing prevents users from using 0YYYY or 0DDMM/0MMDD. Every time some site ridiculously insists I "use a more secure password", I sigh and add "A1!$" to the end of my 32-character alphanumeric random string.
- lxgr 4y agoA PIN is almost by definition a low-entropy secret and is only secure together with some rate-limiting mechanism. Never (only) encrypt things with a PIN.