Is a Pattern Lock any more secure then a typical text password? [duplicate]

Question

I've been trying to find a way to secure a webpage that is easy to do (ie gaining access) yet still fairly secure. So, while a 4 char numeric password would be fairly quick to enter, it wouldnt be very secure, and a 4 char alphanumeric + symbols would take more time to enter in, but potentially be much more secure...

So I started to look into pattern locks. If you're not sure what they are or you call it something different, see this: http://www.makeuseof.com/tag/which-is-more-secure-a-password-or-a-pattern-lock/

The above article brings up a few good points. Namely the order of magnitude difference between the possible permutations of the pattern lock and the number of character combinations of a text lock...

So, Is a pattern lock inherently more or less secure then a text password?

My initial thought is that the pattern lock will be more secure since it's not a traditional method of entry, requiring a human to enter the correct pattern versus a program that can just brute force the typed password... (Unless of course, you can write a program that simulates user entry. I couldn't figure out how write an app to simulate user input, but that doesn't mean anything...)

I've attached an example that is a work in progress. Note, it DOES NOT work. It simply demonstrates what i'm talking about.

http://dck.dx.am/GraphicLock/index.html

EDIT:

Thanks to all for the comments! I agree with you as far as the complexity of the password vs the pattern. (especially on mobile when you can see the streak marks!). In regard to complexity, patterns really cant compete.

My thinking was that it would be almost impossible to brute-force as it requires a person to enter the pattern. You'd have to really want to gain access to try it that way...

The above is obviously an assumption. I'm sure there are ways to get a computer to do this if you are determined enough. I guess that's a question for another forum...

Answer 1

Password is better, to foreseeable future.

Password is now better, because

The Pattern Lock can be good for convenience, and it may be sufficient to thwart attackers who have not seen you draw it. However, the number of combinations is significantly smaller for Pattern Lock than in typical password. Even if you restrict password to use only characters and use 4 letter password, there is over 400000 valid combinations. However, according to this earlier question Combination of smartphone pattern password, the number of combinations of pattern lock is smaller. On the other hand, pattern has more combinations than 4-5 digit pin.

If you use relatively long password and follow good password selection practices it is certainly stronger.

Note: Password/PIN is easier to use as secret for key derivation functions. For this reason, on some systems, like Android, if you intend to use "Encrypt phone/tablet", you MUST use either password or PIN; not pattern. (Therefore, if you care for the security of your data on the device, you often end-up to use high or mediocre entropy password).

Future pattern locks

The current pattern locks are inferior to password, but is this inherently so? Amount of choice favors passwords. In password there is anyway tens of characters you can choose in each screen. In pattern, you make choice out of quite few possibilities (different directions). Even if you make grid larger, it is hard to make pattern as efficient as password.

One of important benefits of password is that they are representable in fairly universal format, and therefore, they are solution that can be applied in many places, like computer login, smartphone, tablet, web site etc. Especially for remote usable services (like WLAN password, network password, web site password), pattern lock would be inconvenient as pattern lock is largely tied with the input device.

Answer 2

All else being equal, the security is the same. But, of course, all else is not equal.

You could very simply translate pattern locks into numeric locks (as typically is done internally), just number the pattern positions and record their sequence. If we number the positions as in a telephone dialpad, then a pattern that goes across the top and down the right would equate to the sequence 1-2-3-6-9. And as passwords go, that's approximately the same security as the password 12369.

Except not quite, since the typical pattern implementation disallows repeating digits. So the password 1-3-5-1-2-1 just simply isn't allowed as a pattern. This pretty severely limits your password space, as there's a hard limit of 9 digits, and the search space is combinatorial instead of permutational.

But assuming you artificially limit the search space of the password scheme to match that of the pattern scheme, then yes, the security of the two is precisely identical barring side-channel attacks (smudge pattern analysis, etc.).

Answer 3

One of my friends guessed the pattern lock on my phone based on the streaks left in the grease on the screen (sounds gross, I know). So you don't even need to watch someone trace the pattern if they forget to wipe the screen.