|
Thirtysome years ago I designed and built cryptographic modules for EFT processing. Early days...
In those days there were two main algorithms for PIN verification.
The IBM Derived PIN system used data from the mag stripe (some of the account number and other fields) to crunch up with DES and other things to generate the expected PIN, which was verified by direct comparison (at a processing system, since the terminal did not have the relevant DES keys etc).
The (more popular) VISA method took the PIN and some stripe data, crunched them up and came out with a 4 digit value which was compared with the PVV (PIN verification value) from the stripe (or issuer's database).
This can be viewed as an elaborate hash function (4 digit PIN -> 4 digit PVV)
I investigated its properties as a hash, and (re-)discovered some interesting statistics.
Obviously a 1:1 mapping could be fairly easily brute-forced, so information is "destroyed" to make it a one-way operation.
As a consequence, looking at the PVV space:
1/e (almost 37%) of PVVs are unreachable - no corresponding PINs
1/e have one PIN mapped to them
1/2e (over 18%) of PVVs have TWO PINs that map to them
1/6e (6%+) of PVVS have THREE PINs that map
1/24e (1.5%+) have FOUR ... and so on
So, (back in PIN space) there is a very real chance that your card has more than one PIN that would work. (Good luck finding the other(s)!)
That fact blew the mind of more than a few bean-counters and auditors....
With regard to OG's thread below, we had requests from card issuing institutions to NOT generate "simple" PINs.
In the end I think we discarded PINs with 4 consecutive digits or more than two repeats.
(A little repetition is good - my favoured PINs have two characteristics:
They can be keyed by laying my hand over the PIN pad and merely flexing fingers.
They include a repeat so even keen watchers wind up missing something.)
Some time later, customer selected PINs (and PIN change terminals) hit the streets...
Ah, nostalgia (ain't what it used to be)!
Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012
|
|
|
|
|
Wordle 1,095 5/6*
⬛⬛🟨⬛🟨
⬛🟨🟨⬛🟨
🟨🟨⬛🟨⬛
🟩🟩⬛🟩⬛
🟩🟩🟩🟩🟩
|
|
|
|
|
American here for context
In the light of recent revelations of MS cooperating with the CCP and the PLA and the fact that the DoD and the Feds (I know that's redundant) moved all their crap to the cloud - all of it classified - none of it protected by the OS, I give you this...
So, I have deliberately covered my built in webcam. I login through a password or a pin. The login process or whatever it is has thrown an exception condition. I cannot login. The mouse has gone stupid. The laptop is hung.
The inmates are in charge of the asylum.
Charlie Gilley
“They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.” BF, 1759
Has never been more appropriate.
|
|
|
|
|
Did you let your Matrix subscription lapse?
Reality what a concept.
If you can't find time to do it right the first time, how are you going to find time to do it again?
PartsBin an Electronics Part Organizer - Release Version 1.4.0 (Many new features) JaxCoder.com
Latest Article: EventAggregator
|
|
|
|
|
Well, just uncover your webcam, submit a new blood sample, and schedule your subcutaneous tracking capsule injection. You will be right as rain in no time!
|
|
|
|
|
I was going to make the Subject
"It is your computer BUT we will tell you how you can use it"
This is a Hardware Question if it should not be in the Lounge
Please inform me where to post
Config
W7 64 bit Pro
Firefox browser DuckGo search engine
Chrome Block all Cookies
I have a VB app that stores data in SQLite DB the name of the YouTube site and a link to open the site with a list of all the videos.
A number of things are failing
1 The site will not load content if I use "Open Link in New Window"
2 The site will not load content if I use "Open Link in New Tab"
This varies no consistent behavior political ads show Liberty Mutual ad blocked ? ?
3 In Firefox I turned OFF "Block Popup Windows" it was on OFF no change
As of now the ads do not show but I am presented with a skip button to close the ad
that did not show
If I login to Google then Google and Firefox seem to play nice
except "Open Link in New Window"
Any suggestions on how to make Google and Firefox play nice?
Any settings I should change in either ?
I did try just using "Block 3rd Party Cookies" ONLY no change
|
|
|
|
|
I know that Google Chrome now blocks all 3rd party cookies. As for the other browsers, they may also block 3rd party cookies, but I honestly don't know. It's something I'd have to check.
When it comes to blocking all cookies, I think it would inevitably interfere with the function of most web pages. Instead of blocking all cookies, require the browser to prompt you whenever a page sets a cookie. This way, you can allow cookies for the websites you trust, and disallow all other sites by default.
Take a look at Google's/YouTube's cross-origin-resource-sharing policy. That could shed some light on things. Google may require you to set some sort of HTTP request header in certain cases.
If the problem that you are experiencing occurs in the same way across all browsers, I get the feeling that it would be a CORS issue.
You may also want to try disabling all browser extensions to see if that has any effect. I recently encountered a bug on my site. It turns out that a specific plugin was causing the error. I disabled the plugin, and the problem is fixed.
|
|
|
|
|
3.4M PIN numbers that were pulled together from a whole bunch of data breaches have been heat mapped, and they are quite interesting (to me at least): https://www.grc.com/miscfiles/pin.png[^]
Given that most (if not all ATM / shop card readers work with 4 digit PINs, it's interesting to see what people generally use. Notice the lines and clusters: identical pairs (0000, 0101, ...) birthdate day and month, birth year seem to be pretty common, but it's interesting to note two things:
1) There are a small number of "empty" or "near empty" cells where people just aren't disposed to use that combination.
2) 20 out of the possible 10,000 different PIN values are used by 27% of the population ... so if you want to "brute force" a PIN, those are the ones to try first - if you are using one of them, it's probably time to change it:
1234, 4321, 0000, 7777, 2000, 2222, 9999, 5555, 1122, 8888, 2001, 1111, 1212, 1004, 4444, 6969, 3333, 6666, 1313, 1010
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
"Common sense is so rare these days, it should be classified as a super power" - Random T-shirt
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Very interesting picture. Any four consecutive digits appear to be highly used.
|
|
|
|
|
Yeah - it's surprising how much human beings can skew what you might assume was pretty random data!
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
"Common sense is so rare these days, it should be classified as a super power" - Random T-shirt
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
We're all a bunch of skew be do's.
These numbers are interesting (7410, 7942, 8520) since they don't seem to follow any pattern.
|
|
|
|
|
No pattern? 7410 goes down one side of a standard keypad, while 8520 goes down the middle.
|
|
|
|
|
Totally missed that. Thanks!
|
|
|
|
|
I was looking at physical distances between keys and I see that in most cases where each value is far from the next value they tend to be "more rare".
Or, stated another way, "if your finger is already there, you probably pick something closeby".
If you typed a 2 you probably type a 1 or 3 or maybe 5 next. The physical layout of the keypad does a lot to "force" certain combinations, I think.
|
|
|
|
|
That's what I get for responding to a stale screen and not updating before I post. Wasn't trying to steal thunder or anything.
I’ve given up trying to be calm. However, I am open to feeling slightly less agitated.
I’m begging you for the benefit of everyone, don’t be STUPID.
|
|
|
|
|
7410 is down the left hand side of the number keys pad of a full size keyboard. 8520 is the middle, it gets zero too since the zero key is usually a double width key.
No idea about the 7942 though.
I’ve given up trying to be calm. However, I am open to feeling slightly less agitated.
I’m begging you for the benefit of everyone, don’t be STUPID.
|
|
|
|
|
Banks (in India, most probably elsewhere too) block the login after three incorrect PIN entries (to unlock which the customer has to complete some formalities after visiting a bank branch). So, the customer has at least some protection.
|
|
|
|
|
I have yet to understand how PIN numbers are more secure than passwords. Face it, there are only 10,000 combinations, yet even an alphabetic, case insensitive, PIN would have 456,976 combinations. I would expect being able to brute force a pin number, regardless of length, would be easy for modern computers that can break 128-bit key based encryption systems in hours.
|
|
|
|
|
They are not necessarily safer, just a lot more convenient.
I think the banking industry (where PIN are used a lot ) weighted the pros and cons of 4 or 5 digits PIN and decided that there is a risk, but it's manageable.
Also, I can't imagine having an ATM with a full keyboard and my dad trying to enter his password.
CI/CD = Continuous Impediment/Continuous Despair
|
|
|
|
|
Your pasword must contain ...[^]
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
"Common sense is so rare these days, it should be classified as a super power" - Random T-shirt
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
obermd wrote: I have yet to understand how PIN numbers are more secure than passwords.
It is most likely a numeric pin and not a password because manufacturing and maintaining a numeric keypad ATM machine is far more economical than producing one with a full fledged QWERTY keyboard. It almost always comes down to the costs.
|
|
|
|
|
OriginalGriff wrote: 1234
"That's amazing. I've got the same combination on my luggage." 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
"I've lost the bleeps. I've lost the creeps. And I've lost the sweeps."
|
|
|
|
|
I use the last 4 digits of old phone numbers I've had, like from my childhood.
I'm not likely to forget them, and good luck tying them to me.
Check out my IoT graphics library here:
https://honeythecodewitch.com/gfx
And my IoT UI/User Experience library here:
https://honeythecodewitch.com/uix
|
|
|
|
|
honey the codewitch wrote: good luck tying them to me.
My phone number (number*s*, now that I've joined the club and carry a phone) has had the same last 4 digits for my entire life...
If I used that as my PIN, anyone who knows my phone number would have a pretty good chance at guessing it.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
