The "strongest password" I have an app which is protected by a four-digit-PIN and the user got five attempts at logging in before the account is locked.
Now, one of my customers wants to "strengthen" the security and advocate for another solution:


*

*six-digit-PIN

*NO "same digit next to each other": e.g.: 113945 or 395594

*NO "three-running numbers": e.g.: 123654 or 537893


Now to the question: Which solution is the strongest?
I can calculate the four-digit pretty easy, but how do I calculate the other one?
Thanks!
Update
You get what you ask for - especially when working with math :)
So, what I was asking for was the number of combinations for both number sequences.
Reading through the answers and comments it has come clear to me that it really doesn't matter. If you have 5 guesses then it doesn't matter if you have 10.000 or ~800.000 to choose from.
More important is ruling out 1234 and day of birth. In my situation, I actually have the users day of birth so I have something to check against.
Thanks for a great discussion!
 A: You've asked a statisticians forum for help on this question, so I'll provide a statistically-based answer. Thus it's reasonable to assume you're interested in the probability of guessing a PIN at random (for some definition of random), but that's reading more into the question than is provided.
My approach will be to enumerate all possible options without restricting, then subtract the void options. This has a sharp corner, to it, though, called the inclusion-exclusion principle, which corresponds to the intuitive idea that you don't want to subtract the same thing from a set twice!
In a six-digit PIN with no restrictions and a decimal number system, there are $10^6$ possible combinations, from $000 000$ to $999 999:$ each digit has 10 options.
Consider what "two adjacent, identical" digits looks like: $AAXXXX$, where the positions labelled $A$ are the same and $X$ can be any decimal digit. Now consider how many other ways the string $AA$ can be arranged in six digits: $XAAXXX$, $XXAAXX$, $XXXAAX$, and $XXXXAA$. So for any particular ordering (one of those options), there are at least $10^4$ combinations, since there are $10^4$ digits without restriction. Now, how many choices of $A$ are there? We're working with decimal digits, so there must be 10. So there are $10^5$ choices for a particular ordering. There are five such orderings, so there are $5\times10^5$ arrangements that satisfy this definition. (What this means in terms of security might be measured in terms of an information-theoretic measure of how much this reduces the entropy of the PIN space.)
Now consider what consecutive numbers look like. In the string $ABCXXX$, if we know A, we also know B and C*: if A is 5, then B is 6 and C is 7. So we can enumerate these options:


*

*012XXX 

*123XXX

*234XXX 

*456XXX 

*789XXX


and at this point it's unclear if there's a "wrapping around." If there is, we also include


*

*890XXX

*901XXX


Each solution has $10^3$ associated combinations, by the same reasoning as above. So just count out how many solutions there must be. Keep in mind to count alternative orderings, such as $XABCXX.$
Now we get to the sharp corner, which is the inclusion-exclusion principle. We've made the set of all six-digit PINs into three sets:
A. Permissible PINs
  B. Void PINs due to "adjacent digits"
  C. Void PINs due to "sequential digits"
But there's an additional subtlety, which is that there are some 6-digit numbers  which can be allocated to both $B$ and $C$. So if we compute $|S|=|A|-|B|-|C|,$ we're subtracting out those numbers twice, and our answer is incorrect. The correct computation is $|S|=|A|-|B|-|C|+|B\cap C|,$ where $B\cap C$ is the set of elements in both $B$ and $C$. So we must determine How many ways can a number fall in both $B$ and $C$.
There are several ways this can occur:


*

*$AABCXX$

*$ABCXDD$
and so on. So you have to work out a systematic approach to this as well, as well as a way to keep track of alternative orderings. Using the same logic that I've applied above, this should be very tractable, if slightly tedious. Just keep in mind how many alternative ways there might be to satisfy both B and C.


Slightly more advanced approaches would take advantage of basic combinatoric results and the fundamental theorem of counting, but I chose this avenue as it places the smallest technical burden on the reader.
Now, for this to be a well-formed probability question, we have to have some measure of probability for each arrangement. In the assumption of a naive attack, one might assume that all digit combinations have equal probability. In this scenario, the probability of a randomly-chosen combination is $\frac{1}{|S|}$ If that's the kind of attack you're most interested in preventing, though, then the proposed set of criteria obviously weakens the system, because some combinations have are forbidden, so only a dumb attacker would try them. I leave the rest of the exercise to the reader.
The wrinkle of "five until lockout" is decidedly the better guard against unauthorized access, since in either the 4-digit or the 6-digit scheme, there are a very large number of options, and even five different, random guesses have a low probability of success. For a well-posed probability question, it's possible to compute the probability of such an attack succeeding.
But other factors than probability of sequences of numbers may influence the security of the PIN mechanism. Chiefly, people tend not to choose PINs at random! For example, some people use their date of birth, or DOB of children, or some similarly personally-related number as a PIN. If an attacker knows the DOB of the user, then it will probably be among the first things they try. So for a particular user, some combinations may be more likely than others.
*The sequences you list are strictly increasing, and it's unclear whether both increasing and decreasing when you say "three-running number."
A: Obtaining a closed formula seems complex. However, it is quite easy to enumerate them. There are 568 916 possible codes for the second solution. Which is bigger than the number of solutions with a four digit PIN code. The code to enumerate them is below. Though not optimized, it only takes seconds to run.
Note. I assumed that the sequence had to be in increasing order (which can be easily modified in three_running)
N = 999999

candidates = range(N)

def same_consecutive_digits(x):
    x_string = str(x).zfill(6)
    for i in range(1,len(x_string)):
        if x_string[i] == x_string[i-1]:
            return True
    return False

def three_running(x):
    x_string = str(x).zfill(6)
    for i in range(2,len(x_string)):
        if int(x_string[i]) == int(x_string[i-1]) + 1 and int(x_string[i-1]) == int(x_string[i-2]) + 1:
            return True
    return False

def valid(x):
    return not same_consecutive_digits(x) and not three_running(x)

assert(same_consecutive_digits(88555))
assert(same_consecutive_digits(123))
assert(not same_consecutive_digits(852123))
assert(three_running(123456))
assert(not three_running(4587))
assert(valid(134679))
assert(not valid(123894))
assert(not valid(111111))
assert(not valid(151178))
assert(valid("031278"))

accepted = [i for i in range(N) if valid(i)]
print(len(accepted))

