From helpnetsecurity.com
The “swiping” unlock patterns typical for Android devices are considerably easier for attackers to discern than PIN combinations.
In fact, after only one observation of a user entering the pattern, 64% of shoulder surfing attackers will be able to reproduce it, a group of researchers from the US Naval Academy and the University of Maryland Baltimore County has found.
In comparison, only one in ten attackers could make out a six-digit PIN after one viewing.
Full article here.