• Off Topic

  • Best screen lock password practices for all the devices and operating systems

If anyone is interested in getting more quantitative about password strength, I recommend checking out information about using the "entropy" of a given passphrase to measure its difficulty to crack:
https://en.wikipedia.org/wiki/Password_strength#Entropy_as_a_measure_of_password_strength

In general, many prefer diceware passwords because they offer a good balance between memorability and entropy. Surprisingly, this often enables stronger passwords than what you could typically achieve with a "random" string of letters, number, and symbols as some typically suggest.
(relevant - https://xkcd.com/936/ )
IMO, the EFF is a trusted resource with good tools for making your own diceware passwords:
https://www.eff.org/dice
You might consider the "mind palace" method to be a best practice for memorizing diceware passwords:
https://en.wikipedia.org/wiki/Method_of_loci

How much entropy do you need?
Depends on threat model. You'd need to first estimate how big of a (super)computer your threat actor has and how much time they would reasonably spend running that (super)computer to brute force it. There are also other considerations that are OS-specific like BFU/AFU, etc.

Wikipedia suggests that people with the most extreme threat models choose entropies of 256+
https://en.wikipedia.org/wiki/Key_size#Brute-force_attack

Maybe others have better rules of thumb for this?

Some of the discussion on this thread seems relevant here:
https://discuss.grapheneos.org/d/4997-police-took-my-pixel-6a-and-iphone-12-pro

[deleted] The best practice is a password of between 15 and 20 characters.

You need at least 90 bits of entropy for an unbreakable password, which is 7 random diceware words or 18 random letters and numbers, which both have over 90 bits of entropy.

[deleted] Android and iOS can't be compared to Windows or other systems, because they contain a Titan or SE chip and have their own clocks.

I know, that's why I'm asking.

GrapheneLover In any case where you value your security it is best to use a password of more than 32 characters with numbers, letters, and symbols with and without dictionary words in it. If you truly value your security do not use a pincode.

That's not correct at all. I already mentioned above that unbreakable password is considered 90 bits, which is 7 random diceware words or 18 random letters and numbers.

The part about not using a PIN is incorrect too. Pixel devices with GrapheneOS have aggressive throttling which makes 6 digits pin code unbreakable unless someone has an exploit that could bypass Weaver throttling.

For anyone who has found such an exploit, Google would pay a stupid amount of money which means that countless people that want that cash are looking for a way to exploit this and even Google has security researchers behind this.

Conclusion: nobody will ever use such exploit on you and almost all of us.

BackdoorsNRats My lawyer told me you need at least a 10 digit PIN or they will be able to crack it. This was 2 years ago though. EU country.

This is if they bypassed Weaver throttling.

BackdoorsNRats A friend of mine used pattern-lock and they had no problems unlocking it.

Pattern unlock is such a garbage way to secure your phone that GrapheneOS has even removed it as an option.

BackdoorsNRats I also know fingerprint/face scan is easily breached with the right tools.

That's true, but biometrics are necessary, not only they're much faster and convenient, but they allow you to securely unlock your phone even in a place where your password could be recorded by a security camera or where someone could see it over your shoulder.

One cool upcoming feature to GrapheneOS is an ability to have 2FA for fingerprint unlock, which means that you can set a secure seven word diceware passphrase for your main unlocking method and then setup biometrics with a combination of short PIN as a 2FA.

                I still stand by what I said and if you actually had a high threat level you would know what I said is true. I stand by the recommendation of using a password or passphrase longer than 32 characters with symbols, letters, and numbers. You can use a simple pin code all you want and believe in the secure elements but if you truly care about your security you would opt for what I said without a doubt.

                  GrapheneLover It's like saying that if you truly care about your privacy and security you need to use Whonix in Qubes and nothing less, LMAO.

                  Believe in whatever you want, but don't make people believe that they need this to be secure, that's just harmful.

                      Graphene18 Definitely not harmful at all, what you're saying is infact harmful telling people to use a simple six digit pin is harmful as we are talking about high threat levels, if you are some average everyday user who just uses social media and such sure go ahead and use a 6 digit pincode. If you are someone who has stuff they don't want to lose or a high networth individual or someone who has things that they would get hurt over if found out, opt for a 32+ alphanumeric password or passphrase. I am talking with experience. If you had such a really high threat level and the people wanted you your silly 6 digit pincode would get bypassed one way or another.

                        GrapheneLover 128 bits of entropy is the absolute maximum overkill of what's even reasonable to use and that's what's used for designing encryption algorithms and your recommendation is 210 bits. So yeah, I have nothing more to add.

                          Graphene18

                          Thanks for a well written, quality post.

                          I agree that pattern unlock is used by 50iq people. Some people need to learn the hard way.

                          I also do agree with biometrics being a really good QoL-improvement because of the simplicity it brings.

                          However, I do disagree with your standpoint it should be used (im assuming this is that you think based on your post). It's too easy to compromise through exploits or force. Use the built-in PIN scrambler instead. Be aware of your surroudings to not have a camera being close enough to see the numbers you type. Thanks to the scrambler, as long as it can ser your screen in high res, no way you can get the passcode by watching where you press on screen.

                          Imo, its a big security risk to use biometrics and I would advice everyone to not use it.

                          With that out of the way I also want to say thanks for input and after your post I have upgraded my passcode from 12 digits to 18.

                          Cheers mate!

                              BackdoorsNRats However, I do disagree with your standpoint it should be used (im assuming this is that you think based on your post). It's too easy to compromise through exploits or force. Use the built-in PIN scrambler instead. Be aware of your surroudings to not have a camera being close enough to see the numbers you type. Thanks to the scrambler, as long as it can ser your screen in high res, no way you can get the passcode by watching where you press on screen.

                              Imo, its a big security risk to use biometrics and I would advice everyone to not use it.

                              GrapheneOS only gives 5 attempts for unlocking with biometrics, so it's more secure than any other phone or OS.

                              BackdoorsNRats With that out of the way I also want to say thanks for input and after your post I have upgraded my passcode from 12 digits to 18.

                              You should use a 6 digit passcode.

                              You need a password that consists of 18 random letters and numbers for it to be unbreakable, not the 18 numbers passcode.

                                    Graphene18

                                    10 digits was good enough few years back so Id guess 18 should do it now.

                                    But ill take your advice to heart and change. You seem reasonable and knowledgeable so ill listen to your advice.

                                    Also, didnt know this about GrapheneOS and biometrics and for sure that makes it much better.

                                      • [deleted]

                                      • Post #16
                                      • Edited

                                      Graphene18 A password between 15 and 20 characters is currently unbreakable. If you add to this a physical security element like Google's titan, you won't be able to unlock your phone by any means, even unlimited.

                                        Are we talking about screen locking? In that case, I use a 10 digit PIN but I am planning to make it 20

                                          [deleted]
                                          I think that bitwarden tool assumes full alphanumeric+symbols keyspace, not a numeric-only PIN. So it's estimated crack time is not accurate for PINs.
                                          Also, if the secure element is bypassed, then there is no "Standard delays for encryption key derivation enforced by the secure element". Which means brute force can happen at very fast speeds. All numeric-only PINs, would be insecure. Which is why it is recommended to have full alphanumeric passphrases if the secure element may be bypassed (such as for high threat nation state adversaries).
                                          https://discuss.grapheneos.org/d/4727-graykey-countermeasures/2

                                          matchboxbananasynergy you can use a 18 character password comprised of lowercase letters and numbers, or a 7 word diceware passphrase, which is strong enough to not have to rely on the secure element

                                          And as always, any estimates for crack time, also assume that it is random!!! If you choose something personal or easy to remember phrases (songs, quotes, etc.)... then expect the cracking process to front load those and you might expect it to be cracked in a small fraction of the time.