The Android operating system is currently installed on half of all mobile devices globally. Subsequently, its lock pattern access feature has become one of the most popular forms of protection for smartphones. Gesture-based touchscreen security seems both easier to remember than traditional alpha-numeric passwords as well as harder to guess. But a new study by Marte Løge, as reported by Ars Technica, has found that human beings are just as careless in choosing their Android lock patterns as they are with standard passwords. 

It’s well known that many people choose weak alpha-numeric passwords such as “12345,” “ABCDEFG” or the literal “Password.” This trend of simplistic or lazy passwords extends to touchscreen lock patterns. The researcher analyzed almost 4000 Android Lock Patterns and revealed that the majority of people prefer shorter touchscreen patterns, using four or five nodes at most to unlock a device. According to the study, a four node pattern provides a possible 1,624 lock combinations whereas a five node pattern provides just under 9,000 combinations. Those numbers do not seem so slight until you consider that following the standard rules of the Android lock screen, there are approximately 389,112 distinct combinations that users could create - see the math here. 

Additional findings from the study include surprisingly predictable user behaviour – almost half of all users started their pattern in the top left-hand corner of the screen. Additionally, 77 percent of all users started their pattern in one of the four corners. Using software and predictability algorithms, the simplicity of these Android Lock Patterns could make more mobile devices susceptible to password cracking in the future. The researcher in this study asked subjects to create three lock patterns, one for a shopping application, one for a banking application, and one to unlock a phone. While most healthcare, banking, and government offices have password policies, perhaps its time to review the existing criteria and extend stronger access controls to mobile devices.