Timeline for Why is Math.random() not designed to be cryptographically secure?
Current License: CC BY-SA 4.0
38 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 20, 2021 at 11:49 | history | edited | Glorfindel | CC BY-SA 4.0 |
broken link fixed, cf. https://meta.stackexchange.com/q/361812/295232
|
| May 15, 2019 at 3:28 | history | edited | forest | CC BY-SA 4.0 |
added 5 characters in body
|
| Aug 4, 2018 at 6:31 | history | edited | forest | CC BY-SA 4.0 |
linked to chromium and firefox bug reports
|
| S Mar 24, 2018 at 2:07 | history | bounty ended | Conor Mancone | ||
| S Mar 24, 2018 at 2:07 | history | notice removed | Conor Mancone | ||
| Mar 23, 2018 at 23:02 | answer | added | Bobby Baucom | timeline score: -1 | |
| S Mar 22, 2018 at 17:56 | history | bounty started | Conor Mancone | ||
| S Mar 22, 2018 at 17:56 | history | notice added | Conor Mancone | Reward existing answer | |
| Mar 22, 2018 at 13:51 | answer | added | Spence | timeline score: 4 | |
| Mar 22, 2018 at 2:18 | comment | added | President James K. Polk | @forest: fair enough, it should indeed not be a problem on any modern platform, desktop or mobile. | |
| Mar 22, 2018 at 0:05 | comment | added | forest | @JamesKPolk You only need 128 bits, once (ChaCha takes 256 bits but it's perfectly acceptable to repeat the key twice, as long as you change the constant). By the time any browser loads, plenty of entropy will be available to the system. On microcontrollers that run a JavaScript interpreter for whatever reason and have no source of good entropy, they could just use XorShift128+ (since I'm not suggesting a change to the standards). | |
| Mar 21, 2018 at 19:41 | comment | added | President James K. Polk | Comparing the performance XorShift128+ to ChaCha8 is only part of the performance question. A CSPRNG must collect sufficient entropy before it is ready to emit any secure random bits. This can take significant wall-clock time. | |
| Mar 21, 2018 at 1:41 | comment | added | forest | @Rolfツ This issue has been discussed extensively in answers and comments. The performance of XorShift128+ compared to, say ChaCha8 as used for returning individual floating point numbers. | |
| Mar 21, 2018 at 1:31 | history | edited | forest | CC BY-SA 3.0 |
deleted 52 characters in body
|
| Mar 20, 2018 at 16:27 | comment | added | ArrowCase | Blink is a rendering engine. V8 is the JavaScript implementation used by Chrome and Opera. | |
| Mar 20, 2018 at 14:12 | comment | added | Rolf ツ | Performance maybe? Obtaining a cryptographically secure random value is way more CPU heavy than a pseudo random value. While designing a game (in C++) I specifically had to choose a random algorithm that was offering decent performance. | |
| Mar 20, 2018 at 5:10 | comment | added | MichaelK | @forest Opportinistic security? Words I never thought anyone would say. | |
| Mar 20, 2018 at 3:05 | comment | added | forest | In other words, you are saying that fail-safe design is a bad thing. | |
| Mar 20, 2018 at 3:00 | comment | added | forest |
@MichaelK But there are so many other examples where that is not true. You do not have to say that a feature has certain qualities anywhere. Keep the standard as it is and opportunistically improve security. A good example is any modern C compiler. Would you claim that it is foolish for the compiler to support FORTIFY_SOURCE? Why not just educate people so they don't make vulnerable programs? Why have GCC protect them? I don't know of anyone who is sloppy in their code because they think GCC will protect them, but I know of many people who have been saved by GCC's security measures.
|
|
| Mar 19, 2018 at 12:42 | comment | added | MichaelK | Saying that a feature has certain qualities implies obligation. Obligation incurs cost, first to implement the obligation, second to keep it up to date, and third when you find out that you have not lived up to your obligation. This is especially so when you have obligated to deliver secure functionality. | |
| S Mar 19, 2018 at 8:55 | history | mod moved comments to chat | |||
| S Mar 19, 2018 at 8:55 | comment | added | Jeff Ferland♦ | Comments are not for extended discussion; this conversation has been moved to chat. | |
| Mar 19, 2018 at 4:20 | history | edited | forest | CC BY-SA 3.0 |
grammar fix, misc rewording
|
| Mar 19, 2018 at 4:14 | history | edited | forest | CC BY-SA 3.0 |
respond to claims of creating a false sense of security
|
| Mar 18, 2018 at 14:37 | history | edited | forest | CC BY-SA 3.0 |
misc improvements
|
| Mar 18, 2018 at 14:15 | history | edited | forest | CC BY-SA 3.0 |
small grammar fix, added link to floating point standard
|
| Mar 16, 2018 at 22:04 | answer | added | Cort Ammon | timeline score: 5 | |
| Mar 16, 2018 at 3:36 | vote | accept | forest | ||
| Mar 16, 2018 at 3:29 | answer | added | Rob | timeline score: 14 | |
| Mar 15, 2018 at 15:10 | answer | added | Eric Lippert | timeline score: 462 | |
| Mar 15, 2018 at 11:56 | answer | added | Jared Smith | timeline score: 20 | |
| Mar 15, 2018 at 11:39 | answer | added | richzilla | timeline score: 9 | |
| Mar 15, 2018 at 11:13 | answer | added | Luc | timeline score: 74 | |
| Mar 15, 2018 at 10:22 | answer | added | Philipp | timeline score: 119 | |
| Mar 15, 2018 at 10:10 | answer | added | allo | timeline score: 5 | |
| Mar 15, 2018 at 7:53 | history | tweeted | twitter.com/StackSecurity/status/974191922028957696 | ||
| Mar 15, 2018 at 7:15 | answer | added | LSerni | timeline score: 16 | |
| Mar 15, 2018 at 6:11 | history | asked | forest | CC BY-SA 3.0 |