4 ms·
The same problem applies with php using the function `uniqid`. The function does not generate cryptographically secure tokens. Here are 10 generated in a row:
by nodesocket 14y ago
The same problem applies with php using the function `uniqid`. The function does not generate cryptographically secure tokens. Here are 10 generated in a row:
5123ed3e43a9c
5123ed3e43c3c
5123ed3e43c44
5123ed3e43c4b
5123ed3e43c51
5123ed3e43c56
5123ed3e43c5c
5123ed3e43c62
5123ed3e43c6b
5123ed3e43c74
- krapp 14y agoYeah, uniqid is just an altered timestamp as I understand it. But it's not meant to be in any way cryptographically secure or random, though I'm sure someone somewhere uses it for tokens, passwords, whatnot.
- beambot 14y agoThis advice doesn't appear to be universally true. There are different versions of UUID, including version 4 for truely "random" (or pseudo-random) UUIDs. Looking at the python implementation: http://docs.python.org/2/library/uuid.html http://docs.python.org/2/library/uuid.html def uuid4(): """Generate a random UUID.""" # When the system provides a version-4 UUID generator, use it. if _uuid_generate_random: _buffer = ctypes.create_string_buffer(16) _uuid_generate_random(_buffer) return UUID(bytes=_buffer.raw) # Otherwise, get randomness from urandom or the 'random' module. try: import os return UUID(bytes=os.urandom(16), version=4) except: import random bytes = [chr(random.randrange(256)) for i in range(16)] return UUID(bytes=bytes, version=4)
- icoder 14y agoiirc the PHP explicitly states that these are not true random
- ars 14y agoYou can set the more_entropy argument of uniqid to true to get better randomness. http://www.php.net/uniqid http://www.php.net/uniqid