Predicting the next Math.random() in Java
franklinta.com
Predicting the next Math.random() in Java
1–10 of 58 posts
Re: Predicting the next Math.random() in Java
#2That is a nice not-so-subtle reminder. When a PRNG says it is insecure, it is insecure. When a PRNG says it is secure, it might be - get someone very clever to check it first.
Re: Predicting the next Math.random() in Java
#3How dangerous this prediction can be? I can't stop thinking of java-backended real money, poorly written, gaming websites.
Re: Predicting the next Math.random() in Java
#4Hah, funny! I recently did the same to circumvent CSRF-protection based on java.util.Random. Here's my solver in JS: https://peks.as/experiments/random/
Re: Predicting the next Math.random() in Java
#5Reminded me an interesting Java Random issue with small seeds and power of two intervals:
for(int i = 0; i Re: Predicting the next Math.random() in Java
#6How dangerous this prediction can be? I can't stop thinking of java-backended real money, poorly written, gaming websites.
It's well known. If someone is doing anything with real money, and isn't doing something more secure than this, they've already been hacked, are already out of business, and are already not allowed to write code that deals with real money.
Re: Predicting the next Math.random() in Java
#7How dangerous this prediction can be? I can't stop thinking of java-backended real money, poorly written, gaming websites.
Real random numbers are useless because everything follow some distribution. Actually random generators in programming languages should be called pseudorandom to avoid confusions.
Re: Predicting the next Math.random() in Java
#8If you want cryptographic-quality random numbers, both Java and Javascript have them. Math.random() is simply a super-fast decent RNG.
Example:
var buf = new Uint32Array(10);
window.crypto.getRandomValues(buf);
console.log(buf);
[4027145128, 258543382, 1205615760, 2665675208, 4033127244,
2280027866, 3983484449, 510932333, 1911490534, 2609399642]
IE11 has Crypto.getRandomValues(...)
Java has SecureRandom:
http://docs.oracle.com/javase/6/docs/api/java/security/Secur...
Re: Predicting the next Math.random() in Java
#9How dangerous this prediction can be? I can't stop thinking of java-backended real money, poorly written, gaming websites.
Those likely won't be vulnerable even if they implemented their site using the insecure random function. The reason why this works is that you're the only consumer of Java-randomness, as you add additional consumers it becomes infinitely more difficult.
Consumers also don't need to be users, AI players and cards dealt will also consume randomness. You would also need to know the mapping from the random output into the game (e.g. in card games are there multiple decks each assigned 1 value of entropy? 2 decks, 3 decks, etc? Plus any mappings or conversions will make this impossible (as you wouldn't know the real output of the random number generator)).
Ultimately it will likely work pretty reliably locally, but as soon as you stick it on a web service then all bets are off.
Re: Predicting the next Math.random() in Java
#10nitpick, Firefox doesn't use Rhino, it uses SpiderMonkey which is C++.
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Sp...