Most to least common 4-digit PIN numbers from an analysis of 3.4M - https://news.ycombinator.com/item?id=40306374 - (56 points, 18 comments, 5 days ago)
Most to least common 4-digit PIN numbers from an analysis of 3.4M - https://news.ycombinator.com/item?id=40306374 - May 2024 (19 comments)
Statistical Analysis of PIN Numbers (2012) - https://news.ycombinator.com/item?id=11365962 - March 2016 (1 comment)
The 20 most common PIN numbers - https://news.ycombinator.com/item?id=11230045 - March 2016 (1 comment)
PIN analysis (2012) - https://news.ycombinator.com/item?id=11228319 - March 2016 (1 comment)
Analysis of bank PIN numbers - https://news.ycombinator.com/item?id=4535417 - Sept 2012 (111 comments)
(https://news.ycombinator.com/item?id=40306374 didn't get any frontpage time so we won't treat current post as a dupe)
When his friends started getting phones as well, they copied his. This has migrated through some of the friends' siblings as well.
I switched my passwords to correct-horse-battery-staple and now I'm super secure.
Discussion: https://news.ycombinator.com/item?id=40306374
Some previous discussions on the 2012 source of the data (http://www.datagenetics.com/blog/september32012/index.html)
2018 https://news.ycombinator.com/item?id=17670173
Likewise, on the internet, a lot of things prompt for passwords that really don't need them. People create throwaway accounts and use them as if they were temporary anonymous sessions.
Edit: The joke hit me a tad late. ;-)
And now I'm asking myself why noone else does this. I don't see hordes of Swiss people complaining about being unable to remember a 6-digit PIN at least.
I think remembering one 6-digit PIN would be fine, but in the US, it's common to have many banking relationships. If I needed a pin for every credit card, I'd have to write them on the cards or set them all the same.
Also nothing says you can't use the same PIN for multiple cards; they're essentially the same security domain anyway ("a piece of plastic in your wallet") — most people don't have "more" and "less" trustworthy cards…
And the person that stole your card would just try 123456 instead of 1234 etc and roughly would have a similar chance of success
That said, guessing the PIN isn't the only attack; longer PINs also means that you have to "spy" more digits, which can be significant if the "spying" method is not 100% reliable.
But yeah. I guess it doesn't matter as long as you have a lockout mechanism.
Sounds like it may be the reverse with Europe going the 6 digit route, but I think 4 digits is still pretty universal — I think most interfaces provide a enter key to terminate the PIN?
Sadly, there was a post by the author in June 2019 about being diagnosed with Stage IV cancer [0]. There have been no posts since July 2022. I sincerely hope that's just because Nick doesn't have the time to blog anymore.
https://www.theguardian.com/science/2022/oct/17/can-you-solv...
So me and another dev ran a SQL script to see what the most common were.
#1 was trustno1
#2 was password
#3 was 1234
[1] https://arstechnica.com/information-technology/2019/10/forum...
I was glad to see those plotted out. I was also initially surprised that not a single 19xx pin made the top 20, but I suppose it makes sense considering that there are 100 different combinations of this code.
I knew that mathematically it would be pretty easy to brute force, and figured I could belt out a thousand combos per day and probably get it done within the week or so. "Well, no time like the present," I thought, "...better get crackin'." ((of knuckles))
Changed the combo to 0000, pulled the handle, and... click! Opened on the first try. :-D
> Fry: "10.77. Same as my PIN number."
So many silly scenes like this. I want to re-watch Futurama because last time I watched it was as a teenager, so I'm sure I missed many of subtle jokes.
Use a CSTRNG and as long of a PIN as possible to prevent rampant spending. ;@)
for i in $(seq 1000000); do
echo $[RANDOM%10000];
done | sort -n | uniq -c | sort -rn | gnuplot -e "set terminal dumb; set xtics 1000; plot '< cat' using 0:1 with boxes"I had a look on YouTube and sure enough there was an easy way to pick the lock.
The resulting code - 01234
Should be changed to this, rather than screenshot + link blogspam.
List transcribed by ChatGPT: 8557, 8438, 9539, 7063, 6827, 0859, 6793, 0738, 6835, 8093, 9047, 0439, 8196, 6693, 7394, 9480, 8398, 7637, 9629, 8068.
Does it serve a security function? Am I supposed to remember what it is?
I know the IRS does have an identity protection PIN process, but that's separate.