This sentiment is totally untrue and is why the password resets in PHP apps are the subjects of security conference presentations.<p>It can be surprisingly tricky to predict which random values an application uses will end up being security-critical.