Wait, just to be clear - so anyone who downloads this app can trivially retrieve... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

austinz on March 9, 2014 | parent | context | favorite | on: How not to write an API

Wait, just to be clear - so anyone who downloads this app can trivially retrieve the username and password for all 2000+ users of the app? Did I misunderstand the article?

k1kingy on March 9, 2014 [–]

Basically yes. As he did, he managed to get the API key by doing a TCP dump.

From there he was able to use the key to get the users and plaintext passwords. Very much wtf.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact