element-hq/chatterbox

Use crypto.getRandomValues() instead of Math.random()

Opened this issue · 0 comments

Using Math.random() here seems wrong given it's not suited for cryptographic purposes

https://github.com/vector-im/chatterbox/blob/3c8df045579bce9682bd03e44b0e86f6fbb6a8d6/src/random.ts#L17-L29

I haven't looked into it very deeply, but it seems to me this is actually used for stuff that should use cryptographically strong random values

https://github.com/vector-im/chatterbox/blob/3c8df045579bce9682bd03e44b0e86f6fbb6a8d6/src/viewmodels/AccountSetupViewModel.ts#L40-L62