Hacker News Reader

Microsoft should fix its 4-digit PIN/no limiter app authentication first.

https://www.cnil.fr/en/windows-10-cnil-publicly-serves-forma...

> The company allows users to choose a four characters PIN to authenticate themselves for all its on-line services, notably to access to their Microsoft account

What pin is this talking about? The only pin I see related to my account is a 6-digit one that the Google authenticator app generates.

Is this some kind of enterprise feature?

Windows 10 allows PIN sign in, but it's done with the TPM to ensure a limited number of accesses.

And IIRC it's tied to a single machine, so you need physical access for it to be any use.

That's how PINs typically work. The main threat for a PIN password without any attempt limiter is local bruteforce.

As someone who has accidentally locked himself out of his own Windows device before, there is definitely an attempt limiter on PINs in Windows. You have to resign in with your full password and must reset the PIN.

Reply on news.ycombinator.com