user73223: The library BitcoinJS (https://github.com/bitcoinjs) has a method called makeRandom(). Where does its entropy (randomness) come from? Is it as secure as the method from http://bitaddress.org/ (moving around the mouse), or even more so?

user38618: This code calls this code, which calls crypto.getRandomValues, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as one's browser was not hacked.

73223: <p>The library BitcoinJS (<a href="https://github.com/bitcoinjs" rel="nofollow noreferrer">https://github.com/bitcoinjs</a>) has a method called <code>makeRandom()</code>. Where does its entropy (randomness) come from? Is it as secure as the method from <a href="http://bitaddress.org/" rel="nofollow noreferrer">http://bitaddress.org/</a> (moving around the mouse), or even more so?</p>
 38618: <p><a href="https://github.com/bitcoinjs/bitcoinjs-lib/blob/170328341bdcf2a22d6ee6df1df587ea4e83c8a9/src/ecpair.js#L90" rel="nofollow noreferrer">This</a> code calls <a href="https://github.com/crypto-browserify/randombytes/blob/master/browser.js#L25" rel="nofollow noreferrer">this</a> code, which calls <a href="https://developer.mozilla.org/en-US/docs/Web/API/RandomSource/getRandomValues#Example" rel="nofollow noreferrer"><code>crypto.getRandomValues</code></a>, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as one's browser was not hacked.</p>
