Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/ryanc/statuses/113641669718485611">Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Friday, 13-Dec-2024 05:11:08 JST</a><a href="https://infosec.exchange/@ryanc" title="ryanc@infosec.exchange"><img src="https://gnusocial.jp/avatar/174285-48-20231204225121.webp" width="48" height="48" alt="Ryan Castellucci :nonbinary_flag:" style="position: absolute; left: 0; top: 0;">Ryan Castellucci :nonbinary_flag:</a><div><a href="https://gnusocial.jp/notice/8157891" rel="in-reply-to">in reply to</a><ul><li></ul></div></section><article><p><a href="https://infosec.exchange/@adamshostack">@adamshostack</a> I'm not aware of any such study. I was being a bit flippant, honestly it's probably more about how the people making decisions about implementing them feel.</p><p>Longer ones make issues related to rate limits and race conditions less relevant.</p><p>My bank uses eight alphanumeric characters for logging into online banking and making transfers, but six digits for online debit card transactions.</p><p>This doesn't seem coherent to me, but I really don't want to think too much about their backend.</p><p>You might look for papers which cite this: <a href="https://dl.acm.org/doi/abs/10.1145/3473040" rel="nofollow noreferrer">https://dl.acm.org/doi/abs/10.1145/3473040</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4174241#notice-8158364">In conversation</a><time datetime="2024-12-13T05:11:08+09:00" title="Friday, 13-Dec-2024 05:11:08 JST">about 2 months ago</time> <span>from <span><a href="https://infosec.exchange/@ryanc/113641669718485611" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@ryanc/113641669718485611">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/3685972">Untitled attachment</a></label><br></li><li><article><header><div>Domain not in remote thumbnail source whitelist: dl.acm.org</div><h5><a href="https://dl.acm.org/doi/abs/10.1145/3473040">On the Security of Smartphone Unlock PINs | ACM Transactions on Privacy and Security</a></h5><div> from <span>AvivAdam J.</span></div></header><div>In this article, we provide the first comprehensive study of user-chosen four- and
six-digit PINs (n=1705) collected on smartphones with participants being explicitly primed for device
unlocking. We find that against a throttled attacker (with 10, 30, ...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Friday, 13-Dec-2024 05:11:08 JSTRyan Castellucci :nonbinary_flag:
in reply to
- Adam Shostack :donor: :rebelverified:
@adamshostack I'm not aware of any such study. I was being a bit flippant, honestly it's probably more about how the people making decisions about implementing them feel.
Longer ones make issues related to rate limits and race conditions less relevant.
My bank uses eight alphanumeric characters for logging into online banking and making transfers, but six digits for online debit card transactions.
This doesn't seem coherent to me, but I really don't want to think too much about their backend.
You might look for papers which cite this: https://dl.acm.org/doi/abs/10.1145/3473040
In conversationabout 2 months ago from infosec.exchangepermalink
Attachments
1. Untitled attachment
2. Domain not in remote thumbnail source whitelist: dl.acm.org
  On the Security of Smartphone Unlock PINs | ACM Transactions on Privacy and Security
  from AvivAdam J.
  In this article, we provide the first comprehensive study of user-chosen four- and six-digit PINs (n=1705) collected on smartphones with participants being explicitly primed for device unlocking. We find that against a throttled attacker (with 10, 30, ...

Public

Embed Notice

HTML Code

Corresponding Notice