3 ms·
This is one of those areas where security in depth is a good idea. Gather all the sources of random sources you can and hash them together -- add in any inform
by CJefferson 5y ago
This is one of those areas where security in depth is a good idea.
Gather all the sources of random sources you can and hash them together -- add in any information based on user input (key presses / mouse movements), and personally I'd provide each users with a securely generated random 1K string (which could be sent once at install) to provide more random data.
- htrp 5y agoI like cloudflares solution for entropy. A webcam pointed at a wall of lavalamps in their HQ https://www.cloudflare.com/learning/ssl/lava-lamp-encryption/ https://www.cloudflare.com/learning/ssl/lava-lamp-encryption...
- Tempest1981 5y agoCool, but why are they on public display? Sufficiently hard to hack as-is?
- wlonkly 5y agoYou said it yourself: "Cool"
- dchest 5y agogetRandomValues() already takes input from keyboard and mouse interrupts (via the OS PRNG) and lots of other sources, no need to create own bug-ridden implementations of the same thing.
- CJefferson 5y agoThat's true for good implementarions, but is it true for all implementations? I don't know, but I'd be worried about it.