magento/magento2 — pull request #677 by colinmollenhour (2014-09-26 23:49:01+00:00)
Title: Never seed a RNG with a timestamp\!

Seeding a random number generator with a timestamp allows an attacker with knowledge about when the secret was generated to greatly reduce the amount of work needed to crack the secret. PHP automatically seeds the RNG with a random number, so seeding is not necessary in the first place.

In this case only the microsecond portion of microtime is used and an attacker would probably not know the microtime, so theoretically there are 1 million possible seeds best case. While 1 million is still a big number, it is much smaller than PHP_INT_MAX (2.14 billion).

This should also be fixed in Magento 1 (actually far more important since Magento 1 *always* uses mt_rand).