Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The major sites don't do this. We know because many people out there collect literally millions of poker hands observed on these sites and mine the data for every kind of statistic you can think of. If anything significant was out of whack they would have picked it up. Look at the 'online poker' section of the twoplustwo forums for example.

The random number generators used by these sites are hardware systems that use micro fluctuations in ambient temperature (for example) as a source of entropy and they are very careful to use enough bits of entropy for every card shuffled.



The random number generators used by these sites are hardware systems that use micro fluctuations in ambient temperature (for example) as a source of entropy and they are very careful to use enough bits of entropy for every card shuffled.

It's amusing to realize that they could just read from dev/urandom with zero risk. They're probably not running Linux, but still.

So, for anyone who's wondering if you need this, or if this adds any extra security: probably not. There's no reason not to use the extremely well-tested and well-understood /dev/urandom.


But their devs can't charge as much if they say "I implemented the random number generator, is one line of bash code" rather than "I created a thermal system that is connected to our server where we will use its data as seeds to generate cryptographically random numbers".

Capitalism, we all play it ;)


Actually for something cryptographic or sensitive in nature you would want to read from /dev/random. The "u" in urandom stands for unlimited, basically if the entropy pool runs dry, reads from /dev/urandom will still return data but that data doesn't necessarily have a significant amount of entropy in it. Reads from /dev/random however will block and wait for more entropy if the entropy pool runs dry.


No, this is an urban myth perpetuated by a broken man page. Cryptographic software should use urandom, not random.


tptacek has addressed this concern many times before: https://hn.algolia.com/?q=author:tptacek%20urandom#!/comment...

The summary is that it's a myth.


FWIW, Windows has an equivalent of /dev/urandom. http://msdn.microsoft.com/en-us/library/windows/desktop/aa37...


Is CryptGenRandom equally secure as /dev/urandom, or are there ways to use it wrong?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: