Understanding Human-Chosen PINs: Characteristics, Distribution and Security

ABSTRACT

Personal Identification Numbers (PINs) are ubiquitously used in embedded computing systems where user input interfaces are constrained. Yet, little attention has been paid to this important kind of authentication credentials, especially for 6-digit PINs which dominate in Asian countries and are gaining popularity worldwide. Unsurprisingly, many fundamental questions (e.g., what's the distribution that human-chosen PINs follow?) remain as intact as about fifty years ago when they first arose. In this work, we conduct a systematic investigation into the characteristics, distribution and security of both 4-digit PINs and 6-digit PINs that are chosen by English users and Chinese users. Particularly, we, for the first time, perform a comprehensive comparison of the PIN characteristics and security between these two distinct user groups. Our results show that there are great differences in PIN choices between these two groups of users, a small number of popular patterns prevail in both groups, and surprisingly, over 50% of every PIN datasets can be accounted for by just the top 5%~8% most popular PINs. What's disturbing is the observation that, as online guessing is a much more serious threat than offline guessing in the current PIN-based systems, longer PINs only attain marginally improved security: human-chosen 4-digit PINs can offer about 6.6 bits of security against online guessing and 8.4 bits of security against offline guessing, and this figure for 6-digit PINs is 7.2 bits and 13.2 bits, respectively. We, for the first time, reveal that Zipf's law is likely to exist in PINs. Despite distinct language/cultural backgrounds, both user groups choose PINs with almost the same Zipf distribution function, and such Zipf PIN-distribution from one source (about which we may know little information) can be well predicted by real-world attackers by running Markov-Chains with PINs from another known source. Our Zipf theory would have foundational implications for analyzing PIN-based protocols and for designing PIN creation policies, while our security measurements provide guidance for bank agencies and financial authorities that are planning to conduct PIN migration from 4-digits to 6-digits.

References

1. China now has 656m mobile web users, and 710m total Internet users, Aug. 2016. http://bit.ly/2avZdlK.
2. M. Abdalla, F. Benhamouda, and P. MacKenzie. Security of the j-pake password-authenticated key exchange protocol. In Proc. IEEE S&P 2015, pages 571--587.
3. R. L. Axtell. Zipf distribution of US firm sizes. Science, 293(5536):1818--1820, 2001.
4. B. Bátiz-Lazo and R. Reid. The development of cash-dispensing tech- nology in UK. IEEE Ann. Hist. Comput., 33(3):32--45, 2011.
5. N. Berry. PIN analysis, Sep. 2012. http://www.datagenetics.com/blog/september32012/index.html.
6. J. Bonneau. The science of guessing: Analyzing an anonymized corpus of 70 million passwords. In IEEE S&P 2012, pages 538--552.
7. J. Bonneau, S. Preibusch, and R. Anderson. A birthday present every eleven wallets? The security of customer-chosen banking PINs. In Proc. FC 2012, pages 25--40.
8. W. Burr, D. Dodson, R. Perlner, W. Polk, S. Gupta, and E. Nabbus. NIST SP800--63--2 -- electronic authentication guideline. Technical report, NIST, Reston, VA, Aug. 2013.
9. A. Clauset, C. R. Shalizi, and M. E. Newman. Power-law distributions in empirical data. SIAM Review, 51(4):661--703, 2009.
10. A. Das, J. Bonneau, M. Caesar, N. Borisov, and X. Wang. The tangled web of password reuse. In Proc. NDSS 2014, pages 1--15.
11. EMVCo Ltd. Issuer PIN Security Guidelines, 2010. http://usa.visa.com/ download/merchants/visa-issuer-pin-security-guideline.pdf.
12. S. Fahl, M. Harbach, Y. Acar, and M. Smith. On the ecological validity of a password study. In Proc. SOUPS 2013, pages 1--15.
13. D. Florêncio, C. Herley, and B. Coskun. Do strong web passwords accomplish anything? Proc. HotSec 2007, pages 1--6.
14. J. H. Huh, S. Oh, H. Kim, K. Beznosov, A. Mohan, and S. R. Rajagopalan. Surpass: System-initiated user-replaceable passwords. In Proc. ACM CCS 2015, pages 170--181.
15. International Organisation for Standardisation. ISO 9564: Financial services -- Personal Identification Number (PIN) management and security, 2011. https://www.iso.org/obp/ui/#iso:std:54083:en.
16. M. Jakobsson and D. Liu. Your password is your new PIN. In Mobile Authentication, pages 25--36. Springer, 2013.
17. J. Katz, R. Ostrovsky, and M. Yung. Efficient and secure authenticated key exchange using weak passwords. J. ACM, 57:1--41, 2009.
18. M. Keith, B. Shao, and P. J. Steinbart. The usability of passphrases for authentication: An empirical field study. Int. J. of human-computer studies, 65(1):17--28, 2007.
19. B. Köpf and D. Basin. Automatically deriving information-theoretic bounds for adaptive side-channel attacks. J. Comput. Secur., 19(1):1--31, 2011.
20. Korean Banks to Possibly Adopt a 6-Digit PIN System, Oct. 2015. www.seoulsync.com/news/korean-banks-adopt-6-digit-pin-system.
21. T. Kwon and J. Hong. Analysis and improvement of a PIN-entry method resilient to shoulder-surfing and recording attacks. IEEE Trans. Inform. Foren. Secur., 10(2):278--292, 2015.
22. Chip and PIN: Final deadline in UAE, Dec. 2014. https://www.souqalmal.com/financial-education/ae-en/chip-and-pin/.
23. L. Lundin. PINs and Passwords, Part 1, Aug. 2013. http://www.sleuthsayers.org/2013/08/pins-and-passwords-part-1.html.
24. J. Ma, W. Yang, M. Luo, and N. Li. A study of probabilistic password models. In Proc. IEEE S&P 2014, pages 689--704.
25. D. Malone and K. Maher. Investigating the distribution of password choices. In Proc. WWW 2012, pages 301--310.
26. R. Martin. Amid Widespread Data Breaches in China, Jan. 2012. https://sg.finance.yahoo.com/news/Amid-Widespread-Data-Breaches-pennolson-706259476.html.
27. M. Mehrnezhad, E. Toreini, S. Siamak, and F. Hao. Touchsignatures: Identification of user touch actions and PINs based on mobile sensor data via javascript. J. Inform. Secur. Appl., 26:23--38, 2016.
28. M. Nicholas. The 10 Biggest Data Breaches of Summer 2016, Sep. 2016. https://blog.dashlane.com/biggest-data-breaches-summer-16/.
29. Reuters. Russia launches China UnionPay credit card, Aug. 2014. http://rt.com/business/180696-china-russia-union-pay/.
30. Y. Song, G. Cho, S. Oh, H. Kim, and J. H. Huh. On the effectiveness of pattern lock strength meters: Measuring the strength of real world pattern locks. In Proc. CHI 2015, pages 2343--2352.
31. L. Stanekovaa and M. Stanek. Analysis of dictionary methods for PIN selection. Comput. Secur., 39:289--298, 2013.
32. G. Steel. Formal analysis of PIN block attacks. Theor. Comput. Sci., 367(1):257--270, 2006.
33. S. Uellenbeck, M. Dürmuth, C. Wolf, and T. Holz. Quantifying the security of graphical passwords: The case of android unlock patterns. In Proc. ACM CCS 2013, pages 161--172.
34. B. Ur, J. Bees, S. Segreti, and et al. Do users' perceptions of password security match reality? In Proc. CHI 2016, pages 161--170.
35. R. Veras, J. Thorpe, and C. Collins. Visualizing semantics in passwords: The role of dates. In Proc. ACM VizSec 2012, pages 88--95.
36. D. Wang, G. Jian, X. Huang, and P. Wang. Zipf's law in passwords. IEEE Trans. Inform. Foren. Secur., 2016. In press, http://t.cn/RqT51U8.
37. D. Wang and P. Wang. The emperor's new password creation policies. In Proc. ESORICS 2015, pages 456--477.
38. D. Wang, Z. Zhang, P. Wang, J. Yan, and X. Huang. Targeted online password guessing: An underestimated threat. In Proc. ACM CCS 2016, pages 1242--1254.
39. M. Weir, S. Aggarwal, and B. Medeiros. Password cracking using probabilistic context-free grammars. In IEEE S&P 2009, pages 391--405.
40. J. Yan, A. Blackwell, R. Anderson, and A. Grant. Password memorability and security: Empirical results. IEEE Secur. Priv., 2(5):25--31, 2004.

Index Terms

• Computing methodologies

  • Artificial intelligence

    • Natural language processing

      • Natural language generation

• Security and privacy

  • Human and societal aspects of security and privacy

    • Social aspects of security and privacy

  • Security services

    • Authentication