5 ms·

Not refuting what you're saying but also... they could just kill the API keys.

• MichaelGG 13y ago
  Recreating the core Instagram experience is directly against the ToS for the Instagram API.
• sjtgraham 13y ago
  Why use the official API? Just MITM a 1st party client to find the endpoints it uses. Last time I checked IG only used SSL for login, everything else was clear text. Why no one hasn't has made a firesheep for IG I do not know. Think of the mischief one could cause!
  • seivan 13y ago
    Are you sure that they don't enforce SSL all over? That's the whole point of OAuth2 getting rid of signed request :(
    • sjtgraham 13y ago
      IIRC I don't think it's OAuth. It's (or was when I last looked ~6 months ago) a different API using a session cookie, and yes I'm sure :)