6 ms·
Why is a pin more secure than a password?
by isykt 3y ago
Why is a pin more secure than a password?
- groovybits 3y agoThe PIN (or biometric) is not used to replace your Google account password. The PIN (or biometric) is used to authenticate to your device that holds your Passkeys, which in turn will authenticate you to your Google account (or any account that supports Passkey-based sign-in).
- kube-system 3y agoIt isn't, and this isn't authentication with a pin. Passkeys also requires the device. Using a pin with this is 2-factor. Pin + hardware token.
- isykt 3y agoSo why not just have a password that then unlocks the passkey? I already have a password manager.
- snowwrestler 3y agoSure, PINs can be long and alphanumeric on most phones these days.
- isykt 3y agoHow is that different from a password? PIN stands for Personal Identification Number. Words change meaning all the time, of course, but in this case there’s no reason to call it a PIN when there’s already another word for it.
- snowwrestler 3y agoThe important difference is that it is stored on the local device, not the remote server. Since the things stored on the remote server have been called “passwords” for decades, it seems helpful to call the local thing a “PIN” to help more easily distinguish it. IMO it’s not more silly than calling a hand-held computer a “phone.”
- michaelt 3y agoThe standards group that was behind Fido/U2F has been taken over by people who want to push a new product. That new product is "Log in with your phone" and phone lock screens allow biometrics and pins. Password managers are not relevant, as you don't use a password manager to unlock your phone. The people behind the takeover don't really give a shit about Yubikey-style tokens (which haven't achieved much market penetration anyway) but they've left them in to make the takeover less blatent.
- kube-system 3y agoMore like the other way around -- the existing FIDO/U2F crowd was a bunch of businesses that made money selling keys. And that's why adoption was a rounding error, it was infinitely more expensive than a free password, so few implemented it. This is the obvious solution -- we're already carrying devices with a secure enclave, just use that, it's free.
- tuckerman 3y agoIf you already have a password manager it might already or might soon natively support passkeys as well (1Password already does as an example)
- tzs 3y agoYou can have that by storing passkeys in your password manager, if it has support for that. Currently 1Password does, and BitWarden either does or is suppose to soon. I haven't looked at any others.
- abhinavk 3y agoYou should be able to use your password manager to handle passkeys. Enter your master password in 1Password, use passkey. And Bitwarden support is coming.
- akerl_ 3y agoThe PIN is checked by the local device. It never goes over the network, and the device can limit the number of PIN attempts to a very small number, because the only way to try PINs is to have access to the device.