Columbia University’s Jason Nieh and Nicolas Viennot found thousands of secret keys being stored in app software.