for some reason I cannot require secure random