  [Background] Previous research has shown that developers commonly misuse
cryptography APIs. [Aim] We have conducted an exploratory study to find out how
crypto APIs are used in open-source Java projects, what types of misuses exist,
and why developers make such mistakes. [Method] We used a static analysis tool
to analyze hundreds of open-source Java projects that rely on Java Cryptography
Architecture, and manually inspected half of the analysis results to assess the
tool results. We also contacted the maintainers of these projects by creating
an issue on the GitHub repository of each project, and discussed the misuses
with developers. [Results] We learned that 85% of Cryptography APIs are
misused, however, not every misuse has severe consequences. Developer feedback
showed that security caveats in the documentation of crypto APIs are rare,
developers may overlook misuses that originate in third-party code, and the
context where a Crypto API is used should be taken into account. [Conclusion]
We conclude that using Crypto APIs is still problematic for developers but
blindly blaming them for such misuses may lead to erroneous conclusions.
