I'm having some difficulties doing this the right way (as much as it can go).
Some time ago, I've asked a question here, asking for help on how to implement sending an access link through email.
First of, I know this is terribly insecure from the beginning, but we have our reasons so let's leave that aside.
The idea basically is sending an email with a long-living link that gives access to a very specific area of our app.
The Attack I Want To Avoid
A user guessing another access key using his own.
What I Was Suggested
In my former question, I was suggested using a random string as the access key which'll be saved in my database.
I've been doing a bit of research, and I'm worried my PRNG won't be random enough, especially since I'm generating a bunch of access keys at a time.
I've been traumatized by C# lessons in school where my "random" function would change output every 1000 or so iterations.
I'm thinking about using Random.org to have a truly random seed, but that seems a bit of an overkill.
I have 4 options which I want to check with you guys before I succumb to Random.org -
- Just using the PRNG, checking beforehand how it behaves (Node.js's PRNG), maybe implementing a
sleep(500)between generations. If the result are similar but not identical, hash it with SHA-2.
- Taking the user ID and hashing it thoroughly with PBKDF2 (does it matter?), save it in DB and just send that.
- Using an implemented PRNG such as Mersenee Twister, as suggested in this stackoverflow question.
- Other stuff which I know nothing about such as a cipher which only I know how to decrypt, or JWTs like I'm using for my regular users.
What do you think?
Thanks for any assist! I appreciate taking the time to read this.