2020/08/24 by Hassan Khan, Khan, Hassan, Jason Ceci +9
Computer Science · Decision Sciences · Social Sciences · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Human-Computer Interaction (cs.HC) #Personal Information Management and User Behavior #Privacy, Security, and Data Protection #User Authentication and Security Systems
paper · pdf · doi:10.48550/arxiv.2008.10697
openalex publication_date 2020/08/24 · openalex created_date 2022/07/26 · openalex updated_date 2026/07/28
Personal Identification Numbers (PINs) are widely used as an access control\nmechanism for digital assets (e.g., smartphones), financial assets (e.g., ATM\ncards), and physical assets (e.g., locks for garage doors or homes). Using\nsemi-structured interviews (n=35), participants reported on PIN usage for\ndifferent types of assets, including how users choose, share, inherit, and\nreuse PINs, as well as behaviour following the compromise of a PIN. We find\nthat memorability is the most important criterion when choosing a PIN, more so\nthan security or concerns of reuse. Updating or changing a PIN is very\nuncommon, even when a PIN is compromised. Participants reported sharing PINs\nfor one type of asset with acquaintances but inadvertently reused them for\nother assets, thereby subjecting themselves to potential risks. Participants\nalso reported using PINs originally set by previous homeowners for physical\ndevices (e.g., alarm or keypad door entry systems). While aware of the risks of\nnot updating PINs, this did not always deter participants from using inherited\nPINs, as they were often missing instructions on how to update them. %While\naware of the risks of not updating PINs, participants continued using these\nPINs, as they were often missing instructions on how to update them.Given the\nexpected increase in PIN-protected assets (e.g., loyalty cards, smart locks,\nand web apps), we provide suggestions and future research directions to better\nsupport users with multiple digital and non-digital assets and more secure\nhuman-device interaction when utilizing PINs.\n