Adding /dev/urandom seems like a suboptimal solution. Crypto is hard, and very clever people get bitten by flaws in things like randomness and seeding prngs.
I think the problem they were trying to fix/remedy was that /dev/random was getting called for ALL random functions in the JVM. So every time an android app called for a random number, it would go to /dev/random.
Nobody would suggest using /dev/urandom for cryptography, but it's sufficient for a random number call, especially because /dev/random is blocking.
3 comments
[ 3.1 ms ] story [ 16.0 ms ] threadNobody would suggest using /dev/urandom for cryptography, but it's sufficient for a random number call, especially because /dev/random is blocking.