Can I Guess Your PIN?

[Loz]

I was reading an article that reckoned that a thief has a 20% chance of guessing your PIN. Someone did some number crunching on user-select PINs and found that, with the three guesses allotted then by trying '1234' (14% of PINs), '1111' (6%) and '0000' (2%) then that gives them a 1 in 5 chance of guessing the PIN.

Is your PIN guessable?

[DulwichFox]

Hi Loz.

If given an infinite amount of attempts to guess the range of a 4 digit code spanning from "0000-9999" there are 10,000 possible numbers.

Many pin verification systems allow only three attempts, so there is 1 in 3333 chance of someone correctly guessing your pin before the system is blocked.

Foxy

[Loz]

Only if they are evenly distributed, Foxy, which they are not it seems...

[lane lover]

Anyone with any of the above mentioned pins deserve to get their funds stolen.

Survival of the fittest and all ...

[????]

DulwichFox Wrote:

-------------------------------------------------------

> Hi Loz.

>

> If given an infinite amount of attempts to guess

> the range of a 4 digit code spanning from

> "0000-9999" there are 10,000 possible numbers.

>

>

> Many pin verification systems allow only three

> attempts, so there is 1 in 3333 chance of someone

> correctly guessing your pin before the system is

> blocked.

>

> Foxy

erm, you sure on your maths here Foxy

as you were my mistake :)

[lane lover]

Foxy's maths makes sense to me. All else being equal (i.e. excluding idiots with an easy pin).

[DulwichFox]

I'm confused now.

The odds are 3 in 10,000 because you do have 3 chances. Is that right ???

Foxy :)

[unlurked]

How do people remember all of their pins?

[woodrot]

them maths dont add up i think

[Townleygreen]

>>How do people remember all of their pins?

I only have the one pin - seems to work!

[Loz]

unlurked Wrote:

-------------------------------------------------------

> How do people remember all of their pins?

In my case, variations on a theme. Certain number common to all cards in my head, some chosen from places on the card itself. Right buggered me when they replaced a little-used card and it came with new numbers.

[Mick Mac]

Townleygreen Wrote:

-------------------------------------------------------

> >>How do people remember all of their pins?

>

> I only have the one pin - seems to work!

That's because only one pin works. Per card.

[Townleygreen]

you're so funny

[JohnL]

but once he has used a chance he won't take it again

1 in 10K then

1 in 9999 then

1 in 9998

Ok - not much difference :)

DulwichFox Wrote:

-------------------------------------------------------

> I'm confused now.

>

> The odds are 3 in 10,000 because you do have 3

> chances. Is that right ???

>

> Foxy :)

[El Pibe]

everything you ever wanted to know....

http://www.cl.cam.ac.uk/~mgk25/ec-pin-prob.pdf

assuming the banks' algorithms for pin generation are good then foxy is basically right.

It would appear that they're not all so good though, and definitely sounds like EuroCheque is a damn good place to start for your aspiring PIN guessing thief

[Mick Mac]

Townleygreen Wrote:

-------------------------------------------------------

> you're so funny

I'm taking that literally.

[Mick Mac]

El Pibe Wrote:

-------------------------------------------------------

> everything you ever wanted to know....

> http://www.cl.cam.ac.uk/~mgk25/ec-pin-prob.pdf

>

> assuming the banks' algorithms for pin generation

> are good then foxy is basically right.

> It would appear that they're not all so good

> though, and definitely sounds like EuroCheque is a

> damn good place to start for your aspiring PIN

> guessing thief

Although I think Loz was talking user select PINs v El Pibe bank select PINs

[ianr]

If you are in position to usefully guess, make good use of surveys of PIN choices. In particular, try using the holder's birthdate or other significant date information that's available to you. http://www.lightbluetouchpaper.org/2012/02/20/how-hard-are-pins-to-guess/

[El Pibe]

apparently eurocheque doesn't allow the user to select.

But that's a point, considering the bank sends you the initial PIN on a seperate letter for security reasons, what idiot then goes and changes it to 1234?

I'd have thought anybody that stupid would probably be unaware you can actually change the damn thing in the first place.

And how was this survey done?

"excuse me sir, I'm doing a survey on PIN selection, can you give me your PIN please?"

All sounds a bit dubious to me ;)

[Loz]

In reply to http://www.eastdulwichforum.co.uk/forum/read.php?20,1211851,1212380#msg-1212380

Mick Mac Wrote:

-------------------------------------------------------

> Although I think Loz was talking user select PINs v El Pibe bank select PINs

Correct. Most banks let you change your PIN to something a little more personally memorable.

[El Pibe]

Aaaah, so we're not necessarily talking banking PINs but iPhone unlocks and suchlike?

I guess if you're going to lock your phone thus you really oughtn't to bother locking the damn thing in the first place.

I did try using face recognition for a bit, but it didn't like my glasses, and in the end they're all a bit of a pain, so I don't bother at all.

My banking PIN is 1243, see what I did there? Hide in plain sight!!!!

[El Pibe]

I loved this comment on Ianr's article

"Perhaps I should leave a note of my birthday in my wallet ? it has nothing to do with any of my PINs and invites any attacker to waste one of their three guesses!"