How to choose a PIN - assessment of dictionary methods

TL;DR

This paper evaluates dictionary-based methods for choosing PINs, revealing their limitations in security and proposing approaches for creating memorable yet secure PINs.

Contribution

It provides an experimental assessment of dictionary methods for PIN selection and discusses strategies for generating memorable PINs for random numbers.

Findings

Dictionary methods have limited coverage of PIN space.

PIN entropy is often insufficient for security.

Proposed methods improve memorability without compromising security.

Abstract

Personal Identification Numbers (PINs) are commonly used as an authentication mechanism. An important security requirement is that PINs should be hard to guess for an attacker. On the other hand, remembering several random PINs can be difficult task for an individual. We evaluate several dictionary-based methods of choosing a PIN. We experimentally show that these methods are far from ideal with respect to expected covering of the PIN space and the entropy of PINs. We also discuss two methods for constructing easy to memorize PIN words for randomly chosen PINs.