Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

love the idea, but logins are not dead, you just piggy backed on device/passcode combination instead of email/password combination.

PS: I have always wondered why PINS from debit card are 4 digits, and some random consumer product will ask you for a crazy complex password with at least 8 characters.



As the story goes, when John Shepherd-Barron[1] was working on the original ATM system, he originally planned 6 digits, but reduced it to 4 because his wife wasn't able to consistently recall a 6 digit random number.

If true (and it sounds at least plausible), then the sheer number of legacy devices that expect a 4 digit PIN (including hardware crypto modules, which cost an absolute fortune to design and verify)

And, of course, a numeric keypad is much smaller and easier to design around than a full qwerty (and probably internationalises better as well)

The Cambridge Uni security group have a nice paper on PIN security in more detail, if you're interested[2].

[1] https://en.wikipedia.org/wiki/John_Shepherd-Barron

[2] http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_secu...


Because if you guess my PIN correctly there's not much you can do with it unless you also have my card.


I think 4 digit pins are so prevalent because they're easy to remember. As they get longer and harder to remember, people are more likely to write them down etc.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: