Hacker News Reader

Comment by zokier | Hacker News Reader

And why do banks (or credit card companies) even let users pick their own PIN codes? Wait, do not answer that, I know. Some beancounter has calculated that the cost of somebody guessing PIN is significantly less than cost of support calls when people forget their random PINs. Which kinda sucks that security is compromised to make more profit.

For reference I have (afaik fully random) bank-assigned PIN on my card.

View on HN

I opened an account at Citizens Bank, who did not let me choose my pin code. It went something like this.

Received card, no pin, called, sent new, recieved card, no pin, pin came 2 weeks later.. for the first card, no pin for second card, third attempt nothing was sent, went to the bank, they told me I had to call, gave up after 2 months, over the next year they sent me several new cards (security breaches?), but I never had a pin to activate them.

One year later they change their terms and contions, impose new fees, deplete my checking account, deplete my savings overdraft account, and then send me to collections... all for opening a couple of accounts and depositing a few hundred dollars.

I seriously doubt they just up and decided to take all your money. What policy or agreement did you violate?

Account inactivity. Cards were never used.

>And why do banks (or credit card companies) even let users pick their own PIN codes?

Sure the PIN sucks, but ATM security is actually two factor, something you have and something you know. The cards can be duplicated, they've made good inroads on that but haven't rolled those cards out in the states.

Its an example of "good enough" security. Not only is the barrier to theft much higher than the cash next to it in their wallet, you only have a 30% chance of getting into their account before the ATM eats the card. If you do get in, you can typically only withdraw $300 and your face has been recorded.

Which kinda sucks that security is compromised to make more profit.

I find it kind of strange that you're picking up on this, do you not read everything on HN as a stream of soul-crushing money-first attitudes too?

In the UK, cards are issued with random PINs. I believe some have the facility to change them, but i would guess the majority do not. I was wondering this when reading the article; so I can take it to assume that in the US you define your own pin? How does that work, do you do it at the bank or a the ATM machine the first time you use it?

I'm not aware of any UK cards that don't let you change the PIN, just pop them into a cash machine and you'll find an option to do it on the menu.

Of course, my not being aware doesn't mean you can't, but I know from experience that most of the big banks let you do it, and I can't think of a single example of either me not being able to do it or me hearing of anyone else not being able to do it.

That could be true. But how many people do you think actually change their PIN? I think it's will be low single figure %; I think many aren't aware you can make PIN changes.

I only have anecdotes rather than data (suspect the same is for you), but personally I would have guessed that nearly everyone does. Obviously I don't know the situation of all my family/friends, but for example in my close family both parents and both siblings have always changed to PIN numbers they chose themselves, I've known colleagues go change their PINs after getting a new card, etc...

I suspect there's no way to know which of our guesses is closer to the truth without a bank providing stats, which seems unlikely to happen. Or a poll somewhere..

In every letter I've had with a new bank card it's told me how to change my PIN if I want to. I'm not sure I know anyone who hasn't changed theirs.

In Finland you actually don't get to pick your own PIN. The bank sends one to you when you get a new card and that's that.

Most US banks are that way. Almost all, in fact. I thought it was a law until I joined a credit union which lets me change my PIN at their ATMs.

I don't have sufficient knowledge to say that you're wrong about this, but I DO know that the largest banks ALL allow you to change your PIN. Examples:

  * Bank of America
  * Chase
  * Citibank
  * Wells Fargo

Many banks apparently don't let you choose PINs; however from the limited sample of PINs I know of (mine, my wife, my company and a few others) they're not random; they all have doubled digits (like 2554).

It could be a coincidence. About half of all 4-digit numbers contain at least one repeated digit. (Of 10000 possible numbers, 10 * 9 * 8 * 7 == 5040 contain four distinct digits.)

Right, and about a quarter contain the same digit at least twice in a row, which may be the "double digit" the grandparent referred to.

    $ pins() { seq -f '%04.0f' 0 9999; }
    $ pins | egrep -c '(.)\1'
    2710
    $ pins | egrep -c '(.).*\1'
    4960
    $

Further to my reply to sibling-reply finnw, here's the pattern of digits, further showing his 10 * 9, etc., breakdown.

    $ pins |
    > sed -r '
    >     :a; s/^([0-9])(.*)\1/\1\2a/; ta; s/[0-9]/a/
    >     :b; s/a([0-9])(.*)\1/a\1\2b/; tb; s/[0-9]/b/
    >     s/([0-9])\1/cc/; s/[0-9]/c/
    >     s/[0-9]/d/
    > ' |
    > sort | uniq -c | sort -n
         10 aaaa
         90 aaab
         90 aaba
         90 aabb
         90 abaa
         90 abab
         90 abba
         90 abbb
        720 aabc
        720 abac
        720 abbc
        720 abca
        720 abcb
        720 abcc
       5040 abcd
    $

I know it is best to use a full uniform distribution for assiging PINs, but I do not know whether any bank does it. Would they really dare send out '0000' to 1 in 10000 of their customers?

You can still have a uniform distribution across the subset of four digit numbers that don't look suspicious to a human.

Reply on news.ycombinator.com