Debunking Myths: /dev/urandom Is Secure and Preferred for Cryptographic Randomness
By
signa11
Slow-proofed and worth the wait. Worth its weight in flour.
Summary
This article debunks common myths about /dev/urandom and /dev/random on UNIX-like systems. It explains that /dev/urandom is actually the preferred source of cryptographic randomness, contrary to the myth that it is insecure. Both /dev/urandom and /dev/random use the same cryptographically secure pseudorandom number generator (CSPRNG), and their differences are minor and unrelated to security quality. The article aims to correct widespread misconceptions in the developer and system administration community.
Key quotes
· 3 pulled/dev/urandom is the preferred source of cryptographic randomness on UNIX-like systems.
Both /dev/urandom and /dev/random are using the exact same CSPRNG (a cryptographically secure pseudorandom number generator).
There are a few things about /dev/urandom and /dev/random that are repeated again and again. Still they are false.
You might also wanna read
wolfCOSE: A Lightweight COSE + CBOR Library for Embedded Systems with PQC and FIPS 140-3 Support
wolfCOSE is a lightweight C library implementing CBOR (RFC 8949) and COSE (RFC 9052/9053) for embedded systems, using wolfSSL as the crypto
github.com·1d ago
Anthropic launches Claude Security beta for codebase vulnerability scanning
Anthropic has released Claude Security, a defensive security tool within Claude Code on the web, from closed preview to beta for Claude Ente
thenewstack.io·1d ago
How LinkedIn's 2012 Breach Exposed the Dangers of Unsalted Password Hashes
This article examines the 2012 LinkedIn breach where attackers cracked millions of passwords using fast, unsalted hashes like MD5 and SHA-1.
hendryadrian.com·1d ago
AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator
A malicious npm package named mouse5212-super-formatter, identified by OX Security, was caught leaking its own hardcoded GitHub token. This
infosecurity-magazine.com·1d ago
How a botnet abused my open source project's cloud version to phish 14,000 people
The author, who runs an open source project management tool called Kaneo, discovered that a botnet had abused the hosted cloud version of th
andrej.sh·2d ago
176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers publi
sonatype.com·2d ago