The PHP builtin method rand() is used to generate the secret in https://github.com/chregu/GoogleAuthenticator.php/blob/master/lib/GoogleAuthenticator.php#L78. The PHP docs state «This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a cryptographically secure value, consider using openssl_random_pseudo_bytes() instead.»
The PHP builtin method rand() is used to generate the secret in https://github.com/chregu/GoogleAuthenticator.php/blob/master/lib/GoogleAuthenticator.php#L78. The PHP docs state «This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a cryptographically secure value, consider using openssl_random_pseudo_bytes() instead.»