Evaluating the Guessability of 6-Digit PINs under User Bias and Date-of-Birth Leakage

Tóm tắt

Six-digit PIN security cannot be characterized by the nominal -value space or by unconditional entropy alone. This paper presents a fully specified synthetic evaluation of three populations: uniform (M1), survey-calibrated biased (M2), and user-specific date-of-birth linked (M3). The anonymous convenience survey contained 142 responses; one missing strategy response was excluded, one free-text response was recoded, and date-format probabilities were estimated conditionally from 119 applicable responses. Exact population metrics are separated from finite-sample plug-in estimates, and four attacks are evaluated on held-out users across 20 declared seeds. Correct full-support enumeration gives M1 an expected guess number Frequency-Ranked of 500,000.5, Top-10 success whereas reaches 19.833% ± 0.252% against M2. M3 has unconditional entropy  but conditional entropy ; with DOB known, Leakage-Assisted Top-10 success reaches 38.736% ± 0.409%. Thus, population diversity and individual protection are different properties. Blocklist outcomes depend on post-rejection behavior: conditional reselection can reduce global frequency attacks but does not mitigate the modeled DOB-assisted attack, while concentrated workarounds can increase risk. Conclusions are limited to the stated synthetic populations and assumptions; no blocklist size is claimed to be universally optimal.