3 ms·
> Math.random() That's just not acceptable, even as a fallback, I'm sorry, the whole idea of this service is just horrible. Please don't use this.
by lawl 11y ago
> Math.random()
That's just not acceptable, even as a fallback, I'm sorry, the whole idea of this service is just horrible. Please don't use this.
- mykii 11y agoI talking about failsafe not fallback, U will never reach the condition on browsers or nodejs. This mimic is there just to avoid a null return from .password() (generaly not checked by user) which could be more dangerous.
- lawl 11y agoRight because completely aborting would break things, who cares about security? This is just horrible and I honestly hope nobody will ever use this, I'm sorry.
- mykii 11y agoOne more thing, all lib/codes i can find on the net use Math.random() that's why i made this lib. because i use it first :)
- robinhood 11y agoLol.
- jetpm 11y agoI'm curious, why is Math.random() not OK? Does it have a bad seed?
- mykii 11y agohttp://ifsec.blogspot.fr/2012/05/cross-domain-mathrandom-prediction.html http://ifsec.blogspot.fr/2012/05/cross-domain-mathrandom-pre...
- jetpm 11y agoawesome and scary at the same time. awescary. If I understood it correctly this should work for nodejs servers as well, for example when they create random ids for users or urls.
- mykii 11y agoexcept that nodejs generally uses crypto.randomBytes() and the Google V8 seems to have a strongest Math.random() but the approach is not clear