When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad.
Currently we're requiring a six-digit passcode and using a keypad. The thinking is, this is a good compromise between security (six digits is more secure than 4, but less than a longer passphrase) and convenience (tapping on a numberpad is easier and quicker than a keyboard). Since we will be locking the app whenever the user switches to something else, the user will potentially be unlocking the app multiple times during the course of a session.
Are there any studies that illustrate the relative effectiveness of each approach? For example, will most people just choose their normal 4 digit pin and repeat the first or last two digits, thereby making the passcode less secure? Is the advantage of easily tapping on a keypad worth the security tradeoff? If we allow only a four digit passcode (which was requested by our CEO), will most users end up using the same passcode they use for the device, making this extra security completely worthless?
Bottom line, I'm looking for the sweet spot for making an app more secure while not completely crippling the user with difficult security measures.