More than seven months after being flagged as vulnerable, more than a dozen Android apps collectively downloaded at least 350 million times still contain fatal HTTPS flaws that cause them to leak passwords, phone numbers, and other highly sensitive user data, student researchers at City College of San Francisco found.

The vulnerable apps include OKCupid Dating, Dish Anywhere, ASTRO File Manager with Cloud, CityShop – for Craigslist, and PicsArt Photo Studio, which collectively have commanded from 170 million to 670 million downloads, according to official Google Play figures. Most of the titles have been updated regularly, but they continue to contain a game-over vulnerability that fails to detect fraudulent transport layer security (TLS) certificates, according to a blog post published Sunday by Sam Bowne, a security researcher who teaches a class on the ethical hacking of mobile devices at the City College of San Francisco. They likely are a tiny fraction of the Android apps that suffer the same flaw.

All 15 of the apps called out by Bowne's class were first flagged as unsafe in a September blog post from the CERT Division of the Software Engineering Institute. In the September post, researcher Will Dormann said CERT was contacting developers of all 23,668 apps found to be vulnerable. Bowne's class didn't have the resources to check all of the apps on the list, so it's likely many more also remain unfixed. Bowne assigned this class project after independently discovering that all text transmitted by Snap Secure could be decrypted by anyone presenting the app with a fraudulent TLS certificate.

To test the apps, Bowne's students used the freely available Burp software suite and an invalid TLS certificate to attempt a man-in-the-middle attack. Vulnerable apps were those that trusted the certificate and used the private key it contained to encrypt and decrypt communications. Attackers connected to Wi-Fi hotspots, rogue employees inside ISPs or virtual private networks, or state-sponsored hackers sniffing the Internet backbone could use similar techniques to monitor or modify encrypted communications sent between vulnerable apps and the servers they connect to.

The unreliability of protected HTTPS communications from smartphones is nothing new. More than 31 months ago, academic researchers found that apps downloaded by hundreds of millions of Android users contained similar TLS flaws . More recently researchers have unearthed critical encryption failures in tens of thousands of iOS apps available in Apple's App Store . The defects in both Android and iOS apps are particularly dangerous because they are almost impossible for most end users to detect.

Google officials have released the following statement:

Applications that introduce vulnerabilities to users in Google Play are prohibited in Google Play. Google Play does notify developers about potential security issues, and we've taken action against specific applications in the past. During 2014, Google Play began to send out warnings to large numbers of applications (our recent annual report mentions that more than 25,000 apps fixed following these warnings.) We soon plan to start setting hard deadlines for fixing these broad categories of issues.

Google's attempts to improve the security of third-party apps hosted on its own servers are a good start, but the record speaks for itself. For more than 31 months—either continuously or off and on—many apps have contained critical defects. If third-party researchers can spot these apps, Google and Apple researchers can do the same. Until they do, users should remain wary.