This $200 3D printed bot can crack your phone's PIN in 20 hours

It seems after loosing your phone you have a few hours to disable access to your email account.

They hit 2580 and 1111 as well before the video cuts out.

That's the whole point. If someone gets physical access to my phone, I don't want them to get access to my data.

Then after the 30 second delay, if you guess wrong again, it goes up to around 5 minutes. The same happens repeatedly and it can get up to a few hours. I tried on an old iPod touch and got it up to around 4 hours.

However, it can be circumvented by restarting the phone.

And that has been the default on all Android phones I've used so far.

That's quite nice.

Escalating to a stronger password after 5 failed attempts seems like a good measure which would got a long way to nullifying this sort of brute force attack.

How does logging into the Google account work if the phone is in Airplane mode or whatever where there will be no data connection?

Personally, I'd like the option to set an unlock pin that's weaker than my disk encryption password, and prompt for my disk encryption password (rather than a Google account) if I fail the pin a couple of times.

Yes indeed. And even the pin number can be longer than 4 digits (contrary to the article)

Or just remove the SIM card...

doesn't that assume you can only select each pad once?

Pattern unlock leaves a body fat trail on the screen that is trivial NOT to see & exploit.

That assumes you can go directly from any spot to any other spot, which you can't. Given a grid that looks like this:

    123
    456
    789

you can't go directly from 1 to 3 unless 2 has been selected. I also don't think you can immediately backtrack, as in 213; you have to go 2513, for instance.

With that in mind, I wrote a quick search:

    Adjacent only (can't go from 1 to 6 or 8)
    1 9
    2 40
    3 160
    4 496
    5 1208
    6 2240
    7 2984
    8 2384
    9 784
    total: 10305
    total with length >= 4: 10096

    Non-adjacent (knight-moves) allowed (can go from 1 to 6 or 8)
    1 9
    2 56
    3 304
    4 1400
    5 5328
    6 16032
    7 35328
    8 49536
    9 32256
    total: 140249
    total with length >= 4: 139880

    Pass through previous spots, no immediate backtracking (2513 but not 213)
    1 9
    2 56
    3 304
    4 1464
    5 6136
    6 21344
    7 57184
    8 105376
    9 100928
    total: 292801
    total with length >= 4: 292432

    Pass through previous spots, with immediate backtracking allowed (213)
    1 9
    2 56
    3 320
    4 1624
    5 7152
    6 26016
    7 72912
    8 140704
    9 140704
    total: 389497
    total with length >= 4: 389112

So, I believe the correct number is 292432. For comparison, that's less secure than a 6-digit PIN, or a 4-lowercase-letter password.

More importantly, though, if you're using an unlock pattern, you can't be using disk encryption, so anyone who has physical possession of your phone need not bother brute-forcing the unlock pattern.

After 5 tries they should make you do some task like drawing a line or sliding a button to allow you to do the second 5 tries, so that random button mashing doesn't wipe your phone.

But in the phone’s lockscreen, you are usually not bound by the 4-digit requirement of SIM card PINs, hence can use an arbitrary alphanumeric password (though likely rather short, as you have to enter it often on a small keyboard). 36^5 >> 10^4.