4 ms·

Why use the official API? Just MITM a 1st party client to find the endpoints it uses. Last time I checked IG only used SSL for login, everything else was clear

Why use the official API? Just MITM a 1st party client to find the endpoints it uses. Last time I checked IG only used SSL for login, everything else was clear text. Why no one hasn't has made a firesheep for IG I do not know. Think of the mischief one could cause!

seivan 13y ago
Are you sure that they don't enforce SSL all over? That's the whole point of OAuth2 getting rid of signed request :(
- sjtgraham 13y ago
  IIRC I don't think it's OAuth. It's (or was when I last looked ~6 months ago) a different API using a session cookie, and yes I'm sure :)