PIN generation and vulnerable PINs

Hi @stmorrpom6cenz,

I'm sure I either read or heard Troy Hunt say something about populating the database with every permutation of a certain PIN length but I can't find the source or how many digits it was going to apply to. So it could be anything from every permutation for both 4 and 6 digit PINs are present to I've made the entire thing up in my head and who knows how I managed to dream it.

It's a tricky line to tread. If I use the Password Generator infinite times to generate an 8 character password then at some point it will generate the word peekaboo and should that happen I want that rare event to be discarded for the reasons you mention. There will be a few other 8 character long passwords that it also applies to. These should be quite rare though given all the combinations possible. With a 6 digit PIN the combinations are exactly 000000-999999 or 1,000,000 combinations. It's just a pathetically low number. If we eliminate every combination seen we would likely seriously reduce the entropy and if somebody were to either know, guess or assume the use of 1Password they could eliminate large sections of the search space when trying to guess your PIN. Sometimes what seems intuitive doesn't work with the maths involved.

There was a book on the history of cryptography that I enjoyed sufficiently that I've probably read it at least three times now and in the part that documented World War II and the Enigma machine one of the tricks used to help defeat the encryption by breaking the current code was that certain rules had been put in place, you weren't allowed to transpose two characters next to each other on the keyboard. Somebody thought it made things more secure but it was a rule that reduced the search space the encryption breakers needed to consider. My memory could be a bit faulty but essentially various tricks were used to reduce the search space and then what was left was small enough that brute force was used against it.

That isn't to say that if a certain combination, say 1111 or 1234 is used so often that you need to avoid it just because but the presence of certain combinations may be present but seen so infrequently that their presence in HIBP doesn't mean they shouldn't be considered as still valid if a service is going to make the bad move of limiting the thing you know to a 6 digit PIN. I can only comment on 1Password for Mac at the moment but basically all 6 digit codes receive an equally harsh critique of their strength but when I test certain ones meter tanks as a result. It could be whatever list we use may need to be updated but eliminating every permutation in HIBP may not leave enough options.