News for hackers. Stuff that matters.

A comment on SpiderOak Encryptr – Zero-Knowledge Password Syncing. Parent comment

Re:SpiderOak Encryptr – Zero-Knowledge Password Syncing by CiPHPerCoder on Tuesday April 26, 2016 @04:56PM (#11575544)
The "non-problem" of a biased PRNG is that you get reduced entropy in your generated passwords, thus reducing security.

The "flaw" in the pull request was fixed in a later commit (by switching to Uint8Array instead of Uint32Array), and then it was ignored by the SpiderOak team.

[ Parent | on HN ]
Re:SpiderOak Encryptr – Zero-Knowledge Password Syncing by Dylan16807 on Tuesday April 26, 2016 @08:10PM (#11576885)
Selecting one of 84 characters purely randomly gives you 6.3923174227787602763 bits of entropy.

Selecting one of 84 characters by using modulus on a 32 bit random number gives you 6.3923174227787602889 bits of entropy.

It is a bug, but it is absolutely a non-problem. The difference you would get from using 83 or 85 characters is many orders of magnitude larger; this is not something that needs such an enormous level of precision.

[ Parent | on HN ]