Java: Random vs SecureRandom

Every service that has a login mechanism should also have the option to reset the password. But how to do it right?

Password reset functionality usually works more or less like this.
The user provides the email address associated with the account on the website.
At this point, the server checks whether such user exists in the database.
If so - it generates a unique string, which is then saved and sent in an email.
Then the user opens the email and clicks on the link that contains this unique key.
The server verifies if a unique string exists in the database - and if everything is correct, you can change the password.

So how to generate this unique string?
Probably we will think of using the Random class that lets us generate unique sequences of numbers.

The Java Random class is a pseudo random number generator.
This means that based on a small amount of information - the so-called seed, it generates deterministically consecutive pseudo-random numbers.

The seed can be defined by the user - or like in our case, set automatically by Java.
So it is enough to guess what seed was used to be able to generate the next token on your own computer.

#from0topentestinghero #security #java

[hellraider]

clear and precise. Thanks for the Video !!