4 ms·
> The "Jiggle your mouse to generate encryption key" ridiculousness is now a thing of the past is it really ridiculous?
by hansel_der 5y ago
> The "Jiggle your mouse to generate encryption key" ridiculousness is now a thing of the past
is it really ridiculous?
- creatonez 5y agoYes. The /dev/random device would formerly refuse to continue giving data even when it had plenty of entropy backing it. The reality is, unless you are in early boot (now fixed by Torvald's RNG seeder) you have enough entropy to generate nearly unlimited quantities of pseudorandom numbers without revealing much of the PRNG's internal state. You only need 256 bits of initial seed entropy to be virtually unpredictable, as long as those 256 bits are strong. See: Myths about /dev/urandom https://www.2uo.de/myths-about-urandom/ https://www.2uo.de/myths-about-urandom/ Jiggling the mouse may have made feel better about the security of the software they're using, but really should have been considered a bug (and the UI, a horrible workaround) this whole time. Now that /dev/random no longer exists, and the kernel now has Torvalds' cache timings based seeder, any software that mistakenly uses it will generate a key instantly regardless of how much mouse jiggling you do.
- loeg 5y agoThe mouse-jiggling might remain valid for initial seeding / unblocking in an environment without other random sources (including Torvalds' version of jitterentropy), but it's hard to imagine those are anything but theoretical.
- Xarodon 5y ago> https://www.2uo.de/myths-about-urandom/ https://www.2uo.de/myths-about-urandom/ Needs an update now, it contains numerous facts that are no longer true.
- throwawayninja 5y agoI imagine the people most burned by that design run / remote into servers.
- Dylan16807 5y agoYes because it already collected plenty of data from the mouse since boot.