Abstract:Personal Identification Numbers (PINs) are ubiquitously used in embedded computing systems where user input interfaces are constrained. Yet, little attention has been paid to this important kind of authentication credentials, especially for 6-digit PINs which dominate in Asian countries and are gaining popularity worldwide. Unsurprisingly, many fundamental questions (e.g., what's the distribution that human-chosen PINs follow?) remain as intact as about fifty years ago when they first arose. In this work, we conduct a systematic investigation into the characteristics, distribution and security of both 4-digit PINs and 6-digit PINs that are chosen by English users and Chinese users. Particularly, we, for the first time, perform a comprehensive comparison of the PIN characteristics and security between these two distinct user groups. Our results show that there are great differences in PIN choices between these two groups of users, a small number of popular patterns prevail in both groups, and surprisingly, over 50% of every PIN datasets can be accounted for by just the top 5%~8% most popular PINs. What's disturbing is the observation that, as online guessing is a much more serious threat than offline guessing in the current PIN-based systems, longer PINs only attain marginally improved security: human-chosen 4-digit PINs can offer about 6.6 bits of security against online guessing and 8.4 bits of security against offline guessing, and this figure for 6-digit PINs is 7.2 bits and 13.2 bits, respectively. We, for the first time, reveal that Zipf's law is likely to exist in PINs. Despite distinct language/cultural backgrounds, both user groups choose PINs with almost the same Zipf distribution function, and such Zipf PIN-distribution from one source (about which we may know little information) can be well predicted by real-world attackers by running Markov-Chains with PINs from another known source. Our Zipf theory would have foundational implications for analyzing PIN-based protocols and for designing PIN creation policies, while our security measurements provide guidance for bank agencies and financial authorities that are planning to conduct PIN migration from 4-digits to 6-digits.

IFTT-PIN: A PIN-Entry Method Leveraging the Self-Calibration Paradigm

IFTT-PIN: A Self-Calibrating PIN-Entry Method

Interactive introduction to self-calibrating interfaces

IllusionPIN: Shoulder-Surfing Resistant Authentication Using Hybrid Images

Logging safely in public spaces using color PINs

PressPIN: Enabling Secure PIN Authentication on Mobile Devices Via Structure-Borne Sounds

Widely Reused and Shared, Infrequently Updated, and Sometimes Inherited: A Holistic View of PIN Authentication in Digital Lives and Beyond

P2Auth: Two-Factor Authentication Leveraging PIN and Keystroke-Induced PPG Measurements

Your PIN Sounds Good! On The Feasibility of PIN Inference Through Audio Leakage

Hand Me Your PIN! Inferring ATM PINs of Users Typing with a Covered Hand

ArmSpy++: Enhanced PIN Inference Through Video-based Fine-grained Arm Posture Analysis

ArmSpy: Video-assisted PIN Inference Leveraging Keystroke-induced Arm Posture Changes

Heart of Betrayal: A PIN Inference Attack Leveraging Photoplethysmography on Wearables

Understanding Human-Chosen PINs

Pin: building customized program analysis tools with dynamic instrumentation

Stealing PINs via Mobile Sensors: Actual Risk versus User Perception

Comparison of PIN- and Pattern-Based Behavioral Biometric Authentication on Mobile Devices

BEEMA: Braille Adapted Enhanced PIN Entry Mechanism using Arrow keys

Behavioral Acoustic Emanations: Attack and Verification of PIN Entry Using Keypress Sounds

The Factors Affect User Behaviour in a Picture-Based User Authentication System: PixelPin

Side-channel attacks against the human brain: the PIN code case study (extended version)