Any X digit PIN as good as the next one (mostly)?

jmjm

As we know some sites require, for example, a 6 digit PIN. Do essentially all random 6 digit PINS have the same "strength"?

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

Ben

Though none of them are very strong, most cracking attempts will start with the more commonly used PINs e.g. 000000, 000001, 123456, and so on. As such one of those frequently used PINs is likely to be cracked sooner than a random one. That said, with modern computing power, cracking a 6-digit PIN is fairly trivial, even if it is random, taking ~24 hours as a worst case (best case?) scenario.

Ben

jmjm

As you know sometimes we have no choice ie the site in question requires exactly 6 digits for its PIN. (At least it is 'better' than another site which only allows for 4 digits :( )

XIII

This might be interesting:

https://this-pin-can-be-easily-guessed.github.io/

jmjm

Thanks for that XIII.

jmjm

Though none of them are very strong

I have tried three 6 digit PINS for a login requiring a 6 digit PIN and each one results in 1P classifying it as a "Vulnerable Password". This would lead me to believe that all 6 digit PINS would be classified as "Vulnerable".

Ben

That is likely correct. I wouldn't be surprised if every possible combination of 6 digits has been used as a password by someone and has been compromised at some point.

Ben

XIII

I wouldn't be surprised if every possible combination of 6 digits has been used as a password by someone and has been compromised at some point.

Maybe. However, 948137 is not in the HIBP database...

(No, I'm not using that anywhere - I used some scripting and command line tools to find one)

(I only checked this one, but if I made no mistake 1,151 out of 1,000,000 are not in there)

Unfortunately I can't check what 1Password thinks about it since I don't get 000000 (or monkey) listed as a vulnerable password in 1Password7 for Mac (7.4.3), while both are in the HIBP database...

Bug?

(PS: I could not find any 4 digit PIN code that's not in the HIBP database)

jmjm

Thanks @XIII for elaborating on these 6 digit perms and coms.
(Actually I guess it is only combinations)

jmjm

(I only checked this one, but if I made no mistake 1,151 out of 1,000,000 are not in there)

I need a couple of these "uncompromised" 6 digit PINS ;). Is there an "easy" way for me to generate one?

XIII

Is there an "easy" way for me to generate one?

Depends on your skills I guess.

I might post some general instructions on how I did it (when I’m using a physical keyboard).

jmjm

Why isn't the case that 1P only generates PINS (or even passwords) which aren't "vulnerable"?

XIII

Why isn't the case that 1P only generates PINS (or even passwords) which aren't "vulnerable"?

(Why) would it matter?

The number of 6 digit PINs that are “not vulnerable” is so small that a hacker can easily just brute force all 6 digit combinations and hit these as well...

XIII

This is roughly what I did:

1. Write a Python script that writes all possible 6 digit PIN codes and their SHA-1 hashes to a file (one PIN and its hash per line)
2. Use the cut & sort commands to create a new file that only contains the sorted SHA-1 hashes
3. Download the (almost 10 GB!) passwords from HIBP, sorted by SHA-1 hash
4. Use the comm command to find SHA-1 hashes that are in the file from step 2, but not in the file from step 3
5. Use the file from step 1 to find the PIN codes generating those hashes

Does that help?

jmjm

Thanks @XIII. If and when I can get a hold of our son I will pass this along to him to let him have some "fun" :).

Lars

:) :+1: