Hacker News new | ask | show | jobs
by byoung2 1397 days ago
When there is nothing to be gained from guessing the random number (to the point where you could just hardcode it, then it is safe to use a weak random number generator. Examples would be randomizing background images in a website header or picking a random quote of the day from a list.

If there is a benefit to guessing the random number, then use a secure random number generator. Anything related to passwords, private keys, or anything you expect to be reasonably hard to guess, use a secure number generator.

1 comments

Weak generators can also cause trouble in non-security-related applications. Monte Carlo simulations or integrations run with generators that don't truly randomly sample with respect to the underlying structure of the problem can go quite badly wrong. This usually requires a truly awful generator, but you'd be surprised what can happen. These days there is really no excuse to use anything worse than the Mersenne Twister for mathematical uses.
I think what you're talking about would be random numbers with a poor distribution, which is important to distinguish from random numbers with poor unpredictability.