You must log in or register to comment.
The fact that every 4-digit pin is in this picture shows quite well how these are pretty easy to crack.
Idk why you would be cracking a PIN code. They aren’t really typically used for online security (and shouldn’t be). And if your attacker is targeting you, the PIN code isn’t meant to stop them.
What it does stop is you finding a random card on the side of the street and finding the nearest ATM to withdraw all of the cash from.
which will lock the card after 3 tries, so even if you are using your birth year chances are they are not going to guess it
Revolut which is a European wide online bank mentions a passcode required to access your account + a two factor authentication typically on the same device…
I recall I was not confident on the security options and opted to close the account before even finishing the registration 😅
You can see that 19xx line continue at 20xx too
Now someone tell me which pin is the least common one so we all can use it to be safe.
The ones that are showing black dots.
wooosh
I’ll take it.
Now imagine if you could use FIVE digits for something as important as a bank account.
Even more hilarious is the number of banks that have online login systems that have a maximum length of like 12 characters for the password.
and then the 2nd factor? Yeah that’s just another password.
Second factor being a “security question” that anyone who stalks you on social media could figure out.
Not if you put nonsense as your security answer too. A lot of people don’t realise that those answers should be secondary passwords.
But then you have to note down another password.
I’ve met ones that restrict passwords to be 6–8 characters
At my last job, our payroll logins were maxed at 6 characters
Install a second language keyboard, and put your password in those characters.
I use 8! My mom called me ridiculous for doing that :(
It is! How long does it even take to type in 40320 digits?!?
I figure gotta be, at least 45 seconds!
She’s right, 8 is not a very secure code.
Why is 1701 circled?
NCC-1701 is the ship designator of the Enterprise from Star Trek
This occurred to me right after I posted. But are there that many ST fans?
Yes. Dozens of us.
DOZENS!
It was an extremely popular show when it was new, and continues to have a cult following among nerds.
When it was new? It’s had various new incarnations for over half a century.
IDK if I’d call it a cult…
It’s pretty iconic and when you need to make a 4-digit pin quickly, it’s something that stands out if you’re a fan of the series. But as the heat map suggests, it may not be the most secure
I’m a fan of the series but it would never occur to me to use that as a pin.
Lots of Anna Magdalena Bach fans out there. A real lot. Or otherwise, people are using the worst possible pin to access their BIR1701 income tax return. But probably fans of baroque music.
I wanna know what these black dots are. Forbidden numbers? Numbers the mind cannot guess?
Just the least used. 9805 for example. Mines dark orange and I wasn’t even trying, I just made it a physical pattern rather than a number combo.
EDIT: You know, I bet 9805 is gaining popularity in countries that use the Day/:Month/:Year format. Aug 9th 2005 is the birthday of a fair number of adults, now.
There’s text over mine, I have no idea how I did. Judging by surrounding stuff, I think I’m ok. The numbers are fairly random.
The bank gave me the code and I just memorized it, and never bothered to change it.
Anyone have a version of this that doesn’t have anything overlayed on it?
Set all pins to 6806, got it.
My bank just gave me a random PIN number. Choosing my own was not an option.
I’d forget that so hard.
I used to be able to memorize random sequences of numbers when I was young, but my brain doesn’t do that tedious shit any more.
Man, I hope I don’t lose that ability. Would be disappointing.
Maybe it was just because it was the time before smartphones and it was actually necessary to remember phone numbers, credit card numbers, account numbers, addresses, etc. All that is offloaded to a device now.
I still remember some old addresses, SSNs, and pre-Internet bank account details.
it was actually necessary to remember phone numbers
Hehe, I memorised all my family’s phone numbers as a child. Do all children have devices now?
My family’s “phone numbers” were just one phone number, because we had one telephone in the house.
From what I understand, most children do have devices now.
Password manager is the way. It’s recommended for all password related things anyway.
And good ones like bitwarden or keepass, not bad ones that get hacked almost yearly like lastpass
I was able to change it, but once I found out I had the random one memorized anyways and changing would’ve been even more confusing.
damn, 0451 is blocked from view :-(
hunter2?
*******thats what I see
/s ?
Fahrenheit 451
I would say probably more 451 games (essentially synonymous with Immersive Sims) where there’s almost always a door with the code 0451, a reference to System Shock, where the first door uses this code as a reference to Fahrenheit 451. In the end you’re right, but it’s more a reference to this repeated reference (which is in itself a reference) than a reference to the book itself.
Oh I see now.
Also it’s the first code entered into the first door to leave the first room in the first System Shock, which is likely what thread OP was referring to.
SS did it and so a bunch of other games do it in reference, like BioShock
White is most common and dark orange/grey are the least common? By how many standard deviations?
Very valid question, but honestly I hardly think it matters much in this context. It highlights people’s patterns, and apparently humans are the worst to ask for random numbers.
On a side note, what’s up with the hotspot at 5049?
It’s probably 5150
Hmm, it seems you’re probably right Last night I tried lining it up with a random toothpick on the table in front of me LOL!
I tried again using the edge of a sheet of paper, and yeah it does seem more like it’s 5150.
Whatever. Still, what’s up with that?
Eddie Van Halen used a guitar amp called the Peavey 5150. I imagine it’s that.
or maybe the police code for involuntary psychiatric commitment? i know $b reference it in their lyrics a lot
I believe there’s a Dierks Bently song about this too, 5-1-5-0
It’s definitely this. Source: I know at least 2 people who are really in to rock, and use 5150 as their PIN.
Looks like there is a bright at 2846, which makes me laugh. My pin is safe, though, at least in this graph, so I guess I’m good.
I imagine many are common based on their geometrical shape on the number pad.
For my main card it is from the pin I used to reload my Gauntlet save at the arcade, which was based on an easy to memorize joystick pattern used to select the pin on the cabinet
Hot spot at 6969, nice.
Hot spot at 8888 too, less nice
There is also the original ‘original source’. It includes a version of the picture without the labels and the axis flipped.
this is so much better. Always read the x axis before the y axis
That blog’s such a treasure! I’ve ended up on there several times over the years for completely disparate reasons like solving Countdown numbers games, etymology and explaining mathematical paradoxes.
Fantastic analysis
There’s also a recent YouTube video on it…
Here’s a question, would it be more secure to choose a rare pin number or a pin number that is extremely common (ignoring obviously bad ones like 1234, 4321, meme numbers, numbers with four repeating digits, etc)?
Logic suggests that picking a rare number is better than a common one, because common ones are the ones that people would try first when attempting a bruteforce attack. Yet at the same time, personally if I was trying to brute force a pin, I’d start with obvious choices like 1234, 4321, four repeating numbers and meme numbers, and then switch to alternating between common-rare-common-rare if I was trying to brute force a pin number (starting with the most common and most rare). That’d mean the pin numbers that are the most secure when it comes to brute force attacks would be somewhere in the middle.
Granted, 4-digit pin numbers aren’t very secure considering there are a maximum of 10,000 combinations, and social engineering attacks like phishing mostly bypass the need to brute-force the combination entirely. As such, the effort would likely be inconsequential and pointless outside of not picking ridiculously bad pins like 1111, but I’m still curious.
If your goal is to access a random account as quickly as possible, why would you ever try anything other than the next most common PIN?
It’s not like Vegas where longer odds = higher payout. Less common PIN just means any given account is less likely.to use it, and therefore it’s less likely to be correct on any given attempt.
If you look at it another way, the brightness of each square on that grid is the probability that there is a prize inside. If you wanted the most prizes as quickly as possible, picking the darkest avsilsble square is always a bad choice.
If you have some degree of knowledge about the target, and know they are somewhat security savvy (but also somehow only have a 4 digit pin protecting this account) then it might be wise to check the pins that would be considered more secure. Or, at least, to perform some data processing on the source data for this graph which culls stupid pins (and remember the ones you cull to add to the end of your brute force approach), and from there continue with the highest probability.
As you said, 4 digits is not enough to make something secure to a computer. 10,000 permutations is milliseconds of computation.The only reason it’s at all secure for a credit card is because you’re generally only using the PIN for in-person transactions where there are more practical limits on attempts (Narrator: “After 2 hours and 632 attempts, the cashier began to get suspicious…”), if not hard cut offs from the bank/processor for failed attempts. If we’re being realistic, as long as your PIN isn’t in the first 3-6 numbers they can try, it’s probably secure enough in itself. Theives want low hanging fruit. Easier to try to social engineer your PIN then to manually brute force it. As long as you’re avoiding the most obvious first attempt numbers, go ahead and use your dog’s birthday or your childhood home’s address. It’s fine.
Honestly, almost any PIN is probably fine so long as you don’t have it written on the back of the card or something. Cards get locked after like 3 failed attempts, so the number itself doesn’t have to be unique or rare.
Hell - even if you gave them the first digit and the thief could eliminate 90 percent of of the remaining numbers based on probabilities, the thief would still have less than a 1:30 chance of getting the right combination before the card was locked.
Here in Australia, post code is also common
