Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Windows 8 allows me to log in with my Microsoft Account username and password.

But Windows 8 also lets me setup a 4 digit pin. It also lets me setup a three gesture touch password. These are super-easier than typing my full password (esp on a touch device).

That made me wonder. Are they secure?

share|improve this question

closed as not constructive by Shinrai, Tom Wijsman, Canadian Luke, Indrek, Xavierjazz Oct 22 '12 at 17:40

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Less and less possible characters will always be less secure than a longer password, the Gesture Touch password on the other hand allows more possibly combinations but has the downside that people can watch you do it on your screen. Nothing is as secure as a long password with non-usual characters which are hard to crack, even with GPU power. –  Tom Wijsman Oct 22 '12 at 17:03
    
This is actually relevant to a current event. It is shown that when using PIN or picture pass, the original password is simply unlocked. See arstechnica.com/security/2012/10/… –  Henning Klevjer Oct 22 '12 at 19:30
add comment

1 Answer

That made me wonder. Are they secure?

What makes anything secure? The same attacks that can be used to your traditional windows password can be used against the gesture and pin password. In addition to those traditional attacks if an attacker has physical access to the machine, they can use additional attacks ( i.e. brute force by smudges ) on your gesture password, in the end your still secure.

Once somebody has physical access to your machine any number of attacks can be performed, including yanking out the hdd, and reading the data on another machine.

Your Windows Account ( i.e. msn, hotmail, outlook ) still requires a traditional password to be accessed.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.