Docs review suggestions

Co-authored-by: Ben Ahmady <[email protected]>

Author: egregius313

java/ql/src/Security/CWE/CWE-330/InsecureRandomness.qhelp

@@ -4,21 +4,21 @@
 <qhelp>
 	<overview>
 		<p>
-			Using a cryptographically weak pseudo-random number generator to generate a security-sensitive value,
-			such as a password, makes it easier for an attacker to predict the value.
+			If you use a cryptographically weak pseudo-random number generator to generate security-sensitive values,
+			such as passwords, attackers can more easily predict those values.
 		</p>
 		<p>
 			Pseudo-random number generators generate a sequence of numbers that only approximates the properties
 			of random numbers. The sequence is not truly random because it is completely determined by a
-			relatively small set of initial values, the seed. If the random number generator is
+			relatively small set of initial values (the seed). If the random number generator is
 			cryptographically weak, then this sequence may be easily predictable through outside observations.
 		</p>
 
 	</overview>
 	<recommendation>
 		<p>
 			Use a cryptographically secure pseudo-random number generator if the output is to be used in a
-			security-sensitive context. As a rule of thumb, a value should be considered "security-sensitive"
+			security-sensitive context. As a general rule, a value should be considered "security-sensitive"
 			if predicting it would allow the attacker to perform an action that they would otherwise be unable
 			to perform. For example, if an attacker could predict the random password generated for a new user,
 			they would be able to log in as that new user.
@@ -36,7 +36,7 @@
 		</p>
 
         <p>
-            In the first case, we generate a fresh cookie by appending a random integer to the end of a static
+            In the first (BAD) case, we generate a fresh cookie by appending a random integer to the end of a static
             string. The random number generator used (<code>Random</code>) is not cryptographically secure,
             so it may be possible for an attacker to predict the generated cookie.
         </p>