生成没有时间的随机字符串？

Question

I know how to generate a random string in go using Runes & seeding rand.Init with time.UnixNano(). My question is, is it possible (with the stdlib) to seed rand without using the current timestamp (secure)?

Furthermore, I ask because isn't just relying on time to generate a random string for a sensitive operation insecure/a vulnerability?

Answer 1

For sensitive operations use crypto/rand instead of math/rand:

Package [crypto/] rand implements a cryptographically secure random number generator.

Note that you don't need (you can't) seed crypto/rand.