The problem is that 111111 and 999999 as well as 123456 etc are probably at the top of the list of codes to try before you start iterating brute force.

> Sure, but if your angle of attack is "someone swiped my phone off my desk and wants to unlock it within the next 30 minutes before I wipe it remotely" then 111111 is as good as literally any other 6-digit pin code, unless the attacker just tries 111111. In which case 999999 is probably a better choice.

Asking "How secure is this?" is essentially the same as "What angles of attack would this prevent?" So if your phone is susceptible to a very basic dictionary attack (which is just a codified way of saying "susceptible to educated guesses") then it is not "just as secure as any other code" because there are other passwords which aren't susceptible to this attack.

Note that my post was responding to the claim that it's "just as secure as any other code". It is not.

If you myopically only look at the most basic of attacks, then you can use crap security and it will work for those attacks. But a US Congressman could obviously be a target of sophisticated attackers. And you're literally proposing an attack which would break your proposed password, yet still defending the claim that it's just as secure.

I was just reading someone's comment saying they come to HN because the comments are so good, and I can't say I know what they're talking about. So much uneducated speculation about comments taken out of context is being presented as fact in these comments.