Hacker News Reader

Maybe the simplest conclusion is that PIN isn't really any secure method. It's somewhat good for keeping most normal people away under normal circumstances. But if you really need to keep things secure than I have a hard time seeing that PIN is o way to go? I mean, passwords are not super good, and PINs (short anyway) are easy worse. There's a reason 2-factor auth exists after all...

View on HN

"Really keeping things secure" has a lot of definitions. If your threat model is some guy on the other half of the planet half-heartedly trying out leaked passwords, 2FA is great. If your threat model is someone local specifically targeting you, 2FA kinda sucks, while a good password might do the trick. If your threat model is you getting abducted and hit with a wrench, then you should probably make some sort of shared key with multiple people where you need x% of all parts + invest if physical security.

We built an open source platform (qbix.com/platform) to power social apps and security was a major consideration. By default we encourage a user to type a pass phrase and give them suggestions based on {{possessivePronoun}} {{noun}} {{very}} {{possessivePronoun}} {{noun}}

But they can also attach another source, such as inputting an api key to NewsAPI and then to generate each suggestion we take a random news article and take three consecutive words from that article.

Reply on news.ycombinator.com