4 ms·

He quickly glossed over the fact that these are computer passwords which happen to be 4 numeric digits. "Given that users have a free choice for their password

He quickly glossed over the fact that these are computer passwords which happen to be 4 numeric digits. "Given that users have a free choice for their password, if users select a four digit password to their online account, it’s not a stretch to use this as a proxy for four digit PIN codes." Though there probably wouldn't be drastically different phenomenon, I think the actual PIN distribution would be noticeably different. Particularly 1234. It may still be the top PIN, but I don't think it would have the same dominance. People choose trymynewwebservice.ly passwords a lot more callously than their bank password. I have to believe on average people put a little more effort into disguising it.

rm999 14y ago
I wonder about the 2580s (vertical numbers on a PIN pad). It makes perfect sense for PINs, but not a computer keyboard. It could be people keeping their passwords consistent with their PINs e.g. using their ATM PIN for their online bank account password. A lot sites (correctly) prevent people from using very short or simple passwords, including four digit numbers. I'm curious what sites his database comes from.
- maxerickson 14y ago
  This paper(PDF) uses the RockYou password database to do a similar analysis: http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_security.pdf http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_secu... (RockYou discussed here: http://en.wikipedia.org/wiki/RockYou#Controversy http://en.wikipedia.org/wiki/RockYou#Controversy ) The patterns displayed by the codes in the paper are similar to the blog.
  - rm999 14y ago
    Wow, it's worse than I thought. Rockyou doesn't allow 4 character passwords so they were extracting the numbers from WITHIN longer passwords. 'asdf1975' would equate to a 'pin' of 1975, or 37489 would equate to two pins, 3748 and 7489. What a terrible assumption to build all your research on top of.
    - maxerickson 14y ago
      The paper is quite clear about the methodology used, they only extracted exact 4 digit sequences. I repeated that much of the analysis, I wanted to examine the patterns, not just look at the frequency plot. I got the same ~1.7 million sequences using a regex that excluded 5 digit sequences. The blog is less clear.

rm999 14y ago

I wonder about the 2580s (vertical numbers on a PIN pad). It makes perfect sense for PINs, but not a computer keyboard. It could be people keeping their passwords consistent with their PINs e.g. using their ATM PIN for their online bank account password. A lot sites (correctly) prevent people from using very short or simple passwords, including four digit numbers. I'm curious what sites his database comes from.

maxerickson 14y ago
This paper(PDF) uses the RockYou password database to do a similar analysis: http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_security.pdf http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_secu... (RockYou discussed here: http://en.wikipedia.org/wiki/RockYou#Controversy http://en.wikipedia.org/wiki/RockYou#Controversy ) The patterns displayed by the codes in the paper are similar to the blog.
- rm999 14y ago
  Wow, it's worse than I thought. Rockyou doesn't allow 4 character passwords so they were extracting the numbers from WITHIN longer passwords. 'asdf1975' would equate to a 'pin' of 1975, or 37489 would equate to two pins, 3748 and 7489. What a terrible assumption to build all your research on top of.
  - maxerickson 14y ago
    The paper is quite clear about the methodology used, they only extracted exact 4 digit sequences. I repeated that much of the analysis, I wanted to examine the patterns, not just look at the frequency plot. I got the same ~1.7 million sequences using a regex that excluded 5 digit sequences. The blog is less clear.