Python: why random should not generate passwords or tokens, and how to use secrets

What happened and what to do

The LWN article explains that Python's random and secrets modules both provide utilities for random values, but only secrets is suitable for security passwords and tokens. For a long time random was used for this purpose, although the documentation stated it was not appropriate for cryptography. In 2015 the core team debated making random secure by default, but in 2016 Python 3.6 added secrets instead. Misuse of random still appears often, which makes it worth reviewing how random number generators are used.

In practice, a company can map in its code the calls to random that produce passwords, reset tokens, API keys, session identifiers or verification codes, and replace them with secrets, such as secrets.token_urlsafe and secrets.choice. An automated check in the continuous integration pipeline, with static analysis rules, prevents the problem from returning to production. It is also worth reviewing flows already deployed, since values generated with random can be predictable even in recent systems.

How the consultancy can help

Wendelmaques can diagnose where random is used to generate secrets in the company's systems and propose a correction plan with a defined scope. Implementation includes replacing it with secrets, automated tests and static analysis rules in the continuous integration pipeline, plus monitored operation in the client's environment.

Next step

Send a short description of your case, including the languages and systems that generate passwords, tokens or keys, and receive a scoped proposal from Wendelmaques.