search

jonschlinkert / randomatic

Easily generate random strings like passwords, with simple options for specifying a length and for using patterns of numeric, alpha-numeric, alphabetical, special or custom characters. (the original "generate-password")
https://github.com/jonschlinkert
MIT License
183 stars 25 forks source link

Math.random() is not #4

Closed tomByrer closed 6 years ago

tomByrer commented 8 years ago

Shouldn't use built in JS Math.random() since it will repeat itself; too dangerous to use for 'Unique ID' etc. https://medium.com/@betable/tifu-by-using-math-random-f1c308c4fd9d#.uskhjv9vc

Might be a while before I can even copy/paste & quick test a solution from there, let alone add the 'white noise' & other repeating tests.

tr;dr: "use urandom. In browser you can use crypto.getRandomValues()" I'm not sure if V8's crypto.getRandomValues() can be exposed in node; seems to have its own crypto lib. But node does have crypto.randomBytes(size[, callback])

ronkorving commented 7 years ago

I would love to see crypto.randomBytes being used, it's the only thing keeping me from loving this library and using it today.

jonschlinkert commented 7 years ago

I'd like to see it implemented as well, I'd take a pr if someone wants to give it a go.

tomByrer commented 7 years ago

Nice wrapper, but should we worry about in-browser usage @jonschlinkert ? https://github.com/crypto-utils/random-bytes

jonschlinkert commented 7 years ago

We should try to address it at least. I think there is a browserify plugin for crypto, but I haven't looked at it, no idea if it's a viable solution for this. that does look like a nice wrapper

jonschlinkert commented 6 years ago

btw, if someone wants to propose a PR I'd be happy to consider one. Please start with an issue to discuss the algorithm, thanks!