A tiny number of digits combined with the standard, visible input system is a recipe for 'shoulder surfing' attacks. I'm not proposing a superior system, just pointing out that brute-force attacks are not the only thing to beware.