Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It is mostly ideology. But using something like random.org does raise your risk profile.

Random.org or any of their partners or your browser or the connection between you and random.org could all potentially be compromised.

If someone knows that you always generate your random salts with that site, they could potentially use past generated strings to reverse engineer your crypto.

Of course, very few password generators are only going to use the random seed you gave it. You would also need to know possibly the exact microtime and a ton of other variables to be able to "replay" the same scenario and generate a copy of the key.

The strength of your crypto is based on how unpredictably random the data you provide it is.

Assuming random.org is not the only source of random that your application used, it's probably fine.

If not, and reusing that same random string will produce the same output, it is quite dangerous. Especially if you are screen sharing. Someone tied to the project could easily figure out the output by copying the random string from the video.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: