8
$\begingroup$

Say that there are different live situations where you have to select own PIN numbers.

Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources?

Is this too hard with today's technologies or possible? What about quantum computing?

And if you know, could you tell me the entropy for this case?

$\endgroup$
  • 6
    $\begingroup$ Is there a phyiscal device involved for entering that PIN? This makes a huge difference insofar as mathematical considerations are kinda bollocks if you can detect fingerprints and measure the thickness of the oil coat, which makes the attack a few million times easier. $\endgroup$ – Damon Jan 16 at 18:56
  • $\begingroup$ Interesting note: the original Banking standards allowed for up to twelve (12) digit PINs for magstripe cards, but there wasn't enough room left on most card magstripes for more than four (4) to six (6) digits of PIN "offsets". $\endgroup$ – outer Jan 16 at 21:31
  • 2
    $\begingroup$ Fun fact: it's always possible. No math formula can ever prevent someone to give a random try and accidently pick the good one. You should get used to say "how many chances" instead. Even if it's low as a chance of 0.00000003, it's possible.. $\endgroup$ – Kaddath Jan 17 at 15:48
  • 1
    $\begingroup$ Borrowing a comment I've said elsewhere: TV shows present quantum computers as a little device you can press on an LCD and unlock any device. That's not computing. That's magic lock-picking. --- Also know that there is a difference between "online" password attacks and "offline". In online attacks, a hacker asks the server if a password/pin is correct. Attackers are subject to rate limiting and lockouts. (Assuming there's no way to bypass those.) In offline attacks someone has all the (leaked) data necessary to guess and check passwords on their own hardware. Offline guesses cannot be limited. $\endgroup$ – Future Security Jan 17 at 18:05
23
$\begingroup$

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \approx 26.57$ bits.

The chances of guessing the PIN correctly in 3 tries is $$1 - \frac{x-1}{x} \cdot \frac{x - 2}{x-1} \cdot \frac{x-3}{x-2} = 1 - \frac{x-3}{x} = \frac{x}{x} - \frac{x-3}{x} = \frac{x}{x} + \frac{-x+3}{x} = \frac{3}{x}$$ where $x$ is $10^8$, so $3\times 10^{-8}$ or just $0.00000003$. This is basic math (which I managed to get wrong quite a few times, thanks to Max O. for correcting me the last time around).

Once you have a limited number of tries, the different technologies make no difference anymore. Quantum computing will allow faster computations, but since you only get 3 tries, speedup is not of any interest.

If a user creates a PIN then PIN numbers such as 00000000 are very likely, and your chances depend very much on the person choosing the PIN. Some banks will therefore disallow the exceptionally stupid ones, leaving just the normally stupid ones. Even smart persons have been shown to be terribly bad at generating random numbers. How bad they are is hard to know, it very much depends on the target audience, I presume.

$\endgroup$
  • 5
    $\begingroup$ step 1: ban 00000000. step 2: bruteforce will start at 00000001. step 3: ban 00000001. step 4: repeat the last two steps and increment each time. step 5: ??? step 6: profit $\endgroup$ – Kepotx Jan 16 at 13:40
  • 1
    $\begingroup$ Has anyone researched how many pins are birthdays of the cardholder or their spouse? Apparently Schneir studied this for 4-digit PINs and found they're popular. $\endgroup$ – Barmar Jan 16 at 16:52
  • $\begingroup$ @Barmar for the small handful of cases where you actually have a say in this PIN - in the aforementioned cases of bank-card PIN you don't usually get a choice (other than accept / deny) ... $\endgroup$ – eagle275 Jan 17 at 9:30
  • 1
    $\begingroup$ European has then to mean excluding Germany where I live ... I can select the login to the online-banking system, but NOT the PIN for my cards. On the other hand most cards I have seen still use 4 digit PINs ... which allow for easy bridges into memory $\endgroup$ – eagle275 Jan 17 at 12:09
  • 1
    $\begingroup$ It depends on the banks. All the French banks I know of do not leave the choice of a PIN number (Visa or Mastercard). However I know of a French "payment proxy", not officially a bank, that issue prepaid Mastercard cards (you can refill them as much as you want) and leaves the use the choice of the PIN code and lets its users change it whenever they want. $\endgroup$ – A. Hersean Jan 17 at 16:08
7
$\begingroup$

The chance to guess right is just

$$\frac{3}{10^x}$$ where in your case, $x$ is $8$. You could write it as $$1-\frac {99999999}{100000000}\cdot\frac {99999998}{99999999}\cdot\frac {99999997}{99999998}=1-\frac {99999997}{100000000}=\frac 3{100000000}$$

To simplify it, just imagine a one digit PIN. You have ten possibilities, from 0 to 9. With three tries, you will get 3 out of 10 right. If you have a two digit PIN, you have a hundred possible combinations (00 to 99), so you will get 3 out of 100 right. When you have 8 digits you have one hundred million combinations, so there is a chance of three to one hundred million, that you will make a correct guess.

$\endgroup$
3
$\begingroup$

Like Ray, I'd like to point out that if the PINs are not chosen randomly but selected by humans and there is no rejection of the easiest pins, the same rules as for passwords apply: some are very, very, very common.

This analysis of 4-digit pins shows that 3 tries will allow you to break over 18% of 4-digit pins, not the 0.03% you would expect from the maths:

    PIN     Freq
#1  1234    10.713%
#2  1111    6.016%
#3  0000    1.881%
#4  1212    1.197%
#5  7777    0.745%
#6  1004    0.616%
#7  2000    0.613%
#8  4444    0.526%
#9  2222    0.516%
#10 6969    0.512%
#11 9999    0.451%
#12 3333    0.419%
#13 5555    0.395%
#14 6666    0.391%
#15 1122    0.366%
#16 1313    0.304%
#17 8888    0.303%
#18 4321    0.293%
#19 2001    0.290%
#20 1010    0.285%

I strongly suspect that even if you expand to 8 digits, you'll still have 12345678, 11111111 and 00000000 representing way more than 10% of the PINs in actual use, a lot more than the 0.000003% the maths tell you.

So if you want to select a pin as postulated by the question, start by avoiding the usual suspects (repetitions, sequences, alternating digits).

Also avoid anything that looks like a birthdate (in any of its permutations). The space for this is pretty large (probably over 100K combinations), but if the attacker knows you (rather than just a random attack), then this reduces to a dozen or so useful combinations.

The next one (in no particular order) is to avoid use any digit multiple times in the same PIN (even if not consecutive), or at least reduce the number of repetitions as much as possible. This way, even if there's any dedicated physical input system for that PIN, you'll have wear/traces on 8 different digits (out of 10), which reduces the chances anyone will be able to trace back the PIN from that.

Next, avoid any patterns (like the 2580 in the analysis linked to above), as not only they will be in the "usual suspects" list, but they are easier for someone to catch when you enter the PIN.

Of course, all of this will make memorising the pin more difficult (especially if it changes often!), so as always, it's a trade-off between security and ease. It all depends on what the pin protects: don't burden the user with impossible-to-remember pins that change every week, or the only thing that will happen is that they will write it down right away!

$\endgroup$
  • $\begingroup$ Good thing my self-chosen PIN isn't in the Top 20!!! $\endgroup$ – RonJohn Jan 18 at 3:55
0
$\begingroup$

Maarten and Max correctly analyze the probabilities for cases in which the PIN is selected uniformly from all 8 digit numbers. But if the user is permitted to choose their own PIN, the distribution will be biased towards those numbers that are easily memorable. (Naturally, the exact distribution will differ from person to person and thus can't be calculated here.) You can improve your chances of guessing correctly within three tries by guessing the more probable PINS first.

In particular, it should be noted that a birthday in YYYYMMDD, MMDDYYYY, or DDMMYYYY format is exactly 8 digits.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.