Exercise 3: Why "4 Digits Is Weaker Than My Long Password" Misses the Point — Possible Solution ==================================================================== WHAT THE COLLEAGUE'S REASONING ASSUMES ------------------------------ The argument treats a PIN and a password as the same kind of secret, differing only in length and character complexity - on that assumption, a short numeric PIN really would look strictly weaker than a long, complex password. WHY THAT ASSUMPTION IS WRONG, PER THIS CHAPTER ------------------------------ Per this chapter, "a Windows Hello PIN is not simply 'a shorter, weaker password.' It's bound to the specific device via a TPM-backed asymmetric key pair - the PIN itself never leaves the machine and is never transmitted anywhere, unlike a password, which is what actually gets sent to (and potentially phished or reused across) a remote service." A password's strength has to compensate for genuine risks a PIN doesn't share in the first place: it can be intercepted in transit, phished via a fake login page, reused across multiple sites, or leaked from a breached server's own credential database. A PIN is never transmitted anywhere and never touches a remote server at all - none of those attack paths apply to it. WHY DEVICE-BINDING IS THE KEY STRUCTURAL DIFFERENCE ------------------------------ Per this chapter, "a leaked PIN from one device is useless on any other device, since there's no matching private key anywhere else to pair it with." Even if someone learned this exact 4-digit PIN, it would do them no good on any other machine - there's no account-wide secret being guessed, unlike a reused password, where learning it once can compromise every account or device that password was used on. WHY THE COMPARISON THE COLLEAGUE IS MAKING ISN'T APPLES-TO-APPLES ------------------------------ The colleague is comparing PIN length to password length as if both secrets face the same threat model. In reality they face genuinely different threats: password strength matters because passwords are transmittable and reusable; PIN "strength" matters far less because a PIN is neither transmitted nor reusable beyond the one device it's bound to. Judging a PIN's security purely by digit count ignores the specific protection - TPM device-binding - that makes brute-force digit-guessing largely irrelevant to begin with. WHY THIS WORKS AS AN ANSWER ------------------------------ It names the flawed like-for-like assumption in the colleague's argument, cites this chapter's own explanation of the PIN's TPM-bound, non-transmittable nature as the actual structural difference, and explains specifically why comparing raw length/complexity between a PIN and a password ignores the different threat models each one actually faces.