User Behaviour in Choosing PIN Codes for FIDO2 Security Keys: An Empirical Study and a Market Research

This academic paper presents the results of an empirical study conducted to investigate user behaviour when choosing Personal Identification Numbers (PIN codes) for FIDO2 security keys. The study was carried out in a medium-sized organization, wherein 40 % of the deployed security keys were found to have simple, easily guessable PIN codes. The research explores the factors influencing PIN code choices and offers insights into improving security practices for FIDO2 authentication. Additionally, the paper provides an analysis of PIN code complexity rules implemented by Token2, a notable FIDO2 key manufacturer, and compares them to a competitor's FIPS series, highlighting the significance of enhanced PIN code security.