5 ms·

And one would hope secure devs know which random to use, whereas gaming devs have no reason to know.

josephg 6y ago
Look up “password generator” or similar terms on npm and take a look at how the packages you find generate random numbers. I did this ~5 years ago and it took until the second page of results before I found any packages that used a crypto-secure rng.
- esrauch 6y ago
  Even that seems unlikely to be problematic for anything short of literally constant seeds AND a generator becoming extremely popular. The vast majority of people reuse low-entropy passwords, figuring out what password generator someone used would be a much higher bar than figuring out passwords, and just knowing the insecure generator wouldnt reduce the entropy by that much. Actually, a password generator on GitHub that generates the password that is literally just seconds-since-1970 would still be a good generator for almost all use cases.
  - fanf2 6y ago
    This is extremely bad advice. It is shamefully unethical to encourage people to harm their security in this way.
    - esrauch 6y ago
      Can you explain more? I genuinely don't see any plausible threat model that a user running an Math.random() based custom algorithm password generator would be susceptible to, but the same algorithm using SecureRandom one is not. Both cases are so drastically better than manually thinking up a password that it's not even close. I think if there's any gap it would be wrong roll your own password generator at all and you only use ones authored by security experts: just using SecureRandom instead of Random isn't going to somehow magically guarantee you didn't mess up another way and write a low-entropy password generator.
- bigiain 6y ago
  Looking for crypto secure code by searching on npm? :facepalm: Seriously.
- ThePadawan 6y ago
  I was trying to generate random string identifiers to make some element ids unique and took the most popular library, which was accidentally crypto levels of secure: https://blog.prat.ch/2020/11/10/randomstring-bundle-size https://blog.prat.ch/2020/11/10/randomstring-bundle-size

Look up “password generator” or similar terms on npm and take a look at how the packages you find generate random numbers. I did this ~5 years ago and it took until the second page of results before I found any packages that used a crypto-secure rng.

esrauch 6y ago
Even that seems unlikely to be problematic for anything short of literally constant seeds AND a generator becoming extremely popular. The vast majority of people reuse low-entropy passwords, figuring out what password generator someone used would be a much higher bar than figuring out passwords, and just knowing the insecure generator wouldnt reduce the entropy by that much. Actually, a password generator on GitHub that generates the password that is literally just seconds-since-1970 would still be a good generator for almost all use cases.
- fanf2 6y ago
  This is extremely bad advice. It is shamefully unethical to encourage people to harm their security in this way.
  - esrauch 6y ago
    Can you explain more? I genuinely don't see any plausible threat model that a user running an Math.random() based custom algorithm password generator would be susceptible to, but the same algorithm using SecureRandom one is not. Both cases are so drastically better than manually thinking up a password that it's not even close. I think if there's any gap it would be wrong roll your own password generator at all and you only use ones authored by security experts: just using SecureRandom instead of Random isn't going to somehow magically guarantee you didn't mess up another way and write a low-entropy password generator.
bigiain 6y ago
Looking for crypto secure code by searching on npm? :facepalm: Seriously.
ThePadawan 6y ago
I was trying to generate random string identifiers to make some element ids unique and took the most popular library, which was accidentally crypto levels of secure: https://blog.prat.ch/2020/11/10/randomstring-bundle-size https://blog.prat.ch/2020/11/10/randomstring-bundle-size