sexmonad
Joined 13 years ago
Joined 13 years ago
That said, mobile devices really aren't lacking in entropy sources. With all the radios and sensors in a modern smartphone, why do they need additional methods to generate random numbers?
For information security purposes, a cryptographically secure PRNG is typically at least as secure as the encryption algorithms that it protects.
But I'll give two cautions:
1. This device has received less auditing than linux's software crypto. And some HWRNGs are quite bad: https://news.ycombinator.com/item?id=6060636
2. You don't really need that much randomness. After your machine has been on for a while and has seeded correctly, /dev/urandom is just as secure as /dev/random. Entropy is not gasoline - it does not disappear as you use it.
I'd much rather that people used self-signed certs (and browsers had certificate pinning) by default, and could then step up to real CA certificates. Self-signed certs provide almost the same amount of trust that StartCom does.