PIN selection policies: Are they really effective?

Abstract

Users have conflicting sets of requirements when it comes to choosing Personal Identification Numbers (PINs) for mobile phones or other systems that use PINs for authentication: the conflict lies between the ‘easy to remember’ usability requirement and the ‘hard to guess’ security requirement. Users often ignore the security requirement and choose PINs that are easy to remember and reuse, making it also easy for attackers to guess and compromise them. Just as the password strength is controlled through various password policies, PIN selection policies may be used to help users choose stronger PINs and meet various security requirements. An example policy would not allow the use of the most commonly selected PINs.

An online user study was conducted to investigate the effectiveness of such PIN selection policies, requesting the participants to choose PINs under some carefully designed policies. The participants were also asked to record the memorability (remembrance difficulty) score of each PIN, indicating how easy/hard it was to remember the selected PIN. Based on the entropies calculated on the collected PINs and their memorability scores, this paper demonstrates that restricting some number of commonly used PINs (e.g. restricting the 200 most commonly used ones) is beneficial: this type of policy would significantly increase the randomness of PINs without incurring significant memorability overhead. Our results also showed that any PIN- or PIN-pattern-based blacklisting policy should be constructed with caution since the total PIN space may become too small, making it easier for attackers to guess PINs.

Introduction

Mobile phones used to be simple. One could simply make phone calls and send/receive text messages. With the emergence of smart phones, however, more and more people have also started using them as a digital-wallet, storing sensitive information like credit cards, identity cards, loyalty/gift cards, vouchers, and mobile banking tokens (Anderson, 2011). Just as one would try to safeguard a wallet full of cash and credit cards from strangers, a digital-wallet user also wants to protect its contents through strong user authentication mechanisms. Among many authentication mechanisms available, Personal Identification Numbers (PINs) are dominantly used. A PIN is a numeric password that the user must type into the mobile phone to authenticate its use.

Unlike biometric and smart card authentication, PINs are easy to implement and do not require extra hardware support. This is what attracts most of the mobile phone companies to use PINs as their primary authentication mechanism. However, PINs too have their own inherent limitations – namely, memorability and security. Problems arise because of the following two conflicting requirements:

• usability – PINs should be easy to remember;

• security – PINs should be secure, meaning they should be randomly distributed and difficult to guess; a user should change their PINs frequently, and use different PINs on different accounts.

In practice, it is difficult to satisfy all of these requirements. A PIN that is difficult to guess is also likely to be hard to remember. As one would imagine, many users choose PINs that are easy to remember without really paying close attention to the security implications. Trivial PINs like ‘1234’ and ‘0000’, users’ birthdays or telephone numbers are often used. A recent study shows that among 204,508 recorded PINs, 15% of them were part of the top 10 most commonly used PINs (Amitay, Jun 2011). Similar trends are evident for passwords, which are a more general form of PINs (Vance, Jun 2010). Such a trend implies that the actual space of PINs used is much smaller than the theoretical space (10^{length of the PIN}), dramatically increasing the likelihood of an attacker compromising a PIN through brute-force type of attacks. One motivation of our work is to investigate the extent that this PIN space can be affected by helping the users choose stronger PINs.

Based on a large dataset of real PINs collected from an iPhone application (Amitay, Jun 2011), Fig. A.1 shows how frequent each button on the keypad was used. This clearly demonstrates a poor PIN selection practice: buttons ‘1’, ‘2’ and ‘0’ were used much more often than ‘8’, ‘6’ and ‘7’. Such statistical information can be misused by attackers to make effective guesses for the PINs. To prevent users from using bad PIN selection practices and choosing weak PINs (that are easy to guess), devices/applications may enforce various PIN selection policies. These policies capture security requirements that must be satisfied upon selecting a PIN; an example policy might be that ‘a PIN shall not have any duplicating number’. Such policies, in theory, should help users choose stronger PINs; but how do we know that they really work well in practice? Precisely predicting how the security and usability requirements stated above will be affected by different policies can be difficult. For instance, if a policy restricts the use of 10 most popular PINs, the next top 10 PINs will soon replace them, becoming the new 10 most popular PINs. Usability would definitely be affected by this policy, but have we really improved PIN security?

To answer these questions, an online survey was conducted, asking the 332 participants to select PINs while conforming with carefully designed PIN selection policies. To maximize consistency in the participants’ attitude and perception towards choosing PINs, the scope of the study was set to focus on locking mobile phones – this information was made clear to the participants prior to starting the survey. By narrowing down the scope, we wanted the participants to have similar perception on the level of complexity required/necessary for their PINs. For instance, a participant’s perception may be different when it comes to choosing PINs for banking purposes. Based on the survey results, the effectiveness of each policy was analysed and suggestions were made on how the policies should be designed. This paper contributes in the following areas: (1) an analysis of the characteristics of the PINs used on mobile phones, and (2) security and usability evaluation of the proposed PIN selection policies.

The following section explains the need for PIN selection policies and explores related work, mainly in the areas of password security and policies. Section 3 analyses the distribution of a sample PIN dataset for mobile phones that have been generated free from any PIN selection policies. This puts us in a position to describe the methodology of our own study in Section 4, and evaluate the effectiveness of different PIN selection policies in Section 5. Our conclusions and future work are in Section 6.