Fixing insufficient randomness

Pseudo-random numbers may suffice for less than critical operations, but these numbers are not genuinely random. Computers use mathematical formulas to produce these pseudo-random numbers, but they are not random enough to be used in cryptographic operations such as salt creation. The predictability and deterministic nature of the data that's produced by these random methods and function generators increases the chance of a password hash being cracked, thus causing hash collision attacks.

Getting ready

Using Visual Studio Code, open the sample Online Banking app folder at \Chapter13\insufficient-randomness\before\OnlineBankingApp.

How to do it…

Let's take a look at the steps for this recipe:

1. Type the following command in the Terminal to build the sample app to confirm there are no compilation errors:

   dotnet build

2. Open the \Chapter13\insufficient-randomness\before\OnlineBankingApp\Areas\Identity\PasswordHasher.cs...