A friend mentioned that he used the sine of a number, i.e. sind(54), to generate long passwords. This way he only has to remember sine 54 and have a calculator to get his password back. I am wondering if this is secure. It can easily generate a long password, but because the numbers are not random would it be vulnerable to some type of attack if they new the numbers were generated using sine?
If someone knows your password creation method, the only hope you have of foiling an attack is if the method has a lot of entropy - roughly, if there are a lot of different passwords you could have with that method (it's not quite the same if some passwords are more likely than others, but it's a good heuristic). If the method is "sine of an integral number of degrees to some precision," this is a fairly weak method. Assuming it's in a base between 2 and 36 (i.e. 0-9 and a-z), and that you only use an integer number of degrees (which means an attacker need only consider integers between -90 and 90), and that the number of digits is between 1 and 15, and that it starts on a digit between 1 and 5, the number of passwords is just $180\cdot 15\cdot 5\cdot 35=472,500$. With a bit of thought, we can guess he's most likely to use base 10 or base 16, and so you just have $180\cdot 15\cdot 5\cdot 2=27,000$ passwords. More thought will reduce the number of likely passwords even further (e.g. if he's doing this for laziness, which is likely, he'll have between 8 and 15 digits starting at the first digit, for 2,880 possibilities).
If the attacker can only try passwords via a web login page, you might not need too many passwords possible to be secure; a login page can lock out the account after 10 tries or similar things that slow down a brute-force. But if an attacker can do an offline attack, it's fairly easy.
Length of a password doesn't determine the security of the password against a smart attacker; entropy does. If I have two possible passwords ("the blue moon rises over the sunny beach" and "colorless green ideas sleep furiously") which I randomly pick between, then an attacker who doesn't know my scheme might have trouble cracking them. But it's better to assume the attacker can figure out your scheme, and only consider how much randomness you inject into each individual password, and in that case my scheme only injects 1 bit despite having long passwords.