  Previous studies have shown that cryptography is hard for developers to use
and misusing cryptography leads to severe security vulnerabilities. We studied
relevant vulnerability reports on the HackerOne bug bounty platform to
understand what types of cryptography vulnerabilities exist in the wild. We
extracted eight themes of vulnerabilities from the vulnerability reports and
discussed their real-world implications and mitigation strategies. We hope that
our findings alert developers, familiarize them with the dire consequences of
cryptography misuses, and support them in avoiding such mistakes.
