2

Is using a numeric password (similar to a PIN code on a phone) on Macs reasonable for regular users, considering they are the norm for passcodes on iOS devices?

Traditionally user accounts on Macs have been expected to use passwords which include letters, digits and other characters, to make the password harder to guess and find using brute force techniques. However, while you can use such passcodes on iOS devices too, Apple seems fine with most users using numeric passcodes on their iOS devices. So would it be reasonable for a regular user to also use a numeric password on their Mac?

To make it clear, this question concerns regular everyday users that want to make a reasonable trade-off between convenience and security — not a user that wants to maximize security.

Improve this question
2
  • The reason why you may have lower security requirements on your phone than on your PC is because you usually have less sensitive data on your phone than on your PC. Plus, if you lose your phone, there is a pretty good chance that you can wipe it remotely, whereas you usually rarely lose your PC.
    – user163495
    Mar 19, 2020 at 22:19
  • @MechMK1 That is an interesting point, and probably was valid at some point in time with less capable phone devices. Although nowadays with smartphones, and cloud services like iCloud synchronizing data across all devices of a user, you could argue many regular people have their most sensitive data also on their phones.
    – Markus Miller
    Apr 1, 2020 at 15:42

1 Answer 1

Reset to default
1

The security requirements for passwords are independent from the operating system. It's the same for iOS as for any other operating system, because the usual attack vectors are the same.

There are best-practices available for what is considered state-of-the-art password strength. Normally, I would link to one of the standards here, but for a private user like you describe yourself, a simple guideline of 10 characters with a good mixture of letters, numbers and special characters will suffice to be on the safe side.

If you want to follow those guidelines, depends on your risk appetite. If you rather run the risk of getting compromised to avoid entering a more complex password, that's up to you. Companies may be bound to regulations and have to be compliant to certain standards. As an individual, you are free to decide how insecure you dare to be. But please, just for a minute, imagine how it would make you feel, if someone breaks into your system, gets access to all your data, monitors everything you do 24/7 or destroys all your data. Is usability still worth using a weak password? If it is, go ahead, no one is stopping you.

Having said that, limiting yourself to just numbers isn't necessarily bad, if you choose a long enough pass code. A 20 digit number is stronger than a password that uses an alphabet of 60 characters (upper and lower + some special chars) with only 10 characters. You can calculate it yourself, the number of potential passwords is simply the size of the alphabet to the power of password length.

Improve this answer
1
  • A windows device with on-device PIN seems to think 6-digit is secure enough -- probably because there are wrong-guess limitations in Hello hardware? Is there a substantive difference between macOS device password, and windows PIN? (maybe related to disk encryption?)
    – Carl Walsh
    Feb 28, 2022 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .