7 ms·

> Passkeys not only offer an improved user experience by letting you sign in faster with your ... PIN, but they also aren’t susceptible to the same kinds of att

> Passkeys not only offer an improved user experience by letting you sign in faster with your ... PIN, but they also aren’t susceptible to the same kinds of attacks as passwords. I don't know about you, but a PIN is pretty much a password in my book. Once I figured out that I can use a password with Windows, I stopped using my PIN. (I didn't use Windows for about a decade.) It's much easier to remember. Even worse, on Windows, I'll only use passkeys on sites where I can use a Yubikey. If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it. Otherwise, on Mac, my passkey supports my fingerprint sensor. Much easier.

stetrain 2y ago
The Windows PIN is just a local password that isn't tied to a cloud account or ever sent across the network. Mine is a full text password, it doesn't have to be numeric. I haven't tried it but it should also work with "Windows Hello" supported face or fingerprint recognition.
- gwbas1c 2y ago
  That is not mentioned anywhere, neither in the article, or when setting up a PIN. The common definition of a PIN is for things like using an ATM, where the PIN is for the account, not the card itself.
  - lxgr 2y ago
    The PIN is also for the card itself. The smartcard chip inside the card can validate it for offline transactions (although that's not as common in the US). I think a reasonable modern definition for a PIN is "a password that can safely be short"; more here: https://news.ycombinator.com/item?id=42446015 https://news.ycombinator.com/item?id=42446015
    - gwbas1c 2y ago
      PIN stands for "Personal Identification Number." It can't have letters / symbols in it. If they're calling a password a PIN, that's the wrong word and will confuse the ^%$^#% out of people who expect PIN to mean numbers only.
vel0city 2y ago
> I don't know about you, but a PIN is pretty much a password in my book. Then your book is filled with misunderstandings of what the PIN function in Windows is actually doing.
- drusepth 2y ago
  What's the difference between the two? I can log into my laptop with a password or a PIN; I assume anyone that steals or hacks my laptop can _also_ log in with a password or a PIN. PINs are inherently shorter and more simpler than passwords; why would anyone use a PIN over a password?
  - toast0 2y ago
    If you change your motherboard, your windows PIN won't work anymore, and you'll have to login to the underlying microsoft online account. A regular local account with a password would still work after a motherboard change. This is assuming no bitlocker. If you have bitlocker, I don't know if bitlocker key recovery will also fix the pin (hopefully you printed the recovery key and can find it) I'm guessing this would also mess up passkeys.
    - UltraSane 2y ago
      AMD CPUs have fTPM built in so the passkeys are actually stored in the CPU. This is more secure because separate TPM chips on the mobo have been attacked by listening to the traces from the TPM to the CPU.
      - toast0 2y ago
        Maybe the PIN doesn't change if you swap the motherboard and keep the CPU, maybe. But if you swap the motherboard and the CPU your PIN doesn't work anymore.
  - hahn-kev 2y ago
    The difference is that I can't login to your account using a pin. I need to use your master password or passkey, then once I have I can use a pin. Basically the pin is only local to your machine, so yes if someone steals your laptop it's the same, but there's a lot less people than can steal your laptop then can try to guess your Gmail password
notatoad 2y ago
A PIN is not a password, because it only works on a device that you have already autheticated using some much more secure mechanism. if there is anywhere that you can use a PIN without additional authentication it's not a PIN, it's just shitty insecure password.
- lxgr 2y ago
  Not necessarily. You can securely use PINs over a protocol like SRP, as long as the backend can be trusted to perform rate limiting properly.
lxgr 2y ago
> a PIN is pretty much a password in my book. My definition of a PIN is a password that can safely be short (i.e. low entropy), which means you can only use it against a system capable of enforcing a rate limit. That can be local trusted hardware (such as a secure enclave, a Yubikey etc.) or a remote backend via something like SRP. > If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it. Then use your password! A PIN can, but does not have to, be short :) FIDO-compliant authenticators have to accept up to 255 UTF-8 characters; you're by no means limited to a numeric 4-digit code.

stetrain 2y ago

The Windows PIN is just a local password that isn't tied to a cloud account or ever sent across the network. Mine is a full text password, it doesn't have to be numeric. I haven't tried it but it should also work with "Windows Hello" supported face or fingerprint recognition.

gwbas1c 2y ago
That is not mentioned anywhere, neither in the article, or when setting up a PIN. The common definition of a PIN is for things like using an ATM, where the PIN is for the account, not the card itself.
- lxgr 2y ago
  The PIN is also for the card itself. The smartcard chip inside the card can validate it for offline transactions (although that's not as common in the US). I think a reasonable modern definition for a PIN is "a password that can safely be short"; more here: https://news.ycombinator.com/item?id=42446015 https://news.ycombinator.com/item?id=42446015
  - gwbas1c 2y ago
    PIN stands for "Personal Identification Number." It can't have letters / symbols in it. If they're calling a password a PIN, that's the wrong word and will confuse the ^%$^#% out of people who expect PIN to mean numbers only.

vel0city 2y ago

> I don't know about you, but a PIN is pretty much a password in my book. Then your book is filled with misunderstandings of what the PIN function in Windows is actually doing.

drusepth 2y ago
What's the difference between the two? I can log into my laptop with a password or a PIN; I assume anyone that steals or hacks my laptop can _also_ log in with a password or a PIN. PINs are inherently shorter and more simpler than passwords; why would anyone use a PIN over a password?
- toast0 2y ago
  If you change your motherboard, your windows PIN won't work anymore, and you'll have to login to the underlying microsoft online account. A regular local account with a password would still work after a motherboard change. This is assuming no bitlocker. If you have bitlocker, I don't know if bitlocker key recovery will also fix the pin (hopefully you printed the recovery key and can find it) I'm guessing this would also mess up passkeys.
  - UltraSane 2y ago
    AMD CPUs have fTPM built in so the passkeys are actually stored in the CPU. This is more secure because separate TPM chips on the mobo have been attacked by listening to the traces from the TPM to the CPU.
    - toast0 2y ago
      Maybe the PIN doesn't change if you swap the motherboard and keep the CPU, maybe. But if you swap the motherboard and the CPU your PIN doesn't work anymore.
- hahn-kev 2y ago
  The difference is that I can't login to your account using a pin. I need to use your master password or passkey, then once I have I can use a pin. Basically the pin is only local to your machine, so yes if someone steals your laptop it's the same, but there's a lot less people than can steal your laptop then can try to guess your Gmail password

notatoad 2y ago

A PIN is not a password, because it only works on a device that you have already autheticated using some much more secure mechanism. if there is anywhere that you can use a PIN without additional authentication it's not a PIN, it's just shitty insecure password.

lxgr 2y ago
Not necessarily. You can securely use PINs over a protocol like SRP, as long as the backend can be trusted to perform rate limiting properly.

lxgr 2y ago

> a PIN is pretty much a password in my book. My definition of a PIN is a password that can safely be short (i.e. low entropy), which means you can only use it against a system capable of enforcing a rate limit. That can be local trusted hardware (such as a secure enclave, a Yubikey etc.) or a remote backend via something like SRP. > If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it. Then use your password! A PIN can, but does not have to, be short :) FIDO-compliant authenticators have to accept up to 255 UTF-8 characters; you're by no means limited to a numeric 4-digit code.