Google Confirms Security Compromise in Android Apps Using Java Cryptography Architecture (JCA)

Alex says, "We have now determined that applications which use the Java Cryptography Architecture (JCA) for key generation, signing, or random number generation may not receive cryptographically strong values on Android devices due to improper initialization of the underlying PRNG. Applications that directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android are also affected. Applications that establish TLS/SSL connections using the HttpClient and java.net classes are not affected as those classes do seed the OpenSSL PRNG with values from /dev/urandom."

Also in the blog post are a couple of things Android developers can do to make sure their apps are secure.