"The Same PIN, Just Longer": On the (In)Security of Upgrading PINs from 4 to 6 Digits