Most to least common 4-digit PIN numbers from an analysis of 3.4M

Ha, I liked that one too.

I wonder if I’m more technically savvy as a millennial, though. My kids are clueless about computers despite genuine effort on my part, and I’m not sure if that’s a fair representation of kids their age. I was able to do so much with computers at 15 years… it’s more than a little unnerving seeing them scratch their head at an iPad occasionally, or have NO clue how they’d do almost anything an app does for them within Apple’s ecosystem if they had to do it themselves. None of it seems possible to them.

But maybe most kids were the same when I was that age. I was too busy programming and modelling or animating in 3D Studio Max to know what was normal.

With a link to a great data story that is easy to miss:

https://www.datagenetics.com/blog/september32012/index.html

Someone tell The Los Angeles Angels.

I always use my PIN number at the ATM machine.

Great link. I love it that RAS Syndrome is an example of itself.

I think a very relevant part of the article is “A limited amount of redundancy can improve the effectiveness of communication”

The prevalence of “PIN number” suggests it’s a useful redundancy.

RAS 'syndrome' is just an example of redundancy in language, which is often actually useful for communication. There's no reason to insist on avoiding it.

I think people are biased towards PINs with only cardinal directions + 45 degree diagonals - or in other words the angles traced out by the digits should always be a 45 degree multiple.

Even at 8 digits people could still use their birthdays. I think there's a tradeoff between PIN size and fraction of the population that will feel comfortable picking a number with no significance. I'd speculate that in a world where every PIN has to be 16 digits that almost everyone would just use 2 or 4 concatenated dates.

Most of the time they do the trick (when rate limited). Even using a birthday will still stop card thieves from emptying your bank account at an ATM.

I'd hazard a guess that asking for an 8 digit pin will see lots of people just repeat the first 4 digits again.

Is that a problem that needs solving? Most interfaces for entering a user-generated PIN, like an ATM, are heavily monitored and rate limited. It's not like backend databases are routinely encrypted with these.

As others have said, increasing the length would do little to increase security in most cases since the usual response will be to repeat digits. Plus the current system seems to be working pretty well empirically.

This reminds of the password rotation policies that some companies insist on using, despite the evidence that they are a waste of time. In practice they are an "Increment the last digit of your password" policy.