2025.11.1 Release Notes

[grb]

@kpiris

In that case, a PIN consisting of 3 words (39 bits of entropy), IMO, would be way more than enough to be safe.

See the thread linked below for a quantitative approach to choosing a security key PIN length/complexity:

YubiKey Login PSA: Set a strong PIN!

With passkeys becoming more prevalent, and with the ability to store passkeys on hardware security keys (e.g., YubiKeys) for passwordless login, it is imperative to set a strong FIDO2 PIN on your security keys. Otherwise, someone who has stolen or found one of your security keys may be able to brute-force guess the PIN, which would reveal information about what accounts can be accessed with the key (see screenshot below): [image]   Thus, if you are using a security key for passwordless login…