3 ms·
> A "very popular cross-platform messaging service" with an install base of 10 million to 50 million users exposed telephone numbers from the address book. Wha
by sturmeh 14y ago
> A "very popular cross-platform messaging service" with an install base of 10 million to 50 million users exposed telephone numbers from the address book.
WhatsApp would that be?
- mike-cardwell 14y agoPossibly. When I originally looked at Kik Messenger back in November 2010, it wasn't using SSL for anything. Even passwords were going over the wire in the clear. In March 2011 they added SSL functionality, but it didn't do any certificate verification. A few months later in June they added appropriate certificate verification. I wrote a small Perl script at the time as a POC which would automatically add signatures to peoples outgoing Kik messages if they were using your network. It even worked with the SSL version of Kik before they added cert verification - https://grepular.com/Advertise_Your_Wifi_in_Your_Customers_Kik_Messages https://grepular.com/Advertise_Your_Wifi_in_Your_Customers_K...
- sturmeh 14y agoI'm sure quite a few apps do it, I know WhatsApp does it for certain. MITM your phone and watch the traffic, your entire contact list gets sent through every time you open the application.