A friend mentioned that he used the sine of a number, i.e. sind(54), to generate long passwords. This way he only has to remember sine 54 and have a calculator to get his password back. I am wondering if this is secure. It can easily generate a long password, but because the numbers are not random would it be vulnerable to some type of attack if they new the numbers were generated using sine?

  • $\begingroup$ Yes, easily. Calculate sin(x) for 0 through 179. Try six through twenty digits for each of them, plus try including and removing the decimal. 5,400 guesses, and I have the password. In fact, now that you know this, you could easily script up something to figure out his password. Worst of all is that this results in the same password for every site. $\endgroup$ – Stephen Touset Feb 8 '15 at 20:38
  • 1
    $\begingroup$ @StephenTouset Correction: -90 through 90. sin(1)=sin(179). $\endgroup$ – cpast Feb 8 '15 at 20:40

If someone knows your password creation method, the only hope you have of foiling an attack is if the method has a lot of entropy - roughly, if there are a lot of different passwords you could have with that method (it's not quite the same if some passwords are more likely than others, but it's a good heuristic). If the method is "sine of an integral number of degrees to some precision," this is a fairly weak method. Assuming it's in a base between 2 and 36 (i.e. 0-9 and a-z), and that you only use an integer number of degrees (which means an attacker need only consider integers between -90 and 90), and that the number of digits is between 1 and 15, and that it starts on a digit between 1 and 5, the number of passwords is just $180\cdot 15\cdot 5\cdot 35=472,500$. With a bit of thought, we can guess he's most likely to use base 10 or base 16, and so you just have $180\cdot 15\cdot 5\cdot 2=27,000$ passwords. More thought will reduce the number of likely passwords even further (e.g. if he's doing this for laziness, which is likely, he'll have between 8 and 15 digits starting at the first digit, for 2,880 possibilities).

If the attacker can only try passwords via a web login page, you might not need too many passwords possible to be secure; a login page can lock out the account after 10 tries or similar things that slow down a brute-force. But if an attacker can do an offline attack, it's fairly easy.

Length of a password doesn't determine the security of the password against a smart attacker; entropy does. If I have two possible passwords ("the blue moon rises over the sunny beach" and "colorless green ideas sleep furiously") which I randomly pick between, then an attacker who doesn't know my scheme might have trouble cracking them. But it's better to assume the attacker can figure out your scheme, and only consider how much randomness you inject into each individual password, and in that case my scheme only injects 1 bit despite having long passwords.

| improve this answer | |
  • $\begingroup$ In fact, by posting this question on SE, Steve may have inadvertently reduced his friend's password security to zero (if it wasn't zero to begin with). $\endgroup$ – Thomas Feb 8 '15 at 20:44
  • $\begingroup$ As a follow up to entropy. So if his password is inherently less secure because despite it's length, it's entropy or randomness is very low. So would that mean it's even weaker to a brute force attack from someone that doesn’t even know it's generated with sine? $\endgroup$ – Steve Feb 8 '15 at 20:53
  • $\begingroup$ @Steve Entropy is generally computed assuming someone knows the method you use to create a password. A lot depends on the specific attacker: if they assume your password is four English words, a sine-based password is immune from cracking; if they know the method you use, it's fairly weak. There's no such thing as the strength of a password in isolation, because it depends on what the attacker knows; strength is "if they know everything but the result of your RNG when you ran it to make this password, how hard is it to crack?" $\endgroup$ – cpast Feb 8 '15 at 20:58
  • $\begingroup$ @cpast Ah, I see. I guess the scenario in my head was something like a password leak/dump where the attack has hashes of passwords. Length seems to be your main strength from a brute force attack. Would creating the password from sine weaken a hash or leak information about the password? $\endgroup$ – Steve Feb 8 '15 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.