If you trace those numbers on a usual keyboard-numpad, it spells out a swastika with a box around it.
I know from the Android pattern lockscreen, that there exist 389112 lockscreen combinations for a 3x3 matrix.
Edit: You should keep in mind that the pattern lockscreen has some limitations like the pattern needs to be one continuous movement, jumping therefore is not allowed. In the swastika-example the user indeed can jump, start new etc. so the possible combinations should be far higher.
Moves = 4, combinations = 1624 Moves = 5, combinations = 7152 Moves = 6, combinations = 26016 Moves = 7, combinations = 72912 Moves = 8, combinations = 140704 Moves = 9, combinations = 140704 Total possibilities: 1624 + 7152 + 26016 + 72912 + 140704 + 140704 = 389112
It turns out, that users tend to prefer visually appealing passwords, which are easy to shoulder-surf and also easy to guess based on smudgepoints since they give you a possible start- / endpoint, which drastically reduces the search-space.
Back to the swastika: Since people tend to use visually appealing passwords, would a password-cracker or brute-forcer put a higher priority on those "visual passwords" on a keyboard or a numpad?
Are there lists for that?
Should I advise people in my company to not use visual passwords that represent something? Because most of the passwort guidelines focus on not using dictionary-words or widespread terms.
My question is not limited to the numpad. Every device that you can type on should be considered.
Visual passwords might be much longer than usual passwords, that you find in a dictionary. Since you "paint" them and only have to remember the visual form, I think that there could be passwords with 20 digits or more.
A brute-forcer usually would not check those long passwords, but if there would be a list of "typable visual forms", suddenly a brute-forcer might be able to check really long words, since there are only so many visual forms that you type on a keyboard.
This example spells out "Cool!", which would look like this if typed:
EWAZXTRDCVGYGBNJUIK,.P;/ - 24 symbols.
PS: I am not a native english speaker and I'm not very satisfied with the terms "picture-passwords", "visual passwords", ... but despite researching beforehand I did not find a more fitting name for what I mean. Is there a better one? Should I change the title of my post?