101 reputation
3
bio website zopatista.com
location Cambridge, United Kingdom
age 41
visits member for 1 year, 9 months
seen Jul 11 at 18:16

Invisible framework coding ninja


Dec
18
awarded  Supporter
Dec
18
comment Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?
@thefourtheye: Yes, see Is a rand from /dev/urandom secure for a login key?
Dec
18
comment Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?
@thefourtheye: 1 << 63 + randrange(10) is 64 bits, but just as easy to predict as the example in this answer. So no, it depends on how the bits are generated. If you do it properly, you have a cryptographically strong random number anyway.
Dec
18
comment Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?
@thefourtheye: At issue is predictability. A cryptographically strong random value cannot be predicted (which is why it is cryptographically strong). Sure, you can generate a 64-bit number, but if the attacker can predict the numbers you generate (or can narrow down the possible numbers to a brute-forceable range) then the extra bits add no extra security.
Oct
5
awarded  Citizen Patrol
Nov
27
awarded  Autobiographer