3 ms·
Server-side folks generate random identifiers and shared secrets all the time. Yes, it's niche, but not "extremely" and you don't use a crypto library for this
by stickfigure 6y ago
Server-side folks generate random identifiers and shared secrets all the time. Yes, it's niche, but not "extremely" and you don't use a crypto library for this (you use secure random!)
- mreome 6y agoThere is a difference between generating these kind of IDs and writing the generator for these kinds of IDs. You shouldn't be rolling your own UUID generator if you don't fully understand the concerns/requirements in regards to your source of randomness. Generally speaking, I'd agree the need for a cryptographicly secure random is niche in that it is limited to the implementation of specific libraries/functions that despite being widely used, should NOT be frequently re-implemented.
- josephg 6y agoI do this in nodejs all the time for IDs: require(‘crypto’).randomBytes(15).toString(‘base64’) Is this bad practice? Can you say more about why?
- cperciva 6y agoThat's only 120 bits of entropy, which means that you'll get a collision after generating ~ 2^60 IDs. Ok, maybe you're not worried about that scale; but I normally recommend 256-bit IDs in order to make sure that you don't need to worry about that possibility.