3 ms·
You can't do this just watching network traffic because the apps use HTTPS + certificate pinning. And you can do it if you want. I do it. I'm sure many more pe
by porfirium 9y ago
You can't do this just watching network traffic because the apps use HTTPS + certificate pinning.
And you can do it if you want. I do it. I'm sure many more people do it.
- passivepinetree 9y agoOut of curiosity, what do you use the decompiled tokens/endpoints for?
- porfirium 9y agoNefarious purposes, mostly. I can crawl without rate limits (well, there are rate limits, but it's much harder to hit them), and I also can spam a lot without getting my account flagged (but it eventually gets flagged, of course). By spamming I don't mean the usual "click on this link and I'll show you my tits" spam; if you create a useful bot that sends "expected" mentions (for example in response to mentions you receive, and not just spam) it will get banned in a matter of hours. With their "secret" tokens, it won't get banned.
- praneshp 9y agoThe official twitter app is possibly using these premium endpoints, so it's token has access to those. If you "grab" that token(s) somehow, you can go ahead and use it in your app, I presume. I don't know how this will work when your app wants to connect to someone else's account, however.
- __sha3d 9y agoYou think all the russian bots are on the official API? Nope.
- gsich 9y agoA rooted device should suffice, but it is a painful procedure.
- deleted 9y ago[deleted]