Users need a strong random number generator to ensure bid confidentiality about ens HOT 5 CLOSED

Such RNGs are not widely available to regular users

On the contrary, modern browsers implement the crypto API, which provides a method for secure random numbers.

I agree that the use of the term 'salt' is misleading here.

I don't see any way to use deterministic encryption to effectively hide a user's bids here; can you elaborate?

from ens.

You definitely can use a special app to generate a random number, I just wanted to say that users do need one and also need to store all these numbers.

After some thinking I realized that deterministic symmetric encryption would not be more efficient than the plain hash function here, as you would need to open the key.

A better strategy might be to have a secret master key and generate salt as a hash of this key and the domain hash. The account private key can serve as such master key. Thus any Dapp browser that has access to private keys can generate and look up the salt value for any domain hash, without extra randomness at all.

from ens.

We expect most people to use the auction DApp, which uses the crypto API to generate secret keys, and store them in client storage (it also offers a backup option).

from ens.

Special care must be taken to add the secret entropy into bids then. The slider I have seen at one issue here might not deliver enough entropy.

from ens.

The slider is for adding extra value to the bid over and above the max bid, so as to disguise the true amount of the bid. 'Salts' are generated independently of that, and not presented explicitly to the user.

from ens.