News you can use if you have an Android phone (or are trying to break into one):
She found that a large percentage of them—44 percent—started in the top left-most node of the screen. A full 77 percent of them started in one of the four corners. The average number of nodes was about five, meaning there were fewer than 9,000 possible pattern combinations. A significant percentage of patterns had just four nodes, shrinking the pool of available combinations to 1,624. More often than not, patterns moved from left to right and top to bottom, another factor that makes guessing easier.
H/T to Bruce Schneier.
I’m a little surprised that brute forcing would be viable on Android phones. Windows phones will require significant delays after (IIRC) three failed attempts to log in. Then after a few more failures the phone will reset.