5 ms·
Neat idea. The debit card pin bit does not seem feasible though, at least in a brute force setting - finding out a 6 digit pin, showing each number for 1 second
by donquichotte 13y ago
Neat idea. The debit card pin bit does not seem feasible though, at least in a brute force setting - finding out a 6 digit pin, showing each number for 1 second, takes > 11 days in the worst case.
- ars 13y agoDon't most people have a 4 digit pin? But in any case showing pins that way wouldn't work anyway - most people have a muscle memory for their pins, but would not recognize them when written down.
- nobodyshere 13y agoYou also forgot to mention multiple cards and pins people have / used to have. I'd expect a false trigger in the system in that case.
- PeterisP 13y agoYou get a bunch of positives and check/bruteforce afterwards. This system couldn't distinguish my creditcard PIN from my office alarm PIN code, but it can give a shortlist to try.
- anigbrowl 13y agoThat seems a highly questionable assumption to me.
- c-oreills 13y agoI recently got a new card and remembered the PIN spatially. After a few times of typing it in I realised that, though I was typing the digits of the new PIN, I was subvocalising the digits of my old PIN. It was a really odd sensation. Having said that, I would recognise both PINs as both a string of digits and as a spatial sequence... so that would probably just be another attack vector.
- Deestan 13y ago> I realised that, though I was typing the digits of the new PIN, I was subvocalising the digits of my old PIN. I trained myself to do this on purpose; subvocalising a different number. If I'm drugged out in a hospital bed and someone asks for my CC PIN, I want them to get an incorrect number.
- aa0 13y agoWell that took a turn... Do you also by chance drink poison every day to build immunity for when that vicious lad taps your drink?
- Deestan 13y agoYes - If he tries to poison me with caffeine, I'm pretty safe. I'm not genuinely worried about being robbed of my PIN, though. I just found the mental challenge interesting.
- mcherm 13y agoWow. I used to think that I was rigorous about security...
- prof_hobart 13y agoCouldn't you just do one digit at a time (is your first digit 1?, etc)? It would take less than a minute at 1 second per digit that way.
- PeterisP 13y agoNo, since all isolated digits would have similar responses. The attack vector is not "is x your PIN?" but it's "is pattern xyzw meaningful to your brain whatsoever?"
- prof_hobart 13y agoMy reading of the article is that if you show someone something that is significant to them, such as "Is the first digit of your PIN the number 1?", then it'll trigger a measurable response, and the first graph in the article is "1st digit PIN" So I'm not sure where you're reading that it wouldn't work using the single digit approach.