Want to create an interactive transcript for this episode?
Podcast: DEF CON 22 [Materials] Speeches from the Hacker Convention.
Episode: Dan Kaminsky - Secure Random by Default
Description: Secure Random By Default
Dan Kaminsky Chief Scientist, White Ops
As a general rule in security, we have learned that the best way to achieve security is to enable it by default. However, across operating systems and languages, random number generation is always exposed via two separate and most assuredly unequal APIs -- insecure and default, and secure but obscure.
Why not fix this? Why not make JavaScript and PHP and Java and Python and even libc rand() return strong entropy? What are the issues stopping us? Should we just shell back to /dev...