I'm in the process of designing an app that allows users to sign in via a personal identification number (PIN) code. I'm curious to know why a typical pin code usually contains four numbers, and why this is common practice?
-
3I see you have an answer, but I suspect you weren't asking about Postal Index Numbers. Am I correct in reading your question as referring to a Personal Identification Number on used on mobile phones? Either way, please clarify your question.– MonomeethCommented May 20, 2016 at 11:49
-
Yes, I was referring to a Personal Identification Number. The type you might find on a mobile app for a financial institution, or what you would enter into an ATM before withdrawing cash.– user47821Commented May 22, 2016 at 22:56
Add a comment
|
4 Answers
Quite an user experience question, where technology development had to adapt to real life experience, in this case the inventor's wife experience
The standard, ISO 9564-1, allows for PINs from four up to twelve digits. The inventor of the ATM, John Shepherd-Barron, had at first envisioned a six-digit numeric code, but his wife could only remember four digits, and that has became the most commonly used length in many places, although banks in Switzerland and many other countries require a six-digit PIN .
While the UX aspect of the question is important, there is a security question hidden within: how can a 4 digit PIN be secure enough to protect my money?
The answer is that a PIN must be tested while it's connected to a secure system, and the secure system needs to limit how many times it can be tested and then disable it.
If the PIN is not being checked by a secure system, there is no security. You could simply type every number from 0000-9999 in just a few hours (or a computer can try them all in a few microseconds.) Eventually, you'll gain access.
If the PIN is being checked by a secure system, the secure system can give the user three tries and then lock the account from PIN access. This means the chances of guessing the right PIN are fairly low, which is the risk the system owners take (assuming the user doesn't choose '1234', or their birthday, of course.)
There are many variations on this theme, of course, and many vulnerabilities and weaknesses associated with various implementations of it. But the primary security feature is that a limited number of guesses are allowed and then access is denied.
If you think wider around the world - the digits vary. In India we have 6 digit pincode, in US some states have 5 digits and other may have different.
ZIP codes were only first introduced in the 1960s with the introduction of new automated address reading machines. With rapid post-war growth across the country and the increasing volume of mail (which doubled between 1942 and 1962 from 33 billion to 66 billion pieces annually
https://www.policymap.com/blog/2013/04/tips-on-zips-part-ii-a-brief-history-us-postal-codes/
Read more here: https://en.wikipedia.org/wiki/Postal_code
The PIN Code system was introduced on 15 August 1972 by Mr.Shriram Bhikaji Velankar.[2][3] The system was introduced to simplify the manual sorting and delivery of mail by eliminating confusion over incorrect addresses, similar place names and different languages used by the public
-
1I think you confused PIN with something else. I believe the OP referred to PINs used for credit cards and security– yitzihCommented May 25, 2018 at 15:58
Credit card PIN is an example of two factor security. "Something you have and something you know". A PIN is useless without the card. With the card but no PIN you cannot brute-force it. Three wrong guesses then use of the card is blocked.
A PIN is not a secure password. But in the hands of Joe Public no password will be anything like secure 90+% of the time. 2-factor is better.
