@thealex sorry, indeed I was a bit blunt on that comment, didn't mean to offend.

That kind of access is due to the fact that you can access the shell without any assistance. Yes, it's easier, but just because it's not as easy to do it on other platforms, doesn't mean it's a bad feature.

You can do it on Windows, for instance, by going into safe mode. It allows you to login to the usually disabled root account. And it takes the same time!

That's just security through obscurity. If you know how to do it, why would other barriers (like having to boot from a USB) be placed?

FileVault was actually a default option between 2 versions (and then got disabled again because users complained about performance and losing files when forgetting the password).

Users should be educated, encryption should be on by default if you set a password, just like it is on the mobile platforms (iOS and Android).

Well, if your partition is not encrypted (e.g. using FileVault) then any low level code will be able to access the contents of the filesystem, ignoring user permissions.

Not having the disk encrypted is always subject to other attack vectors such as removing the disk and connecting it to another machine, or booting your Mac (or PC) with an USB drive with a live os to copy whatever.

But I guess it's easier to blindly bash a company. ¯\_(ツ)_/¯

Passwords shouldn't have an upper limit (apart from server limitations, where 64-255 seems like a reasonable value) since they are supposed to be hashed and salted and end up having a static length anyway.

That restriction screams of bad security practices. :)