[Feature Request] Implement rate-limiting for PIN attempts #1395

New Issue

MrUnknownDE · 2026-04-05T19:20:04+02:00

MrUnknownDE commented

2026-04-05 19:20:04 +02:00

Originally created by @kmanwar89 on 6/6/2025

Pangolin allows an optional 6-digit PIN for authenticating through SSO. Modern hardware and GPU's can crack 6-digits (100000 values) in mere seconds. From ChatGPT:

Here are some estimated cracking times for a 6-digit numerical PIN using modern hardware:

CPU:
Intel Core i9-11900K: around **10-30 seconds** to crack the PIN (using brute-force algorithms)
AMD Ryzen Threadripper 3970X: around **15-45 seconds** to crack the PIN

GPU:
NVIDIA GeForce RTX 3080 Ti: around **1-3 seconds to crack the PIN** (using GPU-accelerated cryptanalysis tools)
AMD Radeon Instinct MI60: around **2-6 seconds to crack the PIN**

Is it possible to implement rate-limiting within Pangolin to prevent these types of brute-force attacks? It would need to be aggressive, to the point that 2 or more failures results in a significant cooldown to prevent modern hardware from cracking it.

The alternative could be to allow special characters, pair the PIN with a 2FA of some sort, or eliminate the PIN altogether. Curious on what the developer's thoughts are on this, thanks!

*Originally created by @kmanwar89 on 6/6/2025* Pangolin allows an optional 6-digit PIN for authenticating through SSO. Modern hardware and GPU's can crack 6-digits (100000 values) in mere seconds. From ChatGPT: ``` Here are some estimated cracking times for a 6-digit numerical PIN using modern hardware: CPU: Intel Core i9-11900K: around **10-30 seconds** to crack the PIN (using brute-force algorithms) AMD Ryzen Threadripper 3970X: around **15-45 seconds** to crack the PIN GPU: NVIDIA GeForce RTX 3080 Ti: around **1-3 seconds to crack the PIN** (using GPU-accelerated cryptanalysis tools) AMD Radeon Instinct MI60: around **2-6 seconds to crack the PIN** ``` Is it possible to implement rate-limiting within Pangolin to prevent these types of brute-force attacks? It would need to be aggressive, to the point that 2 or more failures results in a significant cooldown to prevent modern hardware from cracking it. The alternative could be to allow special characters, pair the PIN with a 2FA of some sort, or eliminate the PIN altogether. Curious on what the developer's thoughts are on this, thanks!

MrUnknownDE closed this issue

2026-04-05 19:20:04 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1395