# Bitcoin Android Flaw **URL:** \ **Category:** NYSpeed Off Topic\ **Created:** [August 12, 2013, 7:49am UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248 "2013-08-12T07:49:37Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [August 12, 2013, 11:30am UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/21 "2013-08-12T11:30:39Z")
It’s an issue with java.security.SecureRandom ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [August 12, 2013, 11:51am UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/22 "2013-08-12T11:51:08Z")
> [@Tunerfreak](#): > > you know what i meant though, I personally wouldn’t call it an android problem when its from the java library but to each his own i guess This isn’t a Java problem. Android uses its own version of Java that is not the same as the desktop version. One of the biggest differences is that Android doesn’t use the Java Virtual Machine that desktop applications use. ---
**Author:** ![Motocrossx23](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/motocrossx23/32/5120_2.png) [@Motocrossx23](https://forums.speedlife.net/u/Motocrossx23)\ **Post date:** [August 12, 2013, 12:09pm UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/23 "2013-08-12T12:09:09Z")
So people made up money and hoped that other people would use it? People are using it and now it’s worth something? ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [August 12, 2013, 12:18pm UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/24 "2013-08-12T12:18:45Z")
> [@Motocrossx23](#): > > So people made up money and hoped that other people would use it? People are using it and now it’s worth something? more-or-less ---
**Author:** ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)\ **Post date:** [August 12, 2013, 12:20pm UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/25 "2013-08-12T12:20:29Z")
> [@Tunerfreak](#): > > you know what i meant though, I personally wouldn’t call it an android problem when its from the java library but to each his own i guess Lol, Java blows dick at everything. It just fucking sucks. Too bad Android is really surrounded by it. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [August 12, 2013, 1:10pm UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/26 "2013-08-12T13:10:43Z")
![http://www.digifail.com/images/research/entropy2.png](http://www.digifail.com/images/research/entropy2.png) Entropy ---
**Author:** ![stuiephoto](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/stuiephoto/32/6070_2.png) [@stuiephoto](https://forums.speedlife.net/u/stuiephoto)\ **Post date:** [August 13, 2013, 11:47pm UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/27 "2013-08-13T23:47:48Z")
[http://www.forbes.com/sites/kashmirhill/2013/08/12/every-important-person-in-bitcoin-just-got-subpoenaed-by-new-yorks-financial-regulator/](http://www.forbes.com/sites/kashmirhill/2013/08/12/every-important-person-in-bitcoin-just-got-subpoenaed-by-new-yorks-financial-regulator/) ---
**Author:** ![Jam](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/jam/32/7235_2.png) [@Jam](https://forums.speedlife.net/u/Jam)\ **Post date:** [August 13, 2013, 11:53pm UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/28 "2013-08-13T23:53:18Z")
If you want to learn more about bitcoin, there was a really well done planet money podcast on it a few weeks back ---
**Author:** ![Jon](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@Jon](https://forums.speedlife.net/u/Jon)\ **Post date:** [August 14, 2013, 4:18am UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/29 "2013-08-14T04:18:24Z")
Yeah,hopefully this doesn’t happen… [http://blog.libertyreserve.com/index.html](http://blog.libertyreserve.com/index.html) > **[Liberty Reserve](https://en.wikipedia.org/wiki/Liberty_Reserve)** > > Liberty Reserve was a Costa Rica-based centralized digital currency service that billed itself as the "oldest, safest and most popular payment processor, serving millions all around a world". The site had over one million users when it was shut down by the United States government. Prosecutors argued that due to lax security, alleged criminal activity largely went undetected, which ultimately led to them seizing the service. In May 2013, Liberty Reserve was shut down by United States federal pros... ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [August 14, 2013, 7:31am UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/30 "2013-08-14T07:31:41Z")
> [@Jam](#): > > If you want to learn more about bitcoin, there was a really well done planet money podcast on it a few weeks back It is pretty awesome and how it is built. I love the idea behind it but wonder its long term benefit with these mining pools getting so powerful and the 51% attack being something possible now. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [August 15, 2013, 8:11am UTC](https://forums.speedlife.net/t/bitcoin-android-flaw/232248/31 "2013-08-15T08:11:01Z")
> **[Some SecureRandom Thoughts](https://android-developers.googleblog.com/2013/08/some-securerandom-thoughts.html)** > > The latest Android and Google Play news and tips for app and game developers. "The Android security team has been investigating the root cause of the compromise of a bitcoin transaction that led to the update of multiple Bitcoin applications on August 11. We have now determined that applications which use the Java Cryptography Architecture (JCA) for key generation, signing, or random number generation may not receive cryptographically strong values on Android devices due to improper initialization of the underlying PRNG. Applications that directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android are also affected. Applications that establish TLS/SSL connections using the HttpClient and [java.net](http://java.net) classes are not affected as those classes do seed the OpenSSL PRNG with values from /dev/urandom. Developers who use JCA for key generation, signing or random number generation should update their applications to explicitly initialize the PRNG with entropy from /dev/urandom or /dev/random. A suggested implementation is provided at the end of this blog post. Also, developers should evaluate whether to regenerate cryptographic keys or other random values previously generated using JCA APIs such as SecureRandom, KeyGenerator, KeyPairGenerator, KeyAgreement, and Signature. In addition to this developer recommendation, Android has developed patches that ensure that Android’s OpenSSL PRNG is initialized correctly. Those patches have been provided to OHA partners. We would like to thank Soo Hyeon Kim, Daewan Han of ETRI and Dong Hoon Lee of Korea University who notified Google about the improper initialization of OpenSSL PRNG." [Previous page](https://forums.speedlife.net/t/bitcoin-android-flaw/232248.md?page=1)