Does using a certain kind of numbers make a good password?

Question

Do special numbers (transcendental number, first few elements of a certain sequences and so on ...) make good passwords in terms of brute force breaking ?

EDIT: Why am I asking this ?

A friend of mine is composing a list of few recommendations on how people in his workplace should choose passwords. From what he told me, he used a "standard" one at first (you know, "choose your password from one to six letters and two numbers ...") and came to a conclusion that most people just ignore those recommendations and just uses passwords like "password", "date of birth", ...

So he decided to invent a list of more interesting recommendations, hoping it will motivate people to at least give it some thought. And so we started thinking on what to put on the list that could prove useful.

Answer 1

It shouldn't really make to much of a difference, in a typical brute force, someone will probably scan for - [a-z]+[A-Z]+[0-9], meaning that your number will be found.

Sorry, you haven't really given enough details on the number series you will be using, but here is some general advise -

When it comes to passwords, a long one is MUCH better and more importantly memorable, for example:

thisismyverylongbutcomplexpasswordphrasethaticanremember
(This is my very long but complex password phrase that i can remember)

This has 56 characters, and even only using [a-z] (lower case), it has (unless I have done my maths wrong) - 1.7318388839216286227999402745695e+79 combinations.

If you just had a normal password, lets say,

myP@55w0rd123456
(my password 123456)

This has 16 characters, and there is a possibility you will forget - as for brute force- using [a-z][A-Z][0-9][Symbols], (saying an average of 170, which includes over 100 characters), giving a total of 4.8661191875666868481e+35

Obviously, having a combination of a very long but complex password is the best, but it is easy to forget and can take to long to type. whatever happens, it will take a hacker a seriously long time to brute force.

Anyway, this is just a general guide, but I hope it has helped you even though I haven't directly said about your actual question.

Answer 2

In terms of brute force, there's no such thing as a "good" password, except to maximize the keyspace. Brute force will take on average just as long if you're using special numbers as it will otherwise.

In response to your edit: it sounds like you're trying to get people away from passwords that can be guessed easily with a dictionary attack or social engineering (e.g. birth date). You might consider providing some passwords that are easy to remember that won't fall to these attacks easily. One website I've seen provides passwords made up of two small words separated by a number, e.g.: hair123car, pole18dog, etc... You could generate these easily with a list of small (3-5 character) words and a number generator. They might not be very strong passwords, but they'll fare better than "password" and they're nicer for the user than "$0mEh4rDP@sSw0rD".

Answer 3

They key to making passwords hard to crack is to pick one outside of the 'search space' that might be used by a potential cracker. Picking the first 10 digits of pi might be a very bad choice if your login name is 'pi-lover' or 'geometry' or whatever.

Wil is right. All things being equal, a long password is harder to crack that a shorter one. But if I have special knowlegde - which might be knowledge you inadvertently provide through other channels - then I have a good chance of (eventually) hacking my way in. The person who hacked Sarah Palin's Yahoo account was able to find out the answer's to her security questions by researching them online.

If I have physical access to your machine, nothing will keep me out for long unless your entire harddrive is encrypted. I can walk up to 95% of computers on the planet with a live CD, boot from that & I have access to (nearly) every resource on the box, no password required.

Answer 4

Agreeing with everyone who posted before me, but also consider that using well-known transcendentals (e.g. e or sqrt(2)) is counterproductive, because they're likely to be in someone's dictionary.

Answer 5

Yes, some numbers make awesome passwords, if you hold down alt while typing them on the numpad.

130 = é 132 = ä

And so forth.

Answer 6

Hey, I don't think that my password is very complicated (although I've been more creative than just using "password" ;). I made good experiences with using passwords from a foreign language i.e. french or spanish.

Answer 7

One easy way to test this yourself would be to create a document in Word (or a new zipfile in Winzip) and password the file. Now download one of the many free password cracking programs and see how long it takes to crack the file. I've done a few of these lately (for legitimate work reasons, people leaving on short notice, leaving behind important files with unknown passwords).

Throwing a dictionary-based cracker at a file with a simple password takes milliseconds to crack. Brute-forcing a file with a six digit numeric password (especially when you know its numeric) takes a few seconds, it really doesn't matter how mathematically obscure your number is, a brute force cracker just tries them all.

Once you expand to non-dictionary words with more than six characters with a mix of character types (lower-case, upper-case, numbers, keyboard symbols, special characters) the time taken goes up exponentially.

Answer 8

If you really want to be secure, you don't want to use any word from the dictionary in your password; even if you replace all "a" with "@", or "s" with "5", or "e" with "3", etc. If it's a word from the dictionary it can be guessed, and most people choose a word that means something to them any which would make it easier for someone who knows them to guess.

What you really want to do is pick a completely random combination of letters, numbers and symbols. This way the only way to brute force attack the password is to guess all combinations possible, instead of doing what is called a "Dictionary Attack". A "Dictionary Attack" is when the attacker guesses passwords based on going through the dictionary.