Hacker News Reader

Comment by gwbas1c | Hacker News Reader

> Passkeys not only offer an improved user experience by letting you sign in faster with your ... PIN, but they also aren’t susceptible to the same kinds of attacks as passwords.

I don't know about you, but a PIN is pretty much a password in my book.

Once I figured out that I can use a password with Windows, I stopped using my PIN. (I didn't use Windows for about a decade.) It's much easier to remember.

Even worse, on Windows, I'll only use passkeys on sites where I can use a Yubikey. If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it.

Otherwise, on Mac, my passkey supports my fingerprint sensor. Much easier.

View on HN

The Windows PIN is just a local password that isn't tied to a cloud account or ever sent across the network. Mine is a full text password, it doesn't have to be numeric.

I haven't tried it but it should also work with "Windows Hello" supported face or fingerprint recognition.

That is not mentioned anywhere, neither in the article, or when setting up a PIN.

The common definition of a PIN is for things like using an ATM, where the PIN is for the account, not the card itself.

The PIN is also for the card itself. The smartcard chip inside the card can validate it for offline transactions (although that's not as common in the US).

I think a reasonable modern definition for a PIN is "a password that can safely be short"; more here: https://news.ycombinator.com/item?id=42446015

PIN stands for "Personal Identification Number."

It can't have letters / symbols in it. If they're calling a password a PIN, that's the wrong word and will confuse the ^%$^#% out of people who expect PIN to mean numbers only.

> I don't know about you, but a PIN is pretty much a password in my book.

Then your book is filled with misunderstandings of what the PIN function in Windows is actually doing.

What's the difference between the two? I can log into my laptop with a password or a PIN; I assume anyone that steals or hacks my laptop can _also_ log in with a password or a PIN. PINs are inherently shorter and more simpler than passwords; why would anyone use a PIN over a password?

If you change your motherboard, your windows PIN won't work anymore, and you'll have to login to the underlying microsoft online account.

A regular local account with a password would still work after a motherboard change.

This is assuming no bitlocker. If you have bitlocker, I don't know if bitlocker key recovery will also fix the pin (hopefully you printed the recovery key and can find it)

I'm guessing this would also mess up passkeys.

AMD CPUs have fTPM built in so the passkeys are actually stored in the CPU. This is more secure because separate TPM chips on the mobo have been attacked by listening to the traces from the TPM to the CPU.

Maybe the PIN doesn't change if you swap the motherboard and keep the CPU, maybe. But if you swap the motherboard and the CPU your PIN doesn't work anymore.

The difference is that I can't login to your account using a pin. I need to use your master password or passkey, then once I have I can use a pin. Basically the pin is only local to your machine, so yes if someone steals your laptop it's the same, but there's a lot less people than can steal your laptop then can try to guess your Gmail password

The PIN on a Windows machine is a secondary credential to unlock the primary local credential, with the primary being your actual password.

Also, as mentioned in the sibling comment, PINs are just device-local credentials. They don't necessarily have to be numeric-only and can also be very long.

You can have your computer re-challenge you for a full password on some interval. So have it force you to use your password on your first login of the day, then you can use your PIN to hop back in during the day and then have the PIN option time out after so many hours. Same with any of the Hello credential options.

After too many failures with a PIN, it will disallow the PIN authentication entirely. So, its length isn't really a problem, it'll start to disallow PIN attempts after only a few wrong guesses. Once again, also configurable. Meanwhile, it'll always still allow a password although it'll start trying to slow you down on password attempts.

PINs are supposed to be stored on the TPM or similar secure platform module, they're not stored on the local computer storage. So, there's not some easily accessible file to do brute-forcing outside of the computer.

While consumer Windows isn't really Windows Hello for Business, the same basic ideas of PIN security are the same. Here's the FAQs on that which also go into some depth of why PINs over passwords:

https://learn.microsoft.com/en-us/windows/security/identity-...

I don't understand the purpose of this at all then. That sounds like I now need to remember two passwords, one with all the problems passwords always had and a second one that requires my device to be useful. I hardly think two different attack vectors is better than one attack vector security wise, especially if one of the two former vectors is also the single later.

I guess the idea is that it is easier to use. I just setup a PIN for Windows Hello. The PIN requirements were more strict than the password requirements, so that is hardly more convenient. Maybe this is punishment for not wanting to use a fingerprint or face scan which remain optional. For now anyway, it feels like all I did was get my goose half cooked and end up with two passwords whereas before I had one. Even if I did give my face scan or whatever, I still need to use my password to login to things so my original point about two attack vectors seems to still stand.

> one with all the problems passwords always had

No, because the PIN is tied to the device and becomes invalid much more quickly. A Windows password is potentially used in far more places and potentially across many devices.

> I guess the idea is that it is easier to use

For many, it really is. On some of my devices which lack biometrics my pin is just a few numeric digits easily input with a small numberpad. The PIN is backed by the TPM which wipes it after too many failures. This is far faster and easier to type in than my full Microsoft account password which uses most of the normal complexity concepts such as length, mixed-case, letters+numbers+symbols, etc. Far easier to just type 4-6 digits (or however long you want it to be) instead of dozens of mixed-case alphanumerics and symbols.

For instance, I recently got a gaming handheld which runs Windows. I want to use my Microsoft account, but as mentioned its a long and complex password. It seems this device doesn't have any biometrics, so its either type in my very long password every time the screen locks on a software touch keyboard or just type in a short PIN backed by the TPM. Which seems like the better process?

> it feels like

You may feel that way, but a Windows Hello PIN is not a password. They're different things in many ways. I could continue throwing more documentation at you, but somehow I feel like continued facts aren't going to change your feelings about this.

> No, because the PIN is tied to the device and becomes invalid much more quickly. A Windows password is potentially used in far more places and potentially across many devices.

I'm talking about the password classic here. It didn't go away. It remains one of the now two methods for signing in. Now there is also a second one while the original still exists, is it more secure? I don't see how two doors is stronger than one.

All else being equal, two access methods are strictly less secure than a single access method. But is all else equal? I suspect that there are quite a few people who are willing to use a long, complicated password occasionally but who won't put up with that for passwords that are used frequently. If those people use better passwords when they can use a PIN to make routine access easy, that's a win.

You could have a strong account password which is needed for remotely accessing the PC, and a simple PIN for convenience but which only works when authenticating locally.

(I'm assuming this is a personal PC and not a corporate device, in which case this model is the same but the strong password is also used for many internal single sign on resources).

Usually you pair this with a Windows Hello camera for face sign-in so you skip the logon hassle when in front of your PC.

There are settings in the group policy editor to change the Windows Hello PIN settings, but it could depend on your Windows edition and whether you have admin rights.

For example, if I use gpedit.msc > Computer Configuration > Administrative Templates > PIN Complexity, I see:

Require digits, Require lowercase letters, Max PIN length, Min PIN length, etc

> You can have your computer re-challenge you for a full password on some interval. So have it force you to use your password on your first login of the day, then you can use your PIN to hop back in during the day and then have the PIN option time out after so many hours. Same with any of the Hello credential options.

That still requires making up and memorizing a PIN.

Sure, but a short numeric PIN you probably type in several times in a day is probably pretty easy to remember. And once again also far easier to type in many situations than a long complex password.

Or even better yet use biometrics instead of the PIN.

>> I don't know about you, but a PIN is pretty much a password in my book.

> Then your book is filled with misunderstandings of what the PIN function in Windows is actually doing.

The "PIN function in Windows" doesn't define what a PIN is. If Microsoft really meant the "PIN function in Windows" specifically, they should have said so in their blog post. Otherwise, in this context, PIN means this: https://en.wikipedia.org/wiki/Personal_identification_number.

> but a PIN is pretty much ___a password___ in my book.

> Once I figured out that I can use ___a password with Windows___, I stopped using __my PIN__.

Context clues. Read the whole comment. Pretty much immediately after they start talking about PINs and how they're pretty much just passwords, they go to talk about using passwords instead of PINs in Windows. Each sentence isn't its own entirely separate universe devoid of any context of the previous words and sentences.

What PIN do you think they stopped using immediately after referencing their Windows password? Think they stopped using their bank card PIN because they figured out how to go back to full Windows passwords?

So no, they're not speaking generally about all PINs, they're specifically referencing it in the context of Windows accounts.

https://www.grammarly.com/blog/writing-techniques/context-cl...

Their post actually says "face, fingerprint, or PIN"

When you set up a PIN in Windows it can either be numeric or a full text password, it's your choice.

the way a PIN works in other contexts is the same concept as what microsoft means.

Your PIN for your bank card doesn't give anybody access to your bankaccount. that would be terrible. your pin acts as a secondary level of authentication to secure the bank card that is your primary authenticator. just like a PIN in windows hello acts to secure your primary auth method - the computer that's already signed in to your microsoft account.

> a PIN is pretty much a password in my book.

My definition of a PIN is a password that can safely be short (i.e. low entropy), which means you can only use it against a system capable of enforcing a rate limit.

That can be local trusted hardware (such as a secure enclave, a Yubikey etc.) or a remote backend via something like SRP.

> If the passkey requires a PIN, I don't bother. I just can't be bothered to remember it.

Then use your password! A PIN can, but does not have to, be short :) FIDO-compliant authenticators have to accept up to 255 UTF-8 characters; you're by no means limited to a numeric 4-digit code.

A PIN is not a password, because it only works on a device that you have already autheticated using some much more secure mechanism.

if there is anywhere that you can use a PIN without additional authentication it's not a PIN, it's just shitty insecure password.

Not necessarily. You can securely use PINs over a protocol like SRP, as long as the backend can be trusted to perform rate limiting properly.

Reply on news.ycombinator.com