I'm assuming that this isn't the best practice as the smart but naughty user could loop through all the possible combinations of the PIN code and wait which one will give him true as a response.
This is called a "brute-force" attack. In principle, it is impossible to prevent brute-force attacks. There is simply no way to set up a password scheme that does not allow people to try entering random passwords and see what happens. But you can make it ridiculously hard for someone to work out what anyone else's password is.
This Security.SE answer is the ultimate introduction on how to securely store user passwords, and these PIN numbers are essentially per-folder passwords. I'll try to give you a quick summary of the key points here.
When we talk about storing user passwords in a "cryptographically secure" way, the goals we usually have in mind are:
- Making a brute force attack as hard as possible without unduly inconveniencing legitimate users.
- Making sure there is no "shortcut", i.e. no attack that's more effective than brute force.
I don't know how far you want to go with security for per-folder PINs, but the concrete measures you can take basically amount to:
- If a user enters too many invalid PIN numbers in a row, do not allow any additional attempts for a while. This is a very easy way of preventing the simplest brute force attacks.
- Require longer PIN numbers. Obviously, if you only have four digit PINs, there simply aren't that many different numbers to try, and it's unlikely the rest of the measures on this list would help much with that.
- Next, do not store the actual PIN numbers anywhere. Instead, whenever the user enters a PIN, run it through a tried-and-true password hashing function (PBKDF2, bcrypt or scrypt) on the server, and store only the hash. If someone ever gets access to your database, this ensures they can't simply look up everyone's PIN numbers, or easily derive the PIN numbers from the PIN hashes.
- Then, configure the hashing function to be as slow as possible without inconveniencing your users. The idea is that trying a single password should take half a second rather than a millisecond. Then, if someone manages to dump your database and tries a brute force attack directly on the data (where you have no way of locking them out after too many failures), it will take them an impossibly long time to try every password.
- Finally, add "salts" into the process to combat rainbow tables. I highly doubt you want to go this far, so I won't bother explaining that one.
I suspect that for PIN numbers, the first two steps might be enough for you, but the rest would still improve security. And for real user account passwords, please do go all the way.
Of course, this only deals with the most common threats that we want to protect passwords against. It doesn't do anything about man in the middle attacks or social engineering, for instance. But it probably covers the cases you're worried about.
