You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Okay, we probably wouldn't use 4 characters (and what's up with those characters?), but you get the idea. The [Efficiency](#Efficiency) explains the 3rd argument of `false`.
218
+
Okay, we probably wouldn't use 4 characters (and what's up with those characters?), but you get the idea.
219
219
220
220
Suppose we have a more extreme need. We want less than a 1 in a trillion chance that 10 billion base 32 strings repeat. Let's see, our risk (trillion) is 10 to the 12th and our total (10 billion) is 10 to the 10th, so:
221
221
@@ -372,11 +372,11 @@ Compare that to the `entropy-string` scheme. For the example above, slicing off
372
372
373
373
But there is an even bigger issue with the previous code from a security perspective. `Math.random`*is not a cryptographically strong random number generator*. **_Do not_** use `Math.random` to create strings used for security purposes! This highlights an important point. Strings are only capable of carrying information (entropy); it's the random bytes that actually provide the entropy itself. `entropy-string` automatically generates the necessary bytes needed to create cryptographically strong random strings using the `crypto` library.
374
374
375
-
However, if you don't need cryptographically strong random strings, you can request `entropy-string` use `Math.random` rather than the `crypto` library by passing in a 3rd argument of `false`:
375
+
However, if you don't need cryptographically strong random strings, you can request `entropy-string` use `Math.random` rather than the `crypto` library by using `entropy.stringRandom`:
376
376
377
377
```js
378
378
constentropy=require('entropy-string')
379
-
let string =entropy.string(80, entropy.charSet32, false)
379
+
let string =entropy.stringRandom(80, entropy.charSet32)
0 commit comments