dalnefre/tart-marshal — pull request #2 by tristanls (2013-12-24 22:26:21+00:00)
Title: Use crypto.randomBytes() for token generation.

Some time fairly recently I learned that we can use `crypto.randomBytes(size)` to generate cryptographically secure random bytes. As `sha1` generates a 20 byte hash, using `crypto.randomBytes(size)` might be more straightforward way of doing this.

As these tokens will end up exposed to the outside world, we may need to consider more than 160 bits (20 bytes) and instead use purely random tokens where the token space should be large enough so that no matter how many tokens we generate, they will still be sparsely distributed in the entirety of the token space itself (to make guessing them unfeasible even with billions/trillions/++ of them in existence). For example, 41 bytes would give us 328 bits, which would be a space large enough to enumerate all atoms in the observable universe. Using `crypto.randomBytes(size)` paves the way for us to tweak the token space as necessary.

[crypto.randomBytes(size)](http://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback)