3 ms·

> but I highly disagree with that extrapolation. That's great, but your counter-claim isn't obvious at all. So please elaborate. Are you alluding to banks gene

by apl 14y ago

> but I highly disagree with that extrapolation. That's great, but your counter-claim isn't obvious at all. So please elaborate. Are you alluding to banks generally setting people's PINs for them, using more appropriate distributions? Or, God forbid, do you believe that users are more careful when picking sensitive PINs? I have serious doubts about the latter.

grey-area 14y ago
Are you alluding to banks generally setting people's PINs for them, using more appropriate distributions? Or, God forbid, do you believe that users are more careful when picking sensitive PINs? Well yes, of course. Firstly, Banks do set the pin first, and the vast majority of people probably never change it. On your second point, for a bank I would pick a complicated pin and/or password, for some throwaway website/app/game account I'd choose something simpler and easy to remember, many people probably use the same pin for loads of services, but wouldn't use it for their bank for obvious reasons. Most people have some perception of levels of security, even if they only have a binary concept of 'involves my money' or not, and trying to extrapolate from website logins for some unimportant data to banking pins which involve real losses for the user involved is not at all convincing.
- ville 14y ago
  Agreed. It's also worth noting that the dataset does not represent the general population, but only the people who use 4-digit passwords on some websites.
- apl 14y ago
  > Most people have some perception of levels of security We're just trading intuitions here, of course, but I'm virtually certain that people's sensitive passwords are as abysmal as their non-sensitive ones. Sure, you'd pick a good password; however, the mere fact that you're debating this point and that you know what password goodness entails tells me that you're not a helpful sample of the population in question (namely everyone). I'm going to look into finding some data pertaining to this issue. What I'll definitely grant you is that the extrapolation isn't perfect.
- Permit 14y ago
  >Firstly, Banks do set the pin first, and the vast majority of people probably never change it. That's certainly not the case at my bank. I live in Canada, so perhaps things are done differently here, but when I was issued my card they made me choose my PIN.

by apl 14y ago

grey-area 14y ago

Are you alluding to banks generally setting people's PINs for them, using more appropriate distributions? Or, God forbid, do you believe that users are more careful when picking sensitive PINs? Well yes, of course. Firstly, Banks do set the pin first, and the vast majority of people probably never change it. On your second point, for a bank I would pick a complicated pin and/or password, for some throwaway website/app/game account I'd choose something simpler and easy to remember, many people probably use the same pin for loads of services, but wouldn't use it for their bank for obvious reasons. Most people have some perception of levels of security, even if they only have a binary concept of 'involves my money' or not, and trying to extrapolate from website logins for some unimportant data to banking pins which involve real losses for the user involved is not at all convincing.

ville 14y ago
Agreed. It's also worth noting that the dataset does not represent the general population, but only the people who use 4-digit passwords on some websites.
apl 14y ago
> Most people have some perception of levels of security We're just trading intuitions here, of course, but I'm virtually certain that people's sensitive passwords are as abysmal as their non-sensitive ones. Sure, you'd pick a good password; however, the mere fact that you're debating this point and that you know what password goodness entails tells me that you're not a helpful sample of the population in question (namely everyone). I'm going to look into finding some data pertaining to this issue. What I'll definitely grant you is that the extrapolation isn't perfect.
Permit 14y ago
>Firstly, Banks do set the pin first, and the vast majority of people probably never change it. That's certainly not the case at my bank. I live in Canada, so perhaps things are done differently here, but when I was issued my card they made me choose my PIN.