Adding Additional login security Considering login security for user logins, I would like an additional option such as a PIN option for all aspects of user login. This seems quite common now across a number of portals out there such as personal banking, social security/gov. tax sites and I would like possibly to offer this as an option to those who do not want to use Facebook, Twitter etc logins which I use on my projects. I appreciate it could simply be an additional field in the system config, but I would be keen to hear any comments on such features, or possibily a popular D7 module which most people use which for me as a Drupal 'plumber' can just drop in for easy of setup, or a generalistic 'how-to'.

Thanks in advance.
Is there an existing "pin" login module?

I'm not aware of any module that does this itself. There are some pin-related modules, but most of them are related to using 2-factor authentication authentication.

Is a pin field actually useful to improve security?

My sense is that adding a pin would not be worth it. 

First, pins are easily guessed: this article on commonly used pins shows how only 20 pins would break over 26% of accounts!

Second, if you were to just require the pin to be on the end of the password that actually makes it harder to break than making it a separate field because they would both need to be cracked at the same time rather than serially. That is in addition to the problem above of pins not being well distributed among the 10^4 potential combinations.

Third, you would have to build, audit, and then maintain this additional code for managing per user pins. That's a new database table, some form fields, and at least a few hundred lines of code that can be buggy that overall adds very little extra security.

Alternate improvements to login security

So, I have some other suggestions on how to improve login security in general:


Security Review offers brute force detection.
You could use one of the 2-factor authentication modules. My favorite way to do that is the tfa module which is the module deployed on drupal.org.
You could use a module to improve true password strength (vs. password policies that usually promote nonsense).