In https://developers.google.com/accounts/docs/OAuth2Login#createxsrftoken Google recommends using a 130-bit cryptographically-secure random number as an anti-forgery token.
Why do we need so many bits?
If an attacker decides to mount a brute-force attack, wouldn't you be able to detect and lock them out after a few attempts? With as little as 30-bits, you've got 1 million possible tokens for 1000 concurrent users. Guessing the token using brute force seems extremely unlikely.
My point is that 30-40 bits of data seems very hard to break using brute force. So why does Google recommend 130-bits? Isn't that just overkill?
UPDATE: Okay, say you couldn't prevent a brute force attack...
- According to http://www.quora.com/Facebook-product/What-is-the-average-number-of-concurrent-users-on-Facebook Facebook gets 500,000 unique visitors per minute.
- Assuming each user makes one request per second, you've got one request per 2 microseconds.
- Therefore, we can safely assume that (as of today) the most powerful attacker will be capable of sending at most one request per 2 microseconds.
- Next, assume that we expire tokens after 5 minutes. This means that an attacker can fire 1.5*108 requests before the token expires.
- Next, assume we want the attacker to have less than a 1% chance of guessing the token. Therefore we need a pool of 1.5*1010 tokens per active token.
- So if you have 500,000 concurrent users (Facebook) you need 7.5*1015 tokens (one pool per user).
- This means you need 53 bits of data, which again is nowhere near the 130 bits which Google is asking for.