Measuring Human-Chosen PINs: Characteristics, Distribution and Security

Personal Identification Numbers (PINs) are ubiquitously used in computer systems where user input interfaces are constrained, such as ATMs, POS terminals, electronic doors and mobile devices. Yet, so far little attention has been paid to this important kind of authentication credentials, especially for 6-digit PINs which dominate in Asian countries and are gaining popularity worldwide. Unsurprisingly, many fundamental questions (e.g., what’s the distribution that human-chosen PINs follow?) remain as intact as about fifty years ago when they first arose. In this work, we conduct a systematic investigation into the characteristics, distribution and security of both 4-digit PINs and 6-digit PINs by using a corpus of 9.74 million 4-digit and 8.64 million 6-digit secret sequences extracted from real-life passwords of two groups of users (i.e., Chinese users and English users), and perform a comprehensive comparison of the PIN characteristics and security among users with distinctive language and cultural backgrounds. Our results show that there are great differences in PIN choices between these two groups of users, a small number of popular patterns prevail in both groups, and surprisingly, over 50% of every PIN datasets can be accounted for by just the top 5%∼8% most popular PINs. What’s most staggering is the observation that, when online guessing is the primary concern, longer PINs essentially mean less security: human-chosen 4-digit PINs can offer about 5.3 bits of security against online guessing and 8.4 bits of security against offline guessing, and this figure for 6-digit PINs is 5.2 bits and 13.2 bits, respectively. Most interestingly, by conducting linear regressions on the collected corpus, we unveil that Zipf’s law perfectly exists in humanchosen PINs. Despite distant space and distinct language and cultural backgrounds, both groups of users, unbelievably, follow nearly the same distribution function. We also investigate some foundational implications of our observations for PIN creation policies, strength measurements, migration strategies, etc. keywords– Authentication, Personal Identification Number, Zipf’s law, Statistics, Markov-Chain-based Cracking.