Joho the BlogOrder of magnitude puzzle: Android sign-ins - Joho the Blog

## Order of magnitude puzzle: Android sign-ins

One of the security options with Android lets you sign in by dragging you finger to trace a pattern you’ve chosen on a 3×3 square numbered 1-9. The codes have to be at least 4 digits long, you can’t repeat any digit, and you can’t lift your finger off the pad. To my always-wrong intuition, that seems like it affords too few possibilities. So, your task is to guess (or, if you must, figure out) roughly how many choices there are.

[Semi-Spoilers] You start with with the following range of numbers: 1,234 to 987,654,321. That is a boatload of numbers. But you remove all the numbers that have repeated digits. For a 9-digit number, there are only 362,880 numbers (9 factorial) without repeated digits, so that’s like subtracting 100 million numbers from the mix. Our son Nathan says that it’s the same number for all the 8-digit possibilities, because 8 factorial x 9 is the same same as 9 factorial. (I’m lost. Ask him.) After you do all of them down through 4-digits, you have to subtract the sequences that have non-contiguous numbers (based on the 3×3 square). So, it’s a big number, especially since the Android UI puts in a time-out after 10 wrong tries. But it’s not an astronomical number. I’m guessing it’s under a million.

But I fully expect to be shown to be wildly wrong.

### 3 Responses to “Order of magnitude puzzle: Android sign-ins”

1. That’s not the real security flaw – the fact that you can see the pattern in the grease on the phone should narrow it down to two or three sequences in most cases. I use it anyway, it’s the only thing that keeps me from pocket dialing…

2. I have noticed too that at times my pattern is fairly obvious on the screen, however it is often not discernible, unsurprisingly.

I find it much easier to deal with than an alphanumeric code.

Whatever the number, a miscreant would have a tough time and a sore set of fingers trying to get in, although the 10 try lockout would give an enforced rest.

3. I think in practice the possibility space is even smaller, based on the actual physical location of the options in relation to each other. Although it may be possible on some phones to have the the top left spot followed by the bottom right one, (or indeed, any but the adjacent three) I cannot set such a pattern on mine. The extrapolating line of the combination path locks onto the first available free spot that is linearly adjacent.
so, if I start at top left (1, 1) I have only three possibilities.
(1,2), (2,1) and (2,2). From there, I have 4, 4 or 7 choices. Etc.

Web Joho only