Numbers only password strength

Question

In my organization, users must generate a password from numbers only (keypads are used to access), minimum length is 8 numbers. How can I make sure the password the user generats is not too weak (using c# on server procossing password change request), applying the following rule:

3 following numbers (even a part of password) are not sequential or repeated (9451238401 or 543555784)

Is this really a programming question? Seems like this has nothing to do with writing an actual program. — rory.ap, Feb 26 '16 at 13:06
@roryap: It seems like a perfectly reasonable question to me: given a candidate password, does it break the sequence/repetition rule? The lack of effort is a different matter, but it's definitely a programming question. — Jon Skeet, Feb 26 '16 at 13:07
This is a duplicate of at least two existing questions, hence too broad. Try breaking up your problem in smaller steps, try to resolve each step on your own and ask a question per step if you can't figure it out. Once you've assembled all smaller parts into one and still can't figure it out, show your code, read [ask] and explain explicitly what exactly you're looking for. — CodeCaster, Feb 26 '16 at 13:08
Reopened, because I shouldn't close questions as duplicate when they aren't duplicate. Sorry. — CodeCaster, Feb 26 '16 at 13:13
How is this the same as [link](http://stackoverflow.com/questions/3844611/detecting-sequence-of-at-least-3-sequential-numbers-from-a-given-list)? whiles it is possible to loop and sort arrays, i do not want this results sorted, only if 3 **following** charachters are sequential or repeated it should flag — Eli Perl, Feb 26 '16 at 13:15
These are ALL still going to be too weak. You need to make them enter a much longer password. 62^8 (2.18E14) is the exhaustive keyspace of an 8 character password with upper case, lowercase, and numeric. Therefore, a 14 to 15 character minimum for numeric only passwords gets you the same exhaustive keyspace. The actual keyspace will be much smaller; for characters, you'll see people's names and birthdays, and Passw0rd (which is horribly weak, and counts), and for numeric you'll see phone numbers, possibly repeated or with birth dates at either end. Plus 13579246801357... — Anti-weakpasswords, Feb 26 '16 at 13:56

score 1 · Accepted Answer · answered Feb 26 '16 at 13:10

1

The regular expression is:

^((?!(?<ch>.)\k<ch>\k<ch>)(?!012|123|234|345|456|567|678|789|890)[0-9]){8,}$

The (?!(?<ch>.)\k<ch>\k<ch>) will check for the same character repeated thrice. Note that for the various contiguous sequences I had to put them in a list of possible sequences, (?!012|123|234|345|456|567|678|789|890). [0-9] is the character that will be accepted as valid. The {8,} is for the minimum length.

answered Feb 26 '16 at 13:10

xanatos

109,618
12
197
280

Have an upvote for creativity. – CodeCaster Feb 26 '16 at 13:14

Matthew Watson · Answer 2 · 2016-02-26T13:34:51.530

If you want a general-purpose approach which tells you the number of repeated, ascending and descending digits:

static void checkStrength(string text, out int maxRepeats, out int maxAscending, out int maxDescending)
{ 
    maxRepeats     = 0;
    maxAscending   = 0;
    maxDescending  = 0;

    int currRepeats    = 0;
    int currAscending  = 0;
    int currDescending = 0;

    for (int i = 1; i < text.Length; ++i)
    {
        char curr = text[i];
        char prev = text[i-1];

        if (curr - prev == -1)
            maxDescending = Math.Max(maxDescending, ++currDescending);
        else
            currDescending = 1;

        if (curr - prev == 1)
            maxAscending = Math.Max(maxAscending, ++currAscending);
        else
            currAscending = 1;

        if (curr == prev)
            maxRepeats = Math.Max(maxRepeats, ++currRepeats);
        else
            currRepeats = 1;
    }
}

You would have to call this and then do what you want with the results:

int maxRepeats, maxAscending, maxDescending;
checkStrength(text, out maxRepeats, out maxAscending, out maxDescending);

if (maxRepeats > REPEAT_LIMIT || maxAscending > ASCENDING_LIMIT || maxDescending > DESCENDING_LIMIT)
{
    // ... report error or whatever
}

If you don't need to vary the allowed number of repeated or ascending digits, then xanatos' regex is clearly by far the shortest code. This code is only needed if you need to vary the allowed counts at runtime.

Numbers only password strength

2 Answers2