20

I’ve seen multiple sources online that say that unlock patterns are less safe than ‘random’ PINs. I was thinking; how come? From what I see, they would both be just as secure; you chose different points on a grid, in a certain order, and then it’ll unlock your phone. They just seem different visually. I also understand that it might be easier to see a pattern through marks on a phone screen, but ignoring that, I don’t understand why anything would change.

Is there something I’m getting wrong here?

Improve this question
4
  • 6
    As a pattern has to be drawable in one screen in one flow therefore the probability for the next field is not equal for all possible positions of the pattern (e.g. the same position twice is not possible and neighboring positions as successor are more likely). Therefore it can be guessed easier.
    – Robert
    Mar 23, 2022 at 12:50
  • @Robert I guess that would lower the amount of combinations, but still, people tend to say it’s a lot less secure, while I’m not sure if it’s that big of a difference
    – Buzzyy
    Mar 23, 2022 at 13:01
  • 3
    There are other aspects to pattern security than just the number of combinations. Deriving more probable patterns is, in theory, easier via social engineering and simple psychology (for example, letters, numbers, and common symbols like spirals and arrows are generally more common than abstract patterns because they have meaning), and people who don’t regularly clean their screens will usually have smudges pretty directly showing the pattern.
    – Austin Hemmelgarn
    Mar 24, 2022 at 1:39
  • 1
    @AustinHemmelgarn The same can be said for pins, though. 1234 alone was at about 11% of chosen PINs.
    – Jason C
    Mar 25, 2022 at 15:01

2 Answers 2

Reset to default
43

With a PIN, each digit has 10 possibilities, so the total possibilities for N digits is 10^N. With a pattern, each position has at most 8 possibilities (center), or only 5 possibilities (side) if the last one was in the center. Computing the total possibilities is much trickier here, because if you're always returning to the center to get more options then each "return to center" adds no meaningful entropy at all, but it's easy to compute an upper bound: 8^(N/2) * 5^(N/2). In practice a pattern will be worse that that upper bound, though.

For N=4, PIN has 10,000 possibilities; pattern has 1,600 (16% as many). For N=6, PIN has 1,000,000 possibilities; pattern has 64,000 (6.4% as many). And remember that the patterns will in practice be worse than that.

Furthermore, it may be easier to deduce the unlock pattern from viewing screen smudges. Sometimes the screen area where the PIN pad / swipe pattern is displayed doesn't get used after unlocking, and if the screen was clean enough before, you can figure out a lot. With a PIN, you might figure out the set of numbers used (which will drastically lower the possibilities), but won't know the order. With a pattern, you might literally be able to deduce the entire pattern at a glance (it's possible to tell where a pattern starts and ends, because the fingerprint at the endpoint is less smudged).

EDIT: Thank you to the people in the comments who pointed out that the Android pattern rules are much more complicated than I assumed (my bad; I don't use the pattern unlock on anything). Worth noting that the actual rules permit far fewer patterns than the upper bound numbers I gave above.

Also, to respond to people pointing out that the maximum guesses barely matter anyway: it may be that you're kind of correct, but for a different reason than you think. The default behavior on Android is (or was as of 2013; I don't know if this has changed) that you have unlimited guesses, just with a 30-second pause every five failed attempts. That's enough to fully brute-force the 4-digit PIN space in under a day, although of course in practice the time is vastly shortened by trying the common PINs first. https://www.theverge.com/2013/7/24/4551962/r2b2-3d-printed-open-source-robot-crack-android-pins (I don't know if the robot could attack swipe patterns, but if so, it would take still less time than PINs, for a given length.) The difference between 20 hours max for a four-digit pin, and 90 days max for a six-digit PIN, is huge... except of course humans are terrible at randomness.

Obviously, if anti-brute-forcing measures are in place (which they usually are on business-managed devices but not necessarily personal ones), a PIN or pattern only needs to be strong enough to stymie the permitted number of attempts. This is how four-digit PINs on credit and debit cards achieve a tolerable level of security. Also, ideally devices would do something similar to the current password recommendations, and disallow PINs (or patterns) too commonly used... but in practice, I'm not going to hold my breath for that.

Improve this answer
15
  • 5
    FWIW, I just wrote a quick program to count patterns under the restrictions that this answer seems to describe (where you can only move between positions that are neighbors either horizontally, vertically, or diagonally), and I found that there are 952 patterns of length 4 and 22,272 patterns of length 6. Under the restrictions that Polygorial seems to describe (which allows those moves plus moves like a knight in chess), there are 2280 patterns of length 4 and 92,448 patterns of length 6.
    – ruakh
    Mar 24, 2022 at 6:48
  • 17
    The actual pattern implementation in Android is fairly complicated. In short: you can't reconnect to a dot that's already connected; you can make "knight" moves; you cannot skip over an unconnected dot, but can skip over a connected dot. See here adamoudad.github.io/posts/lock_pattern and here usenix.org/legacy/event/woot10/tech/full_papers/Aviv.pdf
    – twisteroid ambassador
    Mar 24, 2022 at 8:29
  • 7
    The actual number of possible patterns for each length, counted by the code in my previous comment, are: 4 dots - 1624, 5 dots - 7152, 6 dots - 26016, 7 dots - 72912, 8 dots - 140704, 9 dots - 140704
    – twisteroid ambassador
    Mar 24, 2022 at 8:36
  • 1
    @twisteroidambassador: On Android 11 (Note 10 Lite) in fact the knight move can be made. But it's tricky to not accidentally touch one of the other dots.
    – dotancohen
    Mar 24, 2022 at 9:19
  • 4
    The screen smudge is a big factor. Mine is often pretty clear, so I try to wipe it away but don't always remember. The way the overlap (if any) goes also gives the direction for many patterns
    – Chris H
    Mar 24, 2022 at 11:33
12

Initial work on smudge attacks: https://www.usenix.org/legacy/event/woot10/tech/full_papers/Aviv.pdf Aviv, Adam J., et al. "Smudge attacks on smartphone touch screens." 4th USENIX Workshop on Offensive Technologies (WOOT 10). 2010.

Patterns are less secure - probably the paper people cite, but it compares against random PINs: https://web.archive.org/web/20200709225943id_/https://www.ei.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2013/09/26/patternLogin-CCS13.pdf Uellenbeck, Sebastian, et al. "Quantifying the security of graphical passwords: The case of android unlock patterns." Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security. 2013.

Bigger patterns don't really help much in getting users to pick stronger patterns: https://adamaviv.com/static/www/papers/aviv-acsac15.pdf Aviv, Adam J., Devon Budzitowski, and Ravi Kuber. "Is bigger better? Comparing user-generated passwords on 3x3 vs. 4x4 grid sizes for Android's pattern unlock." Proceedings of the 31st Annual Computer Security Applications Conference. 2015.

4 digit user chosen PINs aren't worse than 6 digit user chosen PINs: https://philipp-markert.com/assets/papers/sp20-670-pin-blocklist.pdf Markert, Philipp, et al. "This PIN can be easily guessed: Analyzing the security of smartphone unlock PINs." 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020.

So - bigger patterns and bigger PINs don't help much.

While not statistically justified, it is somewhat reasonable to compare the results from "The PIN can be easily guessed" and "Quantifying the security of graphical passwords". Both thankfully report a 10% guessability metric. User chosen 4 digit PINs represent around 7.11 bits of entropy (6 digits, 6.57 bits which is less!), while unlock patterns represent around 7.56 bits of entropy. We're using "entropy" very loosely here, these numbers are actually based on guessability estimates.

Frankly, the numbers for user chosen PINs vs user chosen Patterns are close enough that all I can say given the different populations, etc, is that they seem "similar". If there was enough interest in determining which is actually better or if they are essentially equally secure, it would require a separate study and publication directly comparing them.

Ultimately, if you're concerned about unlock security, use a randomly generated PIN instead of choosing your pattern or PIN - 4 random digits represents 13.29 bits of entropy.

Improve this answer
5
  • This is a good alternative way to look at it. It‘s interesting to see different ways to look at this problem.
    – Buzzyy
    Mar 25, 2022 at 11:51
  • A somewhat more "active" version of a smudge attack than discussed would be causing a person to get something greasy on their finger just before they need to use their phone. Not sure the most practical way to mitigate against that.
    – supercat
    Mar 25, 2022 at 15:12
  • @supercat Well, realistically, if they had greasy hands then unlocked and used their phone, using their phone would probably kill the pattern smudges. So the next step there would have to be getting them to immediately put their phone down somewhere you could see it after unlocking it. As for mitigation... I dunno, maybe all phones could slowly secrete oil so that your screen is always dirty, lol. Or pre-smudged screens, could be trendy like pre-worn jeans back in the day. Or microfiber-lined pants pockets, haha.
    – Jason C
    Mar 26, 2022 at 23:34
  • More seriously (fsv "seriously") maybe you could require a person to scribble randomly on the screen after entering their pattern. A slight inconvenience that would have to be accepted by the user if they're concerned about smudge attacks. Also, I know on Android, certain actions, particularly with the store, seem to require a fingerprint to perform even if you use a pattern to unlock.
    – Jason C
    Mar 26, 2022 at 23:35
  • Smudge attacks are interesting, but orthogonal; I linked the paper for further reading as the OP mentioned them. My point is that, surprisingly, PINs and patterns seem to be more or less comparably secure with how they're used in practice, which contradicts received wisdom.
    – Iiridayn
    Apr 23, 2022 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .