Table 6 - uploaded by Ding Wang
Content may be subject to copyright.
Top ten 6-digit PINs in each PIN dataset 

Top ten 6-digit PINs in each PIN dataset 

Source publication
Conference Paper
Full-text available
Personal Identification Numbers (PINs) are ubiquitously used in embedded computing systems where user input interfaces are constrained. Yet, little attention has been paid to this important kind of authentication credentials, especially for 6-digit PINs which dominate in Asian countries and are gaining popularity worldwide. Unsurprisingly, many fun...

Contexts in source publication

Context 1
... the following, besides suggesting compelling answers to these two questions, we also make the first attempt to identify the dominant factors that influence user behaviors of 6-digit PIN choices. Table 6 shows the top-10 most popular PINs in each 6-digit PIN dataset. As expected, 123456 tops the list, followed by 111111 and 123123. ...
Context 2
... confirm that this is largely true as we will demonstrate in the following explorations. Table 4. Every PIN in Table 6 (except for these in bold) conforms to one of three basic patterns: digit repetition, sequential up/down and palindrome. As for these ten bolded PINs, six PINs (i.e., 147258, 123654, 321654, 789456 and 159753) obviously comply with a numpad pattern (e.g., 159753 is a "×" mark over the numeric keypad), two PINs (i.e., 520520, 520131) intrigu- ingly sound like "I love you · · · " in Chinese and two PINs from Yahoo dataset (i.e., 030379, 101471) seem to be of no obvious meaning or simple patterns. ...

Citations

... PINs are the most common form of smartphone unlock authentication; prior studies suggest that about 60% of users unlock their smartphone using a PIN [32]. As with other popular mobile authentication options, including Android unlock patterns [7,35], LG Knock Codes [39], and passwords [34,40], user-selected PINs for smartphone unlocking are chosen nonuniformly [14,32,51], leading to many common, insecure, and easily guessable PINs [32,33,51]. ...
... PINs are the most common form of smartphone unlock authentication; prior studies suggest that about 60% of users unlock their smartphone using a PIN [32]. As with other popular mobile authentication options, including Android unlock patterns [7,35], LG Knock Codes [39], and passwords [34,40], user-selected PINs for smartphone unlocking are chosen nonuniformly [14,32,51], leading to many common, insecure, and easily guessable PINs [32,33,51]. ...
... Prior work has compared the distribution of human-chosen 4-digit PINs to the distribution of human-chosen 6-digit PINs [32,33,51]. However, the impact of the upgrade process itself, in which a given user transitions from a 4-digit to a 6-digit PIN, has not been studied. ...
Conference Paper
Full-text available
With the goal of improving security, companies like Apple have moved from requiring 4-digit PINs to 6-digit PINs in contexts like smartphone unlocking. Users with a 4-digit PIN thus must "upgrade" to a 6-digit PIN for the same device or account. In an online user study (n = 1010), we explore the security of such upgrades. Participants used their own smart-phone to first select a 4-digit PIN. They were then directed to select a 6-digit PIN with one of five randomly assigned justifications. In an online attack that guesses a small number of common PINs (10-30), we observe that 6-digit PINs are, at best, marginally more secure than 4-digit PINs. To understand the relationship between 4-and 6-digit PINs, we then model targeted attacks for PIN upgrades. We find that attackers who know a user's previous 4-digit PIN perform significantly better than those who do not at guessing their 6-digit PIN in only a few guesses using basic heuristics (e.g., appending digits to the 4-digit PIN). Participants who selected a 6-digit PIN when given a "device upgrade" justification selected 6-digit PINs that were the easiest to guess in a targeted attack, with the attacker successfully guessing over 25% of the PINs in just 10 attempts, and more than 30% in 30 attempts. Our results indicate that forcing users to upgrade to 6-digit PINs offers limited security improvements despite adding usability burdens. System designers should thus carefully consider this tradeoff before requiring upgrades.
... PINs and passwords are much smaller than the entropy of biometric features. For example, it is shown that entropy of human chosen 4-digit PINs is 8.41 bits and 6-digit PINs 13.21 bits [33]; human chosen passwords is 20-22 bits [34]. Therefore, biometrics-based authentication is considered more secure than other authentication factors. ...
Article
Full-text available
In this work, we present polar code designs that offer a provably optimal solution for biometric identification and authentication systems under noisy enrollment for certain sources and observation channels. We consider a discrete memoryless biometric source and discrete symmetric memoryless observation channels. It is shown that the proposed polar code designs achieve the fundamental limits with privacy and secrecy constraints. Depending on how the secret keys are extracted and whether the privacy leakage rate should be close to zero, we consider four related setups, which are (i) the generated secret key system, (ii) the chosen secret key system, (iii) the generated secret key system with zero leakage, and (iv) the chosen secret key system with zero leakage. For the first two setups, (i) and (ii), the privacy level is characterized by the privacy leakage rate. For the last two setups (iii) and (iv), private keys are additionally employed to achieve close to zero privacy leakage rate. In setups (i) and (iii), it is assumed that the secret keys are generated, i.e., extracted from biometric information. While in setups (ii) and (iv), secret keys provided to the system are chosen uniformly at random from some trustful source. This work provides the first examples of fundamental limits-achieving code designs for identification and authentication. Moreover, since the code designs are based on polar codes and many existing works study low-complexity and short block-length polar coding, the proposed code designs in this work provide the code design structure and a framework for the application of biometric identification and authentication.
... Our study focuses on the PINs users choose to unlock their mobile devices. Previous work on PINs was primarily focused on the context of banking, e.g., as part of the Chip-and-PIN system [13], and also mainly relied on the analysis of digit sequences found in leaked text-based password datasets, since these data are more readily available [59]. Given the sparsity of information about PINs in the context of mobile authentication, we sought to fill this vital knowledge gap by conducting the first study (n = 1705) on the topic where participants either selected a four-or six-digit PIN, the two predominant PIN lengths used for device unlock. ...
... That is because the biometric does not replace knowledge-based authentication; access to a device is still possible with a PIN even when using a biometric. Moreover, the presence of a biometric may actually lead to a false sense of security when selecting knowledge-based Wang et al. [59] have also analyzed the security of PINs-in this case without any specific usage context. They report on comparing four-and six-digit PINs created by English and Chinese users. ...
... While collected in an uncontrolled experiment, we apply the dataset (Amitay-4-digit) when guessing four-digit PINs, as well as to inform the selection of our "datadriven" blocklists. As there is no similar six-digit PIN data available to inform the attacker, we rely on six-digit PINs extracted from password leaks, similarly to Bonneau et al. 's [13] and Wang et al. 's [59] method. PINs are extracted from consecutive sequences of exactly n-digits in leaked password data. ...
... Signal's PIN in fact takes this advice and blocks digits in sequence. Wang et al. [49] derived numeric sequences from leaked password datasets, and Bonneau et al. [5] measured their guessability. Wang et al. found that PINs generally are easily guessable in online attacks (where an attacker only has a limited number of attempts or is rate-limited), and surprisingly 6-digit PINs more so than 4-digit PINs. ...
... Android unlock patterns, first introduced in 2008 as a modification of the Pass-Go scheme [26], are one of the most widely used knowledge-based authentication mechanisms on smartphones today. Despite being less secure than PINs [1,4,10,19,28,31] or passwords [9,22], 27 % of participants in our study use patterns to secure their smartphones, which matches inquiries from prior work [4,14,17,19]. Some of the security limitations of patterns were first demonstrated by Uellenbeck et al. [28]. ...
... 此外, 用户选择的口令遵 循 Zipf 定律 [44] , 这就解释了为什么口令具有低猜测熵, 即大约 10 位的在线猜测安全性和大约 20∼22 位的离线猜测安全性 (参见文献 [45]). 此外, Wang 等 [46] 报告称, 人类选择的 4 字节口令 (一种特殊 的口令) 可以分别提供 6.6 比特位的在线猜测安全性和 8.4 比特位的离线猜测安全性. 有关口令的详 细解释参考文献 [40]. ...
Article
Full-text available
Password-based authentication is the dominant form of access control and is likely to keep its status in the foreseeable future. Password authenticated key exchange (PAKE) protocols enable two parties to exchange a session key during password-based authentication over an insecure channel. To resist password compromise at the server-side, passwords are recommended to be stored in a salted hash form. However, conventional password hashing functions (e.g., PBKDF2, bcrypt, and scrypt) only support PAKE protocols based on specific number-theoretic assumptions, which can only be proved secure in the random oracle model, and the communication rounds are generally high. Furthermore, they demand a large memory size, i.e., the output is of length 32 bytes. To address these issues, several password hashing schemes based on discrete-logarithm assumptions, e.g., Benhamouda and Pointceva (IACR ePrint2013/833), Kiefer and Manulis (ESORICS'14), and Pointcheval and Wang (ASIACCS'17), have been proposed to be integrated with a smooth projective hash function (SPHF), but they are not secure in the coming quantum era and only can be proved security in the random oracle model. In this work, we focus on the question of how to design an efficient password hashing scheme that can be integrated into quantum-resistant SPHF-based PAKE while being secure in the standard model (but not the random oracle model). Following the research line of Kiefer and Manulis (ESORICS'14), we design three new types of lattice-based password hashing schemes based on homomorphic commitment schemes with provable security in the standard model. We show that they can be efficiently integrated with SPHFs to obtain low-interactive PAKE protocols. Although the proposed scheme is not ready to be deployed in practice, it is an important step for the quantum-resistant password-based authentication and authenticated key exchange.
... Signal's PIN in fact takes this advice and blocks digits in sequence. Wang et al. [49] derived numeric sequences from leaked password datasets, and Bonneau et al. [5] measured their guessability. Wang et al. found that PINs generally are easily guessable in online attacks (where an attacker only has a limited number of attempts or is rate-limited), and surprisingly 6-digit PINs more so than 4-digit PINs. ...
Preprint
Full-text available
We conducted an online study with $n = 235$ Signal users on their understanding and usage of PINs in Signal. In our study, we observe a split in PIN management and composition strategies between users who can explain the purpose of the Signal PINs (56%; enthusiasts) and users who cannot (44%; casual users). Encouraging adoption of PINs by Signal appears quite successful: only 14% opted-out of setting a PIN entirely. Among those who did set a PIN, most enthusiasts had long, complex alphanumeric PINs generated by and saved in a password manager. Meanwhile more casual Signal users mostly relied on short numeric-only PINs. Our results suggest that better communication about the purpose of the Signal PIN could help more casual users understand the features PINs enable (such as that it is not simply a personal identification number). This communication could encourage a stronger security posture.
... In future, we would like to extend the proposed technique for touch-less 3D fingerprint and sensor interoperability; so that it can work with different types of sensors during verification. We will analyze the proposed technique in terms of entropy [75][76][77][78][79] and will compare with other authentication modules [72,80,81]. It will be interesting to combine the other biometric traits in the human body with the proposed technique to develop a multi-modal biometric system. ...
Preprint
Full-text available
Authentication and privacy play an important role in the present electronic world. Biometrics and especially fingerprint-based authentication are extremely useful for unlocking doors, mobile phones, etc. Fingerprint biometrics usually store the attributes of the minutia point of a fingerprint directly in the database as a user template. Existing research works have shown that from such insecure user templates, original fingerprints can be constructed. If the database gets compromised, the attacker may construct the fingerprint of a user, which is a serious security and privacy issue. Security of original fingerprints is therefore extremely important. Ali et al. have designed a system for secure fingerprint biometrics; however, their technique has various limitations and is not optimized. In this paper, first we have proposed a secure technique which is highly robust, optimized, and fast. Secondly, unlike most of the fingerprint biometrics apart from the minutiae point location and orientation, we have used the quality of minutiae points as well to construct an optimized template. Third, the template constructed is in 3D shell shape. We have rigorously evaluated the technique on nine different fingerprint databases. The obtained results from the experiments are highly promising and show the effectiveness of the technique.
... In studying PIN management, we broadly categorize PINs into three categories of protected assets: digital (e.g., to unlock digital devices or authenticate to mobile and web apps), financial (e.g., ATM cards or banking apps), and physical (e.g., digital keypad based entry systems for garages or homes). Researchers have explored PIN-based authentication for financial assets, notably Bonneau et al. studied chip-and-PIN systems [8], as well as Wang et al. studied the guessability of PINs as derived from leaked password datasets [47]. ...
... They found that an attacker who comes into the possession of a lost wallet with a bank card and owner's ID in it has about an 8% chance of guessing the correct PIN due to the widespread use of birthdays for PINs. Wang et al. [47] compared characteristics (guessability, entropy, and distribution) of chosen 4-/6-digit PINs between English and Chinese users. Among other findings, they showed that the top 5-8% most popular PINs account for over 50% of PIN datasets. ...
... It is worth noting that in practice this attack will perform much better, because humans pick a very limited set of PIN-codes and passwords[4,22]. ...
Preprint
Full-text available
Voice assistants are now ubiquitous and listen in on our everyday lives. Ever since they became commercially available, privacy advocates worried that the data they collect can be abused: might private conversations be extracted by third parties? In this paper we show that privacy threats go beyond spoken conversations and include sensitive data typed on nearby smartphones. Using two different smartphones and a tablet we demonstrate that the attacker can extract PIN codes and text messages from recordings collected by a voice assistant located up to half a meter away. This shows that remote keyboard-inference attacks are not limited to physical keyboards but extend to virtual keyboards too. As our homes become full of always-on microphones, we need to work through the implications.