Security Concern: Lack of Brute-Force Protection After Logout or Sleep

Hello Apple Community,

I recently reported a potential security issue in macOS Sequoia 15.3.2, where there are no brute-force protections after logout or sleep. When I raised this as a bug, I was told:

“The behavior you’re seeing is exactly what we expected.”

However, this creates a serious design flaw that makes brute-force attacks much easier under common usage patterns.

How This Creates a Security Risk

Apple enforces escalating time delays and attempt limits when a Mac starts up, helping prevent brute-force attacks. However, once a user has logged in, these protections are no longer enforced. This means that if a Mac is logged out or put to sleep, an attacker can attempt unlimited passwords without restriction.

This is particularly concerning because most Mac users don’t shut down their devices—we simply close the lid and put the Mac to sleep. In this case, the device is vulnerable to unlimited password attempts. Anyone with physical access to a locked Mac in this state (e.g., in an office, coffee shop, or airport) could use a brute-force method to guess the password without facing any time delays or lockouts.

Apple’s own documentation acknowledges this behavior:

“To help prevent malware from causing permanent data loss by trying to attack the user’s password, these limits aren’t enforced after the user has successfully logged in to the Mac, but they are reimposed after a restart.”

This approach prioritizes preventing accidental user lockouts over preventing unauthorized access, but it also introduces a significant security risk. Since closing the lid or logging out does not reimpose brute-force protections, it effectively allows an attacker to enter unlimited password attempts until the next restart.

If macOS treated logout and sleep the same way it treats a full restart, this vulnerability wouldn’t exist. But in its current state, the Mac is only fully protected against brute-force attacks when it has been restarted, which is not how most people use their devices.

Should Apple Reconsider This as a Security Bug?

Given the security implications, should Apple reconsider this behavior as a bug rather than an intentional design choice? Shouldn’t brute-force protections be reimposed immediately after logout or sleep, rather than only after a restart?

Would it make sense for Apple to introduce a security option allowing users to enable brute-force protections after logout or sleep, similar to how they are enforced at startup?

I’d love to hear what the community thinks about this. Is this something Apple should address, or is there another perspective on why this behavior is acceptable?

[Edited by Moderator]