Let's say your friend calls you and asks you how to generate a secure password. You say to your friend, "just slide your finger down the keyboard to get a bunc

Let's say your friend calls you and asks you how to generate a secure password. You say to your friend, "just slide your finger down the keyboard to get a bunch of letters. then capitalize 1 or 2 of them." This is how it looks if I do this: qasWdfghjzUkilo Those 15 characters look pretty random. Yet, if you KNEW a thousand people were following those instructions, then you could build a model of the actual entropy that goes into the password: 1) Where did they start and stop sliding their keyboard 2) What is their keyboard layout 3) Which is the FIRST letter they chose to capitalize? 4) Did they choose to capitalize a second letter, and if so which one? The above is very low entropy. If a thousand people are following your instructions, you can guess one in WAY less time than brute-forcing 15 random letters. The issue is that although the result LOOKS random, very low entropy is entering it - you can repeat the steps, if you know the algorithm. Likewise, pseudorandom number generators take SPECIFIC steps (algorithmically.) If you know the "seed", such as the time-stamp, that they're initiated with, you can simply repeat the steps. This is a huge vulnerability if the result is supposed to contain a high degree of entropy. I've simplified a bit, of course. Good pseudorandom algorithms have very good, equal-looking distributions. But make no mistake: at their heart they're just steps that anyone can follow along with, if they know the entropy entering the algorithm they can come up with the same result.