3 ms·
Now apparently this paper http://accepted.100871.net/jni.pdf http://accepted.100871.net/jni.pdf ("Android Low Entropy Demystified" by Yu Ding, Zhuo Peng and Cha
by MichaelMoser123 11y ago
Now apparently this paper http://accepted.100871.net/jni.pdf http://accepted.100871.net/jni.pdf ("Android Low Entropy Demystified" by Yu Ding, Zhuo Peng and Chao Zhang, from 2014) says that the android random number generator does not have a lot of entropy, this means it is not very secure (note to self: don't buy any stuff online from an android phone)
Interesting if this insecurity of the phone OS is a feature or a design requirement ...
However for use with Google's servers is all pretty much secure, this is certainly a design requirement.
- MichaelMoser123 11y agoi thought about it a bit : by putting the random number generator into /dev/urandom they can claim plausible deniability if the random numbers can be guessed (and you end up with a compromised session key). However that might also be unintended, not on purpose.