5 ms·

Neither. We cracked their mobile apps to reverse engineer their private mobile app APIs, and then implemented our own clients for those APIs. To the bank Teller

Neither. We cracked their mobile apps to reverse engineer their private mobile app APIs, and then implemented our own clients for those APIs. To the bank Teller looks like one of their own mobile apps.

ddoolin 11y ago
I've thought about doing this (and sort of started) but for a separate industry. This is going to prove challenging legally, no?
- sjtgraham 11y ago
  What I've done is actually completely legal and specifically protected by the law in the EU.
deanclatworthy 11y ago
So you're building a service on top of undocumented and private APIs? They could shut you down an instant - no?
- sjtgraham 11y ago
  No. There are a number of things that stop them doing this practically: - Making breaking changes to their APIs break all in-flight clients. This is poor UX for their regular customers if their first party app stops working every week. - App store approval time is a choke point - Internal change control is another choke point - I can find what's changed and deploy a fix in no time.
  - deanclatworthy 11y ago
    What if they block the ips you use to power the API? Furthermore, using some simple heuristics it should be easy to fingerprint your API and automate the blocking. Eg A normal user is unlikely to cycle IPs between requests. Your ApI might.
tomschlick 11y ago
What are you going to do when you start getting C&D letters?
- sjtgraham 11y ago
  Buy some nice frames and put them on the wall.
Johnie 11y ago
This is a sign of how bad and far behind the bank technology stack has become. They are all fighting to stay relevant by keeping others out. But technologists are finding loopholes around their stack.
sionsmith 11y ago
This is exactly what Tink app have done and they have been in operation for the past 3 years. Legally your using public available endpoints so even if they did block your IP's spin that docker image up on a new host ;)

ddoolin 11y ago

I've thought about doing this (and sort of started) but for a separate industry. This is going to prove challenging legally, no?

sjtgraham 11y ago
What I've done is actually completely legal and specifically protected by the law in the EU.

deanclatworthy 11y ago

So you're building a service on top of undocumented and private APIs? They could shut you down an instant - no?

sjtgraham 11y ago
No. There are a number of things that stop them doing this practically: - Making breaking changes to their APIs break all in-flight clients. This is poor UX for their regular customers if their first party app stops working every week. - App store approval time is a choke point - Internal change control is another choke point - I can find what's changed and deploy a fix in no time.
- deanclatworthy 11y ago
  What if they block the ips you use to power the API? Furthermore, using some simple heuristics it should be easy to fingerprint your API and automate the blocking. Eg A normal user is unlikely to cycle IPs between requests. Your ApI might.

tomschlick 11y ago

What are you going to do when you start getting C&D letters?

sjtgraham 11y ago
Buy some nice frames and put them on the wall.

Johnie 11y ago

This is a sign of how bad and far behind the bank technology stack has become. They are all fighting to stay relevant by keeping others out. But technologists are finding loopholes around their stack.

sionsmith 11y ago

This is exactly what Tink app have done and they have been in operation for the past 3 years. Legally your using public available endpoints so even if they did block your IP's spin that docker image up on a new host ;)