5 ms·

PINs can be up to 6 digits (at least here in the UK, but I doubt it's country specific), even though the ones they give you by default are only ever 4. So that'

PINs can be up to 6 digits (at least here in the UK, but I doubt it's country specific), even though the ones they give you by default are only ever 4. So that's only a leak of 1% of them.

extraduder_ire 2y ago
Does that not cause problems on some card machines? I've come across a few that definitely don't let you put in more than four digits.
- jiggawatts 2y ago
  That provides very valuable information: DO NOT TRUST this machine to be secure! Similarly, any web site or app that can’t correctly handle a space character at the end of the password should never be trusted with anything of consequence.
  - quietbritishjim 2y ago
    Are you really worried that a card machine is going to leak your PIN? That doesn't seem to be a common attack vector compared to a third-party skimmer being attached or someone just mugging you and demanding your PIN under threat of physical violence. To answer the actual question: I don't know because I left my PIN at 4 digits, despite knowing I could use more, precisely because I didn't think it would really make my life any more secure.
    - jiggawatts 2y ago
      I'm not worried specifically about the PIN leaking. The concern is that a 4-digit max PIN length is certainly implemented by someone who couldn't be bothered to read the spec for secure credit card transaction handling. It's the equivalent of the "No brown M&Ms" clause or "Canary in the coal mine" test. Nobody actually cares about the M&M color or some dumb bird.
      - lxgr 2y ago
        "Must support 6-digit PINs" is not part of "the spec for secure credit card transaction handling" – which is also not a (or at least one) thing: There are dozens of card networks, and many of them have tons of regional variations. In some markets, issuers only allow 4 digit PINs, and customers don't expect to have to press an "enter" key when they're done entering their 4 digit PIN – so the reasonable implementation is to allow only 4 digit PINs, or you'll be left with people staring at the ATM/POS terminal, waiting for something to happen.
        jiggawatts 2y ago
        4 is the minimum number of digits required, but there are over a dozen different PIN block standards, and most allow between 4..9 and 4..16 digits: https://www.eftlab.com/knowledge-base/complete-list-of-pin-blocks https://www.eftlab.com/knowledge-base/complete-list-of-pin-b... Making an ATM that can accept cards from multiple issuers (which is the norm these days) and allowing only 4 digits is the same category of error as requiring that the first character of someone's last name start with a capital letter, or to block symbol characters in names.
        alexvitkov 2y ago
        > or to block symbol characters in names. People tend to very very quickly their mind on that one once they get a few right-to-left control characters that flip over the text layout of the entire program.
        jiggawatts 2y ago
        "We'll just not do business with anyone named O'Neill, that's just a made-up name designed to trick the database with SQL injection." Also: https://www.ancestry.com.au/name-origin?surname=null https://www.ancestry.com.au/name-origin?surname=null
        lxgr 2y ago
  - lxgr 2y ago
    Why? PINs are limited to 4 digits in many markets, so it's not exactly extreme for a developer to not consider the (to them) edge case of 6 digit PINs on foreign cards. Conversely, it seems very possible to support 6 digit PINs and yet still make a ton of horrible implementation mistakes, security and otherwise.
  - lobsterthief 2y ago
    Why is the space thing inherently insecure? I’m thinking bad form validation could trip it up and be considered “not handled” vs concerns suggesting plaintext storage
- lxgr 2y ago
  It most certainly does.
- hakfoo 2y ago
  For some reason, a lot of credit card processing APIs are still oriented around physical card machines, so they have a lot of fields devoted to self-declaration of the available features. Some of the APIs allow the machine to say "I can accept a PIN up to 12 digits". However, I don't know if anyone 1) actually delivered on it and 2) how you'd know in advance just poking random devices in stores.
- sltkr 2y ago
  Surprisingly, no, or at least it's not common. I'm from a country that has 6-digit PINs on most cards, and I've traveled to e.g. the United States where people are surprised that credit card PINs can be more than 4 digits, but in my experience, terminals accept them just fine. It seems like they are designed to suggest a PIN is only 4 digits but they will happily accept more. So while you're entering your PIN, the display looks something like: [....] [*...] [**..] [***.] [****] [*****] [******] And then you hit OK and the PIN is accepted.
tomtomtom777 2y ago
It helps, but only temporary. I wouldn't be surprised if all 6 digit PINs will be leaked within a few decades.
- banku_brougham 2y ago
  No with the rate of development of quantum computers that estimate is down to the next few years.
- sltkr 2y ago
  Not to worry. We'll just switch to 8 digit PINs and we'll be safe once and for all.
bookstore-romeo 2y ago
My card doesn't even let me include repeating digits in its PIN. I suppose it can make a one-off guess more likely than one in a thousand to correctly guess my PIN.
- lenocinor 2y ago
  Is it repeating in the whole PIN, or in digits next to each other? I'm trying to resist the nerd snipe of what the total number of possibilities would be in the latter case...
  - squarehead11 2y ago
    I believe it would be 7290, or more generalized, S(N) = 10 * 9 ^(N-1) with N being the length of the code and S being the number of combinations (assuming that a decimal system is used) And from there, with variable lengths ranging from L to H, S(L, H) = 5/4 * 9 ^(L-1) * (9^(U-L+1) - 1) So if the bank allows combinations from 4 - 6 digits, there would be a total of 663390 combinations to choose from. Now, of course, the bank may decide to go from decimal to hexadecimal in the future - or maybe, there systems allow only duodecimal. In any case, the formula can be generalized further to account for all number systems - with B being the base of the system: S(L, H, B) = (B/(B-2)) * (B-1) ^(L-1) * ((B-1)^(U-L+1) - 1) This is only defined for B > 2 - in binary system, there's only ever two combinations which fit the constraint
- lxgr 2y ago
  Which is honestly not a bad idea, given that somebody shoulder surfing or trying to read smudges on the PIN pad becomes much easier in the case of repeated numbers. "1111" would just leave a fingerprint on a single key, for example, and only one possible PIN (or maybe 3, if the bank/card allows 6 digit PINs).

PINs can be up to 6 digits (at least here in the UK, but I doubt it's country specific), even though the ones they give you by default are only ever 4. So that's only a leak of 1% of them.

extraduder_ire 2y ago

Does that not cause problems on some card machines? I've come across a few that definitely don't let you put in more than four digits.

jiggawatts 2y ago
That provides very valuable information: DO NOT TRUST this machine to be secure! Similarly, any web site or app that can’t correctly handle a space character at the end of the password should never be trusted with anything of consequence.
- quietbritishjim 2y ago
  Are you really worried that a card machine is going to leak your PIN? That doesn't seem to be a common attack vector compared to a third-party skimmer being attached or someone just mugging you and demanding your PIN under threat of physical violence. To answer the actual question: I don't know because I left my PIN at 4 digits, despite knowing I could use more, precisely because I didn't think it would really make my life any more secure.
  - jiggawatts 2y ago
    I'm not worried specifically about the PIN leaking. The concern is that a 4-digit max PIN length is certainly implemented by someone who couldn't be bothered to read the spec for secure credit card transaction handling. It's the equivalent of the "No brown M&Ms" clause or "Canary in the coal mine" test. Nobody actually cares about the M&M color or some dumb bird.
    - lxgr 2y ago
      "Must support 6-digit PINs" is not part of "the spec for secure credit card transaction handling" – which is also not a (or at least one) thing: There are dozens of card networks, and many of them have tons of regional variations. In some markets, issuers only allow 4 digit PINs, and customers don't expect to have to press an "enter" key when they're done entering their 4 digit PIN – so the reasonable implementation is to allow only 4 digit PINs, or you'll be left with people staring at the ATM/POS terminal, waiting for something to happen.
      - jiggawatts 2y ago
        4 is the minimum number of digits required, but there are over a dozen different PIN block standards, and most allow between 4..9 and 4..16 digits: https://www.eftlab.com/knowledge-base/complete-list-of-pin-blocks https://www.eftlab.com/knowledge-base/complete-list-of-pin-b... Making an ATM that can accept cards from multiple issuers (which is the norm these days) and allowing only 4 digits is the same category of error as requiring that the first character of someone's last name start with a capital letter, or to block symbol characters in names.
        alexvitkov 2y ago
        > or to block symbol characters in names. People tend to very very quickly their mind on that one once they get a few right-to-left control characters that flip over the text layout of the entire program.
        jiggawatts 2y ago
        "We'll just not do business with anyone named O'Neill, that's just a made-up name designed to trick the database with SQL injection." Also: https://www.ancestry.com.au/name-origin?surname=null https://www.ancestry.com.au/name-origin?surname=null
        lxgr 2y ago
- lxgr 2y ago
  Why? PINs are limited to 4 digits in many markets, so it's not exactly extreme for a developer to not consider the (to them) edge case of 6 digit PINs on foreign cards. Conversely, it seems very possible to support 6 digit PINs and yet still make a ton of horrible implementation mistakes, security and otherwise.
- lobsterthief 2y ago
  Why is the space thing inherently insecure? I’m thinking bad form validation could trip it up and be considered “not handled” vs concerns suggesting plaintext storage
lxgr 2y ago
It most certainly does.
hakfoo 2y ago
For some reason, a lot of credit card processing APIs are still oriented around physical card machines, so they have a lot of fields devoted to self-declaration of the available features. Some of the APIs allow the machine to say "I can accept a PIN up to 12 digits". However, I don't know if anyone 1) actually delivered on it and 2) how you'd know in advance just poking random devices in stores.
sltkr 2y ago
Surprisingly, no, or at least it's not common. I'm from a country that has 6-digit PINs on most cards, and I've traveled to e.g. the United States where people are surprised that credit card PINs can be more than 4 digits, but in my experience, terminals accept them just fine. It seems like they are designed to suggest a PIN is only 4 digits but they will happily accept more. So while you're entering your PIN, the display looks something like: [....] [*...] [**..] [***.] [****] [*****] [******] And then you hit OK and the PIN is accepted.

tomtomtom777 2y ago

It helps, but only temporary. I wouldn't be surprised if all 6 digit PINs will be leaked within a few decades.

banku_brougham 2y ago
No with the rate of development of quantum computers that estimate is down to the next few years.
sltkr 2y ago
Not to worry. We'll just switch to 8 digit PINs and we'll be safe once and for all.

bookstore-romeo 2y ago

My card doesn't even let me include repeating digits in its PIN. I suppose it can make a one-off guess more likely than one in a thousand to correctly guess my PIN.

lenocinor 2y ago
Is it repeating in the whole PIN, or in digits next to each other? I'm trying to resist the nerd snipe of what the total number of possibilities would be in the latter case...
- squarehead11 2y ago
  I believe it would be 7290, or more generalized, S(N) = 10 * 9 ^(N-1) with N being the length of the code and S being the number of combinations (assuming that a decimal system is used) And from there, with variable lengths ranging from L to H, S(L, H) = 5/4 * 9 ^(L-1) * (9^(U-L+1) - 1) So if the bank allows combinations from 4 - 6 digits, there would be a total of 663390 combinations to choose from. Now, of course, the bank may decide to go from decimal to hexadecimal in the future - or maybe, there systems allow only duodecimal. In any case, the formula can be generalized further to account for all number systems - with B being the base of the system: S(L, H, B) = (B/(B-2)) * (B-1) ^(L-1) * ((B-1)^(U-L+1) - 1) This is only defined for B > 2 - in binary system, there's only ever two combinations which fit the constraint
lxgr 2y ago
Which is honestly not a bad idea, given that somebody shoulder surfing or trying to read smudges on the PIN pad becomes much easier in the case of repeated numbers. "1111" would just leave a fingerprint on a single key, for example, and only one possible PIN (or maybe 3, if the bank/card allows 6 digit PINs).