secrets module is marketed as a safe alternative to
random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually make reference to the same underlying functions.
For example, the definition of
secrets.randbits is basically a reference to
from random import SystemRandom _sysrand = SystemRandom() randbits = _sysrand.getrandbits
Another example is
secrets.token_bytes which is basically a reference to
random.randbytes, which later ends up calling
def token_bytes(nbytes=None): if nbytes is None: nbytes = DEFAULT_ENTROPY return _sysrand.randbytes(nbytes)
So what is exactly safer? Is this more of a namespace improvement to keep the community from writing their own token-generating code? PEP 506 is not very clear about this IMHO.
Please note this is not about
/dev/urandom and the quality of its entropy.