A German-American team of researchers involving volunteers and compared the security of six-digit and four-digit PIN codes for locking smartphones. In the event of loss or theft of a smartphone, it's better to be certain that your information is protected from hacking. Is this really the case?
Philipp Markert from the Horst Görtz Institute for IT Security at Ruhr University Bochum and Maximilian Golla from the Max Planck Institute for Security and Privacy found that, in practice, psychology outweighs mathematics. Mathematically, the reliability of six-digit PIN codes is significantly higher than that of four-digit ones. However, users tend to prefer certain number combinations, so some PIN codes are used more frequently, nearly erasing the difference in complexity between six- and four-digit codes.
In the study, participants used Apple or Android devices, setting either four- or six-digit PIN codes. Apple devices from iOS 9 onwards feature a blacklist of prohibited numerical combinations for PIN codes that are automatically disallowed. The researchers had both blacklists (for six- and four-digit codes) on hand and also ran combinations on a computer. The blacklist provided by Apple for four-digit PIN codes contained 274 entries, while for six-digit codes, it was 2910.
For Apple devices, users have 10 attempts to enter their PIN code. According to the researchers, in this case, the blacklist is almost meaningless. With 10 attempts, it is hard to guess the correct number, even if it’s a simple one (like 123456). For Android devices, it is possible to make 100 PIN code entries in 11 hours, and in this case, the blacklist serves as a more reliable means of preventing users from entering simple combinations and thus avoiding smartphone hacking through number guessing.
In the experiment, 1,220 participants chose their own PIN codes, while experimenters attempted to guess them in 10, 30, or 100 tries. The guessing was conducted in two ways. When a blacklist was enabled, smartphones were attacked without using numbers from that list. Without an enabled blacklist, the code guessing began with numbers from the blacklist (as those were the most commonly used). The experiment revealed that a well-chosen 4-digit PIN code is sufficiently secure under limited input attempts and is even slightly more reliable than a 6-digit code.
The most common 4-digit PIN codes turned out to be combinations like 1234, 0000, 1111, 5555, and 2580 (which is a vertical column on the numeric keypad). A deeper analysis showed that the ideal blacklist for four-digit PINs should contain around 1,000 entries and differ slightly from the one that was derived for Apple devices.
Finally, researchers found that 4-digit and 6-digit PIN codes are less secure than passwords but more reliable than graphical smartphone locks (based on patterns). The complete will be presented in San Francisco in May 2020 at the IEEE Symposium on Security and Privacy.
Source: 3dnews.ru
