News for hackers. Stuff that matters.

A comment on Blog post id enumeration can lead to unwanted information disclosure. Parent comment

Re:Blog post id enumeration can lead to unwanted information... by marcosdumay on Monday February 29, 2016 @06:10PM (#11199475)
Linux /dev/urandom is cryptographically secure.

The library you are using for creating those UUIDs must have some bug. My guess is they share the same generator for all threads on each machine.

[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by JoeAltmaier on Tuesday March 01, 2016 @01:30AM (#11201106)
From Wikipedia : "some people claim /dev/urandom as not recommended[who?] for the generation of long-term cryptographic keys"
[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by marcosdumay on Tuesday March 01, 2016 @07:38AM (#11202198)
It's manpage also says the same.

It is a cryptographically secure PRNG, but during a small time in system start up, it may not be correctly seeded.

If you need long term keys, it may be better to get some 256 bits from /dev/random before using /dev/urandom.

[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by dchest on Tuesday March 01, 2016 @08:14AM (#11202332)
That's a bad advice.

http://sockpuppet.org/blog/2014/02/25/safely-generate-random...

[ Parent | on HN ]