Diceware passphrase for device unlock

[deleted]

Is a 4 word diceware passphrase good enough or should I opt for 6?

matchboxbananasynergy

If you are using a diceware passphrase in order to avoid having to rely on the secure element's throttling, you should opt for at least a 7 word diceware passphrase. Alternatively a ₁₈ character password comprised of lowercase letters and numbers will do.

[deleted]

matchboxbananasynergy Does this mean that using a 6-digit pin would be the same as using the 4 or 6 word diceware passphrase as both rely on the secure element's throttling?

Edit: If this is true, does the same apply to other devices like Apple silicon macbooks?

other8026

[deleted]

A six digit PIN is nowhere close to a 4 word diceware passphrase. The reason is each PIN digit has 10 possibilities, whereas a single diceware word would be picked out of a pool of 7776 words (roll five dice to get a word).

So, considering that, a 6 digit PIN would have 10⁶ (1,000,000) total different combinations, but a 4 word diceware password would have 7776⁴ (3,656,158,440,062,976) different combinations, and that's not even with adding extra stuff like special characters or capital letters.

When throttling is taken into consideration, a 6 digit PIN can be considered to be "good enough," whereas a 4+ word diceware password might be considered "overkill."