Its like 2FA but little easier. It helps in the situation I was mentioning. You have browser saved backend login creditials and you dont want to take 2FA, which is longer, you just enable 4 digit pin. This pin will as opposite to a login is not saved, stored and offered by browser. ANYBODY arrives to a pc when you are AFK (toilet or vacation) this pc in actual situation as it is offers no security at all. One click away from accessing your website is when you access the backend. So INTRUDER can change something, delete something or get some information (superuser is the worst case scenario)
WITH THIS PIN only you know this pin so when you come from toilet/vacation/fly nobody could login (because they dont know your pin) PIN will not be offered as a one click solution fo fill in automatically as creditials use to in modern browsers.
NORMAL LOGIN WILL NOT BE ALTERED BY ANY WAY, you will still have to provide name and password (to get into the backend). Short but secure PIN will be solution.
Just as in bank accounts, have pins to secure your money.
You just provide:
username (saved and prefilled)
password (again saved and prefilled)
and pin (which shows (if its set on) after you click login)
And now banks are using this and sometimes damage website, hoax or content lost can hurt as money stolen.
So now IS this BAD? In PIN option classic login wont be altered, just expanded.
OK so bank
I somehow login from the browser data (europe), and now Im able to send money transfer (bank transfer) to my secret account. I just can do this because after filling transfer details the bank sums things up and asks for pin (which I dont have because im intruder and this is NOT my bank account). This pin is generated from the card reader, you put there your card, visa for example it reads it you enter the number from bank app to a card reader (generated by transaction variety) and this card reader generates a unique pin for your transaction.
This (maybe in future) doesnt go as far as the bank example. Its short rec. 4-6 digit number, which to enter after user provide classy creditials. [] [] [] [] For example like this.
So this can be used:
Recommendation:
variable pin size (4-10 digits for example)
Labels |
Added:
?
|
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-08-12 17:53:31 |
Closed_By | ⇒ | Quy |
The situation you describe is resolved without any pin.
Almost everything you are describing is resolved with TFA and webauthn which are already provided.