1

Considering login security for user logins, I would like an additional option such as a PIN option for all aspects of user login. This seems quite common now across a number of portals out there such as personal banking, social security/gov. tax sites and I would like possibly to offer this as an option to those who do not want to use Facebook, Twitter etc logins which I use on my projects. I appreciate it could simply be an additional field in the system config, but I would be keen to hear any comments on such features, or possibily a popular D7 module which most people use which for me as a Drupal 'plumber' can just drop in for easy of setup, or a generalistic 'how-to'.

Thanks in advance.

|improve this question
  • Would this be one pin across the entire site or a pin per user? And would the pin be the same for the same user (until they changed it) or would it be a "one time use" pin? – greggles Oct 1 '12 at 13:57
  • Preferably the usage would be to have a PIN per user account and not 'one time' but always required. Whilst I would use Captchas for initial registration, I'm keen to impliment additional user login security for user accounts whereby for users to login to their account, they not only have to enter the standard name (email,p/w) but an additional say 4 number PIN. Of course, I'm not sure how this would be overcome if the user was using an open ID or one of the popular social network 'allow' access such as those found in ala FB/Twitter. It's just an idea, I'm curious of the 'plumbing' involved. – Paul B Oct 1 '12 at 14:03
  • I'll research this idea a bit and try to provide some responses soon. – greggles Oct 2 '12 at 17:51
3

Is there an existing "pin" login module?

I'm not aware of any module that does this itself. There are some pin-related modules, but most of them are related to using 2-factor authentication authentication.

Is a pin field actually useful to improve security?

My sense is that adding a pin would not be worth it.

First, pins are easily guessed: this article on commonly used pins shows how only 20 pins would break over 26% of accounts!

Second, if you were to just require the pin to be on the end of the password that actually makes it harder to break than making it a separate field because they would both need to be cracked at the same time rather than serially. That is in addition to the problem above of pins not being well distributed among the 10^4 potential combinations.

Third, you would have to build, audit, and then maintain this additional code for managing per user pins. That's a new database table, some form fields, and at least a few hundred lines of code that can be buggy that overall adds very little extra security.

Alternate improvements to login security

So, I have some other suggestions on how to improve login security in general:

|improve this answer
  • Thank you Greggles, your answer is satisfying. I suppose then it would be good practice to advise others to follow what other good portals do, ensure users use a good combination of characters and not simply name/number combi (ie ben1920). 10 characters for example, bxexnx1x9x. Anyway, you get my drift. My own annoyance is the 'drop down' 4 letter select (post login) some UK banks use!! Thanks again. – Paul B Oct 2 '12 at 20:05
  • I'm not familiar with the dropdown thing you mention. If it is a select list of numbers for entering a pin then that could be focused on preventing a keylogging attack (which happen, but are pretty rare). One thing I'd like to see in Drupal is a "choose my login photo from a group of 20 photos" kind of feature. Those help prevent phishing AND protect against keylogger issues. – greggles Oct 3 '12 at 17:17
  • Having come back to this issue, I then decided that the module: drupal.org/project/security_questions was easier to implement as it also allows users to set their own questions (single or multiple) and given that users can set 'bizarre' questions, it may mean the answer can be of any strange answer related to it's owner. Hope that helps to future readers. – Paul B Aug 26 '15 at 10:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.