News for hackers. Stuff that matters.

A comment on Blog post id enumeration can lead to unwanted information disclosure. Parent comment

Re:Blog post id enumeration can lead to unwanted information... by JoeAltmaier on Tuesday March 01, 2016 @01:30AM (#11201106)
From Wikipedia : "some people claim /dev/urandom as not recommended[who?] for the generation of long-term cryptographic keys"
[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by marcosdumay on Tuesday March 01, 2016 @07:38AM (#11202198)
It's manpage also says the same.

It is a cryptographically secure PRNG, but during a small time in system start up, it may not be correctly seeded.

If you need long term keys, it may be better to get some 256 bits from /dev/random before using /dev/urandom.

[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by dchest on Tuesday March 01, 2016 @08:14AM (#11202332)
That's a bad advice.

http://sockpuppet.org/blog/2014/02/25/safely-generate-random...

[ Parent | on HN ]