JavaScript class
SecureRandom() has a bug in it and doesn't generate really secure keys.How is it related to cryptocurrencies?
There are numerous browser-based cryptocurrency products that still use popular
SecureRandom() JS class. JavaScript is very popular for creating browser-based products but isn't a really good thing to use for cryptography purposes. The main problem is that JS is not a type-safe language.
Type safety is a complex topic and there's no one agreed definition of what exactly a "type-safe" language is, but by almost any definition of it, JavaScript is not type-safe. It means that JS doesn't really discourage or prevent type errors that are impermissible in cryptography.
The conclusion is, all crypto wallets generated by JS tools inside browsers had (and some - still have!) keys that are predictable enough to crack by brute-force attack. Yes, such keys have the proper length (cryptography-wise) but less than 48 bits of entropy due to the bug in JavaScript class.
Deep technical explanation.
What to do now?
Actually, it's not much to do about it. Like all good cryptocurrency bugs, this one isn’t new at all — here’s Greg Maxwell talking about it nearly three years ago (51:00 on):
This problem affects you if you:
- use old cryptocurrency addresses
- they were generated with JavaScript, i.e., in a web browser
- BitAddress pre-2013;
- bitcoinjs before 2014;
- current software that uses outdated repos from Github.
- move your funds out of those addresses
- don’t use them again
Some interesting facts:
JavaScript was originally called LiveScript. It wasn't developed by Sun Microsystems (as Java) and there was no good reason to rename LiveScript to JavaScript. This led to confusion that JavaScript is somehow related to Java, but JavaScript is a different language, it has more in common with functional languages like Lisp or Scheme than with Java.
JavaScript is an actual high-level, interpreted programming language, not the script, as the -Script suffix suggests.
Posted from my blog with SteemPress : https://coinatory.com/2018/04/19/old-javascript-bug-is-still-a-security-threat-to-cryptos/
Hey, just wanted to let you know I gave you an upvote because I appreciate your content! =D See you around
cryptos are so... cryptos =)))
sometimes I feel that "core development team" of some cryptos looks like this
