Hacker News Reader

Comment by cryptoz | Hacker News Reader

It's open to the public‽ Seems like a bad idea to let a potential spy in there to set up a camera and de-randomize this source of random info. Also, the headline on HN declares it a fact that the lava lamps are assisting in the encryption, but the article is careful to say "maybe", "might", etc.

This seems wildly insecure and much more likely to represent a weak link than to actually aid in randomness.

View on HN

You would also need to eavesdrop on a geiger counter in Singapore that's measuring radiation, and a chaotic pendulum in London: https://www.fastcodesign.com/90137157/the-hardest-working-of...

The effort involved in doing this would maybe be as taxing as brute-forcing the keys in the first place. It seems gimmicky but they're almost surely producing reliable random data that would be almost impossible to simulate otherwise.

Even if the data is not random it doesn't weaken your kernel prng by writing non-random data to urandom.

Don't overcomplicate your threat model with non-existent risks

https://blog.cr.yp.to/20140205-entropy.html

Didn't DJB somewhere describe a PRNG model in which this is not true and you shouldn't let an adversary give you PRNG seeds?

(I don't have any problem with what CloudFlare is doing.)

Edit: While I was writing this comment, drewbug linked to the exact DJB post I was thinking of. Thanks!

Someone observing the lava lamps still can't control their appearance.

It's answered here: https://blog.cloudflare.com/lavarand-in-production-the-nitty...

The nice thing about randomness is that given a random blob, you can xor a non random blob & it's just as random. So this is one input of entropy amongst a cocktail of sources

That’s true statically. Keeping that true with changes over time is HARD. For example, it matters that the non random blob never gets to see either the random input or the output.

Actually that's the property of xor, not randomness. Data xor uniform distribution -> results in uniform distribution. It doesn't have to be random.

Reply on news.ycombinator.com