4 ms·

I never got why 4 digit PINs were so common. Not only does requiring more digits make it harder to guess by brute-force, it also prevents people from making fra

• rurp 2y ago
  Is that a problem that needs solving? Most interfaces for entering a user-generated PIN, like an ATM, are heavily monitored and rate limited. It's not like backend databases are routinely encrypted with these. As others have said, increasing the length would do little to increase security in most cases since the usual response will be to repeat digits. Plus the current system seems to be working pretty well empirically. This reminds of the password rotation policies that some companies insist on using, despite the evidence that they are a waste of time. In practice they are an "Increment the last digit of your password" policy.
• jryb 2y ago
  Even at 8 digits people could still use their birthdays. I think there's a tradeoff between PIN size and fraction of the population that will feel comfortable picking a number with no significance. I'd speculate that in a world where every PIN has to be 16 digits that almost everyone would just use 2 or 4 concatenated dates.
  • lysp 2y ago
    That's why you need an odd number. ie 5. Or 7 for higher security.
• srmarm 2y ago
  Most of the time they do the trick (when rate limited). Even using a birthday will still stop card thieves from emptying your bank account at an ATM. I'd hazard a guess that asking for an 8 digit pin will see lots of people just repeat the first 4 digits again.