That sounds unsafe to me. Quick, yes, but risky. Spending your coins by just providing, say, the last 3 characters of your password makes it much easier for anyone to sneak a peek at them while you're on it, steal your phone away, and drain your wallet.
For quicker spending, I agree with bitmover; facial recognition, fingerprint, or retina scanning are much safer.
You don't get the idea. It should be possible only once. If after the attempt the last 3 characters of your password are wrong, the master key is wiped from the memory and you have to retype the whole password again.
If that still sounds too unsafe, the user should have an ability to hide how many last characters of the password should be used and change the numbers of characters needed.
Look at Keepass2Android. It's beautifully implemented here.
It is important especially on mobile devices, for whom wallets don't provide a decent security (only an easy-to-crack 6 digit PIN).
The idea behind a 4 or 6 digit pin is that after X wrong tries, the app is either locked and requires a different (longer) password or the whole content is erased.
Obviously 10
4 or 10
6 possibilities is not much to bruteforce. But the fact that you only have 5/10/15 attempts is the key.
With 15 attempts and 1.000.000 possibilities, you won't be successful unless a stupid pin (e.g. 123456) is chosen.
Sensitive information also is not encrypted using that pin. The pin is used to access the encryption/decryption key. So simply gaining access to the wallet file and bruteforcing it on another device does not work.
And the encryption/decryption key usually is stored in a secure place (ios: secure enclave; android: keychain). Both are hardware backed storages for key material.
So, even with a 4-6 digit pin, it isn't simply possible to bruteforce your way into a wallet, assuming the implementation is done correctly.
True, although PIN could be replaced with quick unlock which uses X last characters of the password. And it should allow you only for one attempt before you'll have to provide a full password again.
It's harder to figure out last 3 characters of a password or more in comparison to PIN, and especially as you have only one attempt, this shouldn't break the security of your BTC.
Last 3 chars to spend money? Looks like brute force could get easier then. If someone can get a copy of your wallet and there's a tickbox saying 'quick unlock', it won't take that long before your funds are gone.
It should allow only
one attempt before the user would have to provide a full password again. And if you find yourself in danger, you should be able to quickly close your wallet so you need to enter a full password again.
