A 4-digit pin with lockout and an MD5 hash are equally insecure in different ways. The lockout scares me when we acknowledge anyone can be social-engineered int

A 4-digit pin with lockout and an MD5 hash are equally insecure in different ways. The lockout scares me when we acknowledge anyone can be social-engineered into giving up any credential, and anyone can forget a credential no matter how simple. But yeah, at the end of the day, someone who spends a lot of time making cryptographically secure passwords and rotates them every six months is probably less secure on the balance than someone who uses 4-digit pins they rotate every three months.