This PIN Can Be Easily Guessed
Analyzing the Security of Smartphone Unlock PINs
Philipp Markert, Daniel V. Bailey, Maximilian Golla, Markus Dürmuth, and Adam J. Aviv

May 18, 2020 | 41st IEEE Symposium on Security and Privacy

Overview?!
Why study PINs?

1/14

AgendaPriming

Practice

Creation

User Study

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

Results

Why PINs?

Fingerprint

PHOTO: Dan Seifert | The Verge (Vox Media)

Face
2/14

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

IrisWho uses PINs?

1220 participants
461 do not use a biometric

210 use a PIN

759 use a biometric

595 use a PIN

Overall 805 (66%) use a PIN
3/14

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

What we know about PINs

What we don’t know●

User chosen 4-digit PINs arepredictable [1]●How secure are 4- or 6-digit PINs inthe smartphone unlock setting?

●User chosen 6-digit PINs aren’t anybetter [2]●What are the effects of different
blacklists on the security of PINs?

●Blacklisting popular PINs canincrease security [1]●How to balance security and usability
when composing a blacklist?

[1] J. Bonneau, S. Preibusch, and R. Anderson. A Birthday Present Every Eleven Wallets? The Security of Customer-Chosen Banking PINs. FC ‘12[2] D. Wang, Q. Gu, X. Huang, and P. Wang. Understanding Human-Chosen PINs: Characteristics, Distribution and Security. AsiaCCS ‘174/14

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

Treatments
4-digit

6-digitNo Blacklist

1. ControlBlacklist

2. Placebo

3. iOS

4. DD SmallNo Blacklist

5. DD Large

6. ControlBlacklist

7. Placebo

8. iOS

Placebo“Test general effect of warning”

iOS“Test effect of iOS blacklists”

Data-Driven (DD)“Test effect of different blacklist sizes”

Blacklist:● “1st choice” blocked● Any other PIN allowed

Blacklist:● 274 PINs (4-digit)● 2910 PINs (6-digit)

Blacklist:● Top 27 PINs of Amitay (small)● Top 2740 PINs of Amitay (large)

5/14

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINsExtracting the iOS Blacklists

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

User StudyPriming

ConsentPractice

8/14

PIN Creation

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

User Study

Priming

ConsentPractice

8/14

Followup
Questionnaires

PIN Creation

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

Demographics

RecallAttacker Model●

9/14

No information about the victim

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

Attacker Model●No information about the victim
Rank

12
39/14

●

Guesses PINs in decreasing probability orderThis PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

4-digit PINs 6-digit PINs

11234

12345620000

12312332580

111111⁝⁝⁝

Attacker Model

1
2
3

●

No information about the victim●

Guesses PINs in decreasing probability order●

Slowed down by rate-limiting
Android

9/14

10 Guesses

30s

100 Guesses

10h 45min 30s

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINsiOS
1h 36m 0s—Attacker Model123●No information about the victim●Guesses PINs in decreasing probability orderRank

●1x3
9/14

●

Slowed down by rate-limiting

14-digit PINs 6-digit PINs
12345621234
lowedlaton0000

32580

111111⁝⁝⁝

Knows the blacklist and skips impossible choices

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

123123

Research Questions
4 vs. 6

RQ1: How secure are 4- and 6-digit PINs in the smartphone unlock setting?

Small?
Medium?
Large?

RQ2: What are the effects of different blacklists on the security of PINs?

RQ3: How to balance security and usability when composing a blacklist?

10/14This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

RQ1: 4- vs. 6-digit PINs

Observations:

11/14

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs●

Overall comparable securityof 4- and 6-digit PINs in thedefined attacker model●

Differences depending on thenumber of guesses

RQ2: Different Blacklist Sizes

Observations:●iOS and Data-Driven Small offer
comparable security●

Data-Driven Large drasticallyincreases the security●

Blacklist Hitrate:
DD Small 5%
iOS 15%
DD Large 70%

12/14This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

RQ3: Balancing Security and Usability
Observations:“Usable”

13/14“Secure”

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs●

Different extrema throughout
the curve●

Maxima:users choose popular PINs●

Minima:users choose unpopular PINs●

Blacklisting ~10% is ideal

Takeaways
AgendaPrimingPracticeNo biometric

Creation

Biometric

philipp.markert@rub.de
14/14

Security of 4- and 6-digit
PINs is comparable

XXL

Blacklists need to be large
to have an effectBlacklisting ~10% is ideal

Most of the participantsin our study (66%) use a PIN

Why study PINs?

4≈6

User Study@philipp_markert

Results

https://this-pin-can-be-easily-guessed.github.io

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs