Re:All zeros in a bank card's CVC code
by Dylan16807 on Thursday December 27, 2018 @08:42AM
(#18769365)
It's the bias in guessing that matters, not the bias in generation.
If nobody ever guessed 000, or it was guessed exactly 0.1% of the time, it wouldn't be insecure for 90% of people to have a secret number of 000.
At the other extreme, if 90% of people guess 000, then it's insecure to have a secret number of 000, even if it was perfectly randomly generated.
People can learn about biases in generation, and use that to inform their guesses. So biases in generation indirectly matter. But inherent biases in guessing are just as important. Being a perfect RNG is not enough if your keyspace is small.
If nobody ever guessed 000, or it was guessed exactly 0.1% of the time, it wouldn't be insecure for 90% of people to have a secret number of 000.
At the other extreme, if 90% of people guess 000, then it's insecure to have a secret number of 000, even if it was perfectly randomly generated.
People can learn about biases in generation, and use that to inform their guesses. So biases in generation indirectly matter. But inherent biases in guessing are just as important. Being a perfect RNG is not enough if your keyspace is small.