3 ms·

Still weak. Read the seed value from /dev/urandom or get it from CryptGenRandom if you're on Windows. I think it's also best to use #ifdef to prevent those har

by Canada 11y ago

Still weak. Read the seed value from /dev/urandom or get it from CryptGenRandom if you're on Windows. I think it's also best to use #ifdef to prevent those hardcoded debugging keys from being included in production builds. That is, if you still need to keep them at all. edit: joelthelion: You are mistaken. It's not the 1990s anymore. Use the non-blocking /dev/urandom, not /dev/random. (I can't seem to reply directly to you)

joelthelion 11y ago
/dev/random, not /dev/urandom, if I'm not mistaken.
- MrRadar 11y ago
  That's somewhat debatable: http://www.2uo.de/myths-about-urandom/ http://www.2uo.de/myths-about-urandom/ But really either will be way better than anything you could homebrew.
- DanBC 11y ago
  (EDIT: I reread this and it sounds like I'm ranting at you. Sorry, I'm not, even though it does read like that.) This is why cryptography is doomed to fail. This /dev/random vs /dev/urandom (blocking vs non-blocking and whether it matters) is discussed frequently on HN, usually with very long threads, and yet it still comes up. If I want to remember whether there's an apostrophe in possessive its there's a cartoon to tell me. We need a good, accurate, fact-checked cartoon for urandom vs random. (It's one of the things I'd do if I had FU money.)