I believe there was a time when blockchain.info's Android wallet generated keys from Apache's 301 redirect HTML fetched over HTTP[1]. I think there's also a le

I believe there was a time when blockchain.info's Android wallet generated keys from Apache's 301 redirect HTML fetched over HTTP[1]. I think there's also a lesson about idiot-proofing APIs. With the benefit of this in hindsight, I might instead return an invalid, non-HTTP response that blows up every major HTTP client internally, so that it's impossible for the API consumer code to happily truck along interpreting a non-200 response body as if it's valid random data. [1] https://www.reddit.com/r/Bitcoin/comments/37nlg1/i_was_the_guy_who_lost_6_btc_using_blockchaininfo/crokzk8/?context=10000 https://www.reddit.com/r/Bitcoin/comments/37nlg1/i_was_the_g...