If a device uses full disk encryption such as LUKS, BitLocker (with a pin), Veracrypt and others and boots using a complex password, what is the need for complex passwords to log into the operating system thereafter and why?
There are a few reasons why you'd still want complex passwords, though, they're all a little situational.
- Local access or theft of your machine while it's on (or in sleep mode) but locked. A bigger problem for laptops or workstations in open offices/public areas, especially if you don't disable normal sleep and go straight to hibernate.
- Remote access via password (RDP, SMB, various RPC / remoting systems on Windows; SSH or VNC / Screen Share or similar on others). Obviously not an issue if remote access is disabled, public-key only, or enabled only for specific accounts that do have strong passwords.
- Combined with a TPM for defense-in-depth if your FDE key/password is compromised; the thief still wouldn't be able to mount offline attacks without the TPM, and still wouldn't be able to mount online attacks (aside from things like freezing the RAM to extract the master key) without running into the OS anti-brute-forcing protection.
- Defense in depth (in the case the FDE is either bypassed via an online attack or similar, or totally compromised) for data encrypted with EFS or DPAPI (including Credential Vault and saved private keys) on Windows, for Keychain on Mac (assuming your Keychain password is different from your FileVault password; by default they're both the same as your login password), and of course for SSH, GPG, and KWallet/Gnome Wallet/etc. keys on Linux (which aren't tied to your login password but should still be secure).
Yes all passwords should have a standard that enforces a high level of entropy. If not for any other reasons than these two things:
Contributing toward the randomness of the password hash via the source password, and secondly the principle of defense in depth. It is foolish to rely on single layers of defense against compromise. In fact I would argue that surrounding a security layer with weakly configured layers in fact weakens that layer as well. Thinking of a chain with weak links here, and the cumulative strength being compromised, where the strength of the chain is determined by the links, inversely the strength of each link is determined by the chain.