Math.random() (which supposedly generates ~32 bits of entropy
No, it doesn't.
Math.random is not a cryptographically secure random generator, so what it returns does not have any entropy. Entropy is a measure of how unguessable the output is. Since the output of
Math.random is guessable in many circumstances (most easily, by having observed previous outputs, or by observing subsequent outputs), it has zero guaranteed entropy.
If I use Math.random() + Math.random(), both of them generate ~32 bits of entropy.
No, they don't. Even if
Math.random was seeded by a cryptographically secure pseudorandom generator, the first call could have 32 bits of entropy, but the second would be reusing the same entropy, so the entropy would not add up. The second output is correlated to the first, so using it does not increase security.
Math.random returns a number, you're adding two numbers together, not concatenating strings, so the addition loses information. With floating point numbers, the information loss is mainly through rounding; with integers, it would be through wrapping. (Thanks to benrg for pointing this out.)
There is simply no way to generate random numbers securely using
Math.random. You can't make a secure random generator from a non-secure one. Use