In Secrets and Lies, Bruce Schneier writes:
Many keys are generated from passwords or passphrases. A system that accepts 10-character ASCII passwords might require 80 bits to represent, but has much less than 80 bits of entropy. [...] This is why it is laughable when companies like Microsoft tout 128-bit encryption and then base the key on the password. (This describes pretty much all of Windows NT security.) The algorithms they use might accept a 128-bit key, but the entropy in the password is far, far less. In fact, it doesn't matter how good the cryptography is or what the key length is; weak passwords will break this system.
As I understand, things such as Windows' file encryption (not BitLocker, but the actual encryption of individual files on a machine which doesn't necessarily have TPM) are based on user's password and probably something else, stored on disk. If an attacker gains access to the hard disk, he won't be able to read encrypted files, because he doesn't know the password.
The security will be good if the user have chosen a passphrase. If the user has a poorly chosen password, the attacker would be able to brute force the encrypted data and gain access within days or weeks.
Now, with Windows 10, Microsoft is promoting the usage of PINs instead of passwords:
Create a PIN to use in place of passwords. Having a PIN makes it easier to sign in to your device, apps and services.
But doesn't it invalidate all the security? As I imagine, it would take seconds to bruteforce data encrypted with a four-digits PIN.
Am I missing something and there is something else which protects the users? Or the PIN feature targets users who think that they don't need any security and won't encrypt their files anyway?