{"action":"closed","issue":{"url":"https://api.github.com/repos/kkapsner/CanvasBlocker/issues/76","repository_url":"https://api.github.com/repos/kkapsner/CanvasBlocker","labels_url":"https://api.github.com/repos/kkapsner/CanvasBlocker/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/kkapsner/CanvasBlocker/issues/76/comments","events_url":"https://api.github.com/repos/kkapsner/CanvasBlocker/issues/76/events","html_url":"https://github.com/kkapsner/CanvasBlocker/issues/76","id":171064286,"number":76,"title":"RNG is probably flawed","user":{"login":"Bergfried","id":5727196,"avatar_url":"https://avatars.githubusercontent.com/u/5727196?v=3","gravatar_id":"","url":"https://api.github.com/users/Bergfried","html_url":"https://github.com/Bergfried","followers_url":"https://api.github.com/users/Bergfried/followers","following_url":"https://api.github.com/users/Bergfried/following{/other_user}","gists_url":"https://api.github.com/users/Bergfried/gists{/gist_id}","starred_url":"https://api.github.com/users/Bergfried/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bergfried/subscriptions","organizations_url":"https://api.github.com/users/Bergfried/orgs","repos_url":"https://api.github.com/users/Bergfried/repos","events_url":"https://api.github.com/users/Bergfried/events{/privacy}","received_events_url":"https://api.github.com/users/Bergfried/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kkapsner/CanvasBlocker/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"kkapsner","id":1105157,"avatar_url":"https://avatars.githubusercontent.com/u/1105157?v=3","gravatar_id":"","url":"https://api.github.com/users/kkapsner","html_url":"https://github.com/kkapsner","followers_url":"https://api.github.com/users/kkapsner/followers","following_url":"https://api.github.com/users/kkapsner/following{/other_user}","gists_url":"https://api.github.com/users/kkapsner/gists{/gist_id}","starred_url":"https://api.github.com/users/kkapsner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kkapsner/subscriptions","organizations_url":"https://api.github.com/users/kkapsner/orgs","repos_url":"https://api.github.com/users/kkapsner/repos","events_url":"https://api.github.com/users/kkapsner/events{/privacy}","received_events_url":"https://api.github.com/users/kkapsner/received_events","type":"User","site_admin":false},"assignees":[{"login":"kkapsner","id":1105157,"avatar_url":"https://avatars.githubusercontent.com/u/1105157?v=3","gravatar_id":"","url":"https://api.github.com/users/kkapsner","html_url":"https://github.com/kkapsner","followers_url":"https://api.github.com/users/kkapsner/followers","following_url":"https://api.github.com/users/kkapsner/following{/other_user}","gists_url":"https://api.github.com/users/kkapsner/gists{/gist_id}","starred_url":"https://api.github.com/users/kkapsner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kkapsner/subscriptions","organizations_url":"https://api.github.com/users/kkapsner/orgs","repos_url":"https://api.github.com/users/kkapsner/repos","events_url":"https://api.github.com/users/kkapsner/events{/privacy}","received_events_url":"https://api.github.com/users/kkapsner/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-08-14T15:37:00Z","updated_at":"2016-08-15T11:27:31Z","closed_at":"2016-08-15T11:27:31Z","body":"Thank you very much for this addon. I am really concerned when it comes to privacy so this is why I use your addon in the first place. And it is also the reason for this post.\r\n\r\nThe RNG currently in use appears to be broken, at least from what I can tell. In `lib/randomSupplies.js` there is a line that reads `Math.floor(Math.random() * 0xFF)`. Apparently, it is part of a loop that is supposed to create `128 * 8 = 1024` bits of random noise. However, in reality, it will always be less noisy than expected. The reason is that `Math.random` will always return a value less than 1, so due to said expression, `0xFF` will never appear in any of the 128 bytes. The fix is easy in this case: replace `0xFF` with `0x100`. But I think the following is even simpler (and probably more secure):\r\n\r\n    persistentRnd[domain] = new Uint8Array(128);\r\n    window.crypto.getRandomValues(persistentRnd[domain]);\r\n\r\nIt would be really helpful if you add comments to your code (that is, the algorithms in `exports.persistent` and `exports.nonPersistent`, respectively) so we can understand what it is supposed to do. Otherwise, it just looks like magic that is hard to understand and, therefore, not secure. And since this addon is all about security, understanding the algorithms is actually important."}}
{"actor":{"display_login":"kkapsner"}}