A personal identification number (PIN) is a numeric value that is used in certain systems to gain access, and authenticate. PINs are a type of password. Ignorance of the expansion of the acronym often leads to the erroneous usage PIN number, in which the accidental repetition of the final word is sometimes referred to as RAS syndrome.

PINs are (ideally) only known by the person whose PIN it is, and are sufficiently hard to guess. The PIN should be such that a person or computer cannot guess it in sufficient time by using a guess and check method, where it guesses the PIN, and checks for correctness by testing it on the system that the person is attempting to gain access to.

PINs are most often used for ATMs. Throughout Europe the traditional in-store credit card signing process is being replaced with a 'Chip and PIN' system, where the customer is asked to enter their PIN code instead of signing. They are also sometimes used for online systems instead of alphanumeric passwords, which may compromise security. (See password for more details)

Most commonly PINs are 4-digit numbers in the range 0000-9999 resulting in 10,000 possible numbers, so that an attacker would need to guess an average of 5000 times to get the correct PIN.

In 2002 two PhD students at Cambridge University, Piotr Zielinski and Mike Bond , discovered a security flaw in the PIN generation system of the IBM 3624 , which was duplicated in most later hardware. Known as the decimalization table attack , the flaw would allow someone who has access to a bank's computer system to determine the PIN for an ATM card in an average of 15 guesses. [1] [2]

See also

• TAN
• Personal Unlocking Code