Websockets uses insecure random for Sec-WebSocket-Key and mask

[chethega]

Consider the this and this line.

Here, we use the base rand, which uses Mersenne twister. This is not a cryptographically secure random source.

Per rfc6455, "The masking key needs to be unpredictable; thus, the masking key MUST be derived from a strong source of entropy, and the masking key for a given frame MUST NOT make it simple for a server/proxy to predict the masking key for a subsequent frame."

After reading the websockets spec and the paper that lead to this requirement, this is not a severe problem. Still, would be better to fix this and use a secure random source.

A possibility could be to simply use const CSPRNG = Random.RandomDevice().

Cf general discussion here.

[quinnj]

This is a good suggestion; a PR to implement this is here