dominictarr/crypto-browserify — pull request #45 by kyledrake (2014-07-22 18:54:06+00:00)
Title: Remove Math.random RNG as it is not cryptographically secure

This pull request removes Math.random from the RNG.

Math.random is not cryptographically secure. It is used in browsers which don't support the new crypto.getRandomValues (https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues), but with the advent of things like Bitcoin, I believe it is not appropriate to provide a mechanism for generating randomness that does not carry the usual guarantees of good security.

The consequence of this PR is that older browsers will no longer work. It is possible to in the future make a way to do legacy support for those that truly don't need real random numbers, but I think the onus is on the developer to reach this problem organically, understand why it exists, and if they decide to, develop a workaround on their own.