search

Natetodd55 / java-Client-Server

0 stars 0 forks source link

Introduced protections against predictable RNG abuse #5

Closed pixeebot[bot] closed 5 months ago

pixeebot[bot] commented 5 months ago

This change replaces all new instances of java.util.Random with the marginally slower, but much more secure java.security.SecureRandom.

We have to work pretty hard to get computers to generate genuinely unguessable random bits. The java.util.Random type uses a method of pseudo-random number generation that unfortunately emits fairly predictable numbers.

If the numbers it emits are predictable, then it's obviously not safe to use in cryptographic operations, file name creation, token construction, password generation, and anything else that's related to security. In fact, it may affect security even if it's not directly obvious.

Switching to a more secure version is simple and our changes all look something like this:

- Random r = new Random();
+ Random r = new java.security.SecureRandom();
More reading * [https://owasp.org/www-community/vulnerabilities/Insecure_Randomness](https://owasp.org/www-community/vulnerabilities/Insecure_Randomness) * [https://metebalci.com/blog/everything-about-javas-securerandom/](https://metebalci.com/blog/everything-about-javas-securerandom/) * [https://cwe.mitre.org/data/definitions/330.html](https://cwe.mitre.org/data/definitions/330.html)

Powered by: pixeebot (codemod ID: pixee:java/secure-random)

pixeebot[bot] commented 5 months ago

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

pixeebot[bot] commented 5 months ago

Switching to SecureRandom is almost always the right tradeoff. This chart (source) shows the true lack of randomness (re: predictability) of Random, if you needed more convincing:

If there are other concerns about this change, I'd love to hear about them!

pixeebot[bot] commented 5 months ago

This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know!

You can also customize me to make sure I'm working with you in the way you want.