3 ms·
Note that Instagram doesn't encrypt requests to their private API, they're only signing them. In fact the parameter is called 'signed_body', not 'encrypted_body
by potomak 13y ago
Note that Instagram doesn't encrypt requests to their private API, they're only signing them. In fact the parameter is called 'signed_body', not 'encrypted_body'.
Anyway interesting post.
- CGamesPlay 13y agoThe traffic is encrypted over SSL (HTTPS), so there's no need for double-encryption, since presumably the app can trust the DNS and certificate chains on the device. If I were a paranoid Instagram developer, though, I could even use a custom certificate chain that only trusted certificates on my server, so there's no point to doing the encryption in the app.