Stormpath: Insecure RNGs are “ok with us”

github.com

4 pointssarciszewski3 comments

Thanks, Sarciszewski for raising this. Apologies for deleting the comment - that was a fat finger. We're using RGN for non-security related operations. If you want to learn more about the issue and join the full discussion, the thread is here https://github.com/stormpath/stormpath-sdk-php/issues/132

If you want to chat directly, feel free to reach out us at support@stormpath.com. Happy to talk!

The comment was deleted, but: https://archive.is/QEQPO

Wow. Just wow.

If you're going to market your software like this:

>Stormpath is the first easy, secure user management and authentication service for developers. This is the PHP SDK to ease integration of its features with any PHP language based application.

You should probably at least google what your crypto functions do.

Reply on news.ycombinator.com