Ask HN: Why the lack of love for PIN codes on smartphones/Android
Although PIN stands for Personal Identification Number, this is a misnomer. It should actually be PAN - for Personal Authentication Number (as in, a password).
I realize PINs lack entropy, but this is solved by increasing the size of the PIN. I personally have a randomly generated 10+ digit PIN muscle-memorized, e.g. through the below python script:
```import random [random.choice(range(10)) for _ in range(some_high_number)]```
well, in actuality my PIN generation is a bit more complex because I've also tried to include measures related to the behavioural complexity of entering a PIN - which is a totally different story.
I feel like PINs hit the sweet spot between ease-of-entry, familiarity for most, and entropic needs of a password, and I would really like to use them properly and prefer them over a full-blown QWERTY password.
The alternatives as they exist on smartphones nowadays are biometric authentication through fingerprint or face recognition, or the swipe pattern.
I personally don't consider many forms of biometrics a form of authentication, especially fingerprint and face recognition. We leave records of them everywhere, all the time, and they spectacularly fail the privacy aspects of a phone lock, as anyone with physical access to _you_ will be able to unlock your phone quite easily.
Swipe patterns actually contain less entropy then PINs and are more annoying to fill in. Further, the increased behavioural complexity of these swipe patterns is not put to any use in current lock screen implementations (e.g. behavioural biometrics), so really I don't see the point.
This leaves me with PINs as my go-to method of authentication and the source of my frustration.
The way PINs are handled by default is extremely insecure on most OEMs. Both my OnePlus and my Samsung's default settings were to show the actual digits of the PIN as I was typing it. This can fortunately be turned off in a setting somewhere.
What cannot be turned off is the visual feedback that is given at the location of the digit that was pressed. This is IMO a significant shoulder-surfing risk and I really don't understand why it is impossible to turn off.
Further, every single update to the android OS, and whatever crap layer the OEM puts over it, changes SOMETHING about this screen that totally messes with the muscle memory built up to that point. My OnePlus e.g. just moved the PIN confirmation button to another location, and in it's old place they put the backspace button. This means instead of confirming my PIN, I am now for the foreseeable future going to simply backspace the last digit of my PIN...
This is annoying, because I really only have procedural memory of my PIN code and cannot very easily compensate for these changes anymore. This procedural memory is something I've very specifically tried to build up, I consider it a feature and not a bug.
These constant changes mean I have to essentially keep re-learning my PIN and all my built-up practice has been for naught, simply because some UI designer and Google has decided we really need this new fancy UI design to be applied to every single screen on the phone.
Does anybody else share my frustration with this?