Assessment of the 2014 JavaScript generator

Security researcher Juliano Rizzo's follow-up to his own post held at julianor-2085162138956374408, which he quotes here. He tentatively attributes the 2014 code to a named account, with a question mark, and assesses it: the proposed generator makes the secret keys crackable, whereas using a modern browser's Math.random directly would not, and while Math.random is not a cryptographically secure generator, Xorshift128+ is a better PRNG than the multiply-with-carry construction shown. His summary line is that it is easy to make a cryptographic system weaker. Held as the technical substance behind the parallel entropy failure he raised, which is a JavaScript wallet library and not COLDCARD firmware; the same parallel is drawn at crypto_mags-2085586783803453912. The attribution of authorship and the crackability assessment are the poster's own and are not verified here.