Comment by brittohalloran | Hacker News Reader

Comment by brittohalloran | Hacker News Reader

Parent Full thread

He quickly glossed over the fact that these are computer passwords which happen to be 4 numeric digits.

"Given that users have a free choice for their password, if users select a four digit password to their online account, it’s not a stretch to use this as a proxy for four digit PIN codes."

Though there probably wouldn't be drastically different phenomenon, I think the actual PIN distribution would be noticeably different. Particularly 1234. It may still be the top PIN, but I don't think it would have the same dominance. People choose trymynewwebservice.ly passwords a lot more callously than their bank password. I have to believe on average people put a little more effort into disguising it.

I wonder about the 2580s (vertical numbers on a PIN pad). It makes perfect sense for PINs, but not a computer keyboard. It could be people keeping their passwords consistent with their PINs e.g. using their ATM PIN for their online bank account password.

A lot sites (correctly) prevent people from using very short or simple passwords, including four digit numbers. I'm curious what sites his database comes from.

This paper(PDF) uses the RockYou password database to do a similar analysis:

http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_secu...

(RockYou discussed here:

http://en.wikipedia.org/wiki/RockYou#Controversy

)

The patterns displayed by the codes in the paper are similar to the blog.

Wow, it's worse than I thought. Rockyou doesn't allow 4 character passwords so they were extracting the numbers from WITHIN longer passwords. 'asdf1975' would equate to a 'pin' of 1975, or 37489 would equate to two pins, 3748 and 7489. What a terrible assumption to build all your research on top of.

The paper is quite clear about the methodology used, they only extracted exact 4 digit sequences. I repeated that much of the analysis, I wanted to examine the patterns, not just look at the frequency plot. I got the same ~1.7 million sequences using a regex that excluded 5 digit sequences.

The blog is less clear.

Reply on news.ycombinator.com