Can an Ethereum key generated on a laptop be brute-forced by someone else because of low entropy?

Question

I read this and this tweets. Though, I understand that this issue occur because some people use the same private key mentioned in a blog/forum.

But, on the first tweet, people were talking about the "low entropy" thing.

I want to understand, that key pair generated on an average general purpose laptop can be brute-forced or not ?

As, I'm trying to build an application on nodejs, which shall be generating the account following this blog. I don't want to fall prey to any, low-level brute forcing, activity in which users of my application would be losing their asset.

What can I do to stay safe from such activity? or I'm just being over-cautious?

Answer 1

Generally a working laptop will have sufficient entropy, especially when it's been running for a while, as it has lots of places to get it from, such as you typing on your keyboard and moving the mouse. You're more likely to have trouble with freshly-booted servers, and particularly VMs.

On a general-purpose laptop you should probably be more worried about malware and general software bugs in the code you're using to generate your keys.

However, if you're worried, you may want to test your random number generation (not your actual private keys!) on Gavin Andresen's Random Sanity site: https://www.randomsanity.org/