I've released a new version of bitaddress.org with improvements to the entropy collection:
https://www.bitaddress.org/bitaddress.org-v2.8.0-SHA1-87dcf19f02ee9fb9dd3a8c787bcf52eef944aa82.html - more entropy from browser fingerprinting for PRNG seed
- user can add entropy through URL hash tag
- seed mouse movement as 16-bit number
- whole seed pool initially filled by window.crypto.getRandomValues
- added textbox as an alternative input source for entropy
- address will not generate without a minimum amount of human added entropy from mouse or keyboard
- discard mouse movements less than 40ms apart
- visualize points of entropy collection from the mouse
@mikewoods, thank you for the ideas about discarding mouse movements less than 40ms apart and about visualizing the mouse collection points to encourage people to move the mouse more randomly.
I made this notice on your thread because naturally these two JavaScript solutions are being compared.
I believe where the scripts differ now:
offlineaddress.com) Is not seeding a PRNG it is bypassing the PRNG and using the mouse points as the byte source for the private keys. It requires 32 bytes from mouse movements for each private key.
bitaddress.org) Uses a PRNG that is seeded with a 256 byte array. That initial seed is used by the PRNG to generate 32 bytes for each address on the page based on the same 256 byte seed pool. To inject entropy into the PRNG's seed pool browser fingerprinting, time, key presses, mouse movements and hardware randomness from the OS are all xor'd together. As well the output of the PRNG is xor'd with the hardware randomness.