Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

NO. Relying on SecureRandom is riskier than writing the 5-10 lines of code it takes to read from urandom. Prefer urandom to SecureRandom.

Look what "many eyes" did for the Harmony PRNG.



And urandom is not cross-platform, so if I were going to write a cross-platform library, how would you suggest doing it? By writing an interface to urandom, then an interface to CryptGenRandom (doesn't that require an FFI?), and then manually going through all of the platforms Java can potentially execute on until I can be sure I've covered all my bases?

I'm pretty sure that's going to be more than 5-10 lines of code.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: