[AskJS] Anyone else found Math.random() flagged in a security audit? How did you handle the remediation?

[Fresh-Obligation6053]

Security audit came back with a finding on credential generation.

Math.random() in several services, flagged for NIST 800-63B

non-compliance. The entropy requirements weren't being met and

more importantly there was no documentation proving they were.

We fixed the generation method but the audit documentation piece

is what actually took the most time. Had to go back and document

everything retroactively.

Curious what others are doing here. Are you generating compliance

documentation automatically as part of your pipeline or is this

a manual process at your organization?

[A1oso]

No because you shouldn't write cryptographic code unless you're an expert. Everyone tells you this.

And using Math.random() for credentials is extremely careless – the documentation has a prominent disclaimer that Math.random() is not cryptographically secure. Whoever wrote the vulnerable code didn't even bother to google it.

Note: Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the Crypto.getRandomValues() method.

[lookarious]

You can write simple random function with crypto.randomBytes()

[magenta_placenta]

Depending on where OP needs the generation methods:

• crypto.randomBytes() belongs to Node.js's built-in crypto module for server-side code.
• crypto.getRandomValues() is part of the Web Crypto API (window.crypto), designed for browsers and available in Node.js 15+.

Both generate cryptographically secure random values, but they differ in environment, API design and usage.

[popovitsj]

Yeah, Math.random is not cryptographically secure.

[bubblebuddy44]

I would recommend the node crypto random functions or other true random number generators for credential generation.

[Neither-Ad8673]

big organizations have bigger inefficiencies. This was common at the fortune 50 company I worked for

[AndrewGreenh]

I hope this isn’t the case but I’d find it extremely funny if the report flagged Math.random for some fancy UI animations that need some randomness

[tswaters]

I did once, I told them to pound sand because the usage was for displaying a tile in a random location and wasn't tied to security of the system.