5 ms·
What a non article. As if iPhone apps don't have these keys in them. So, now you have those keys. What are you going to do with them? Just because you have the
by pan69 12y ago
What a non article. As if iPhone apps don't have these keys in them.
So, now you have those keys. What are you going to do with them? Just because you have the "app" key doesn't mean you have access to any sort data. The worst you can do is write an authentication flow with some other companies app keys, and then what?
Can someone please explain what the security issue here is?
- userbinator 12y agoI wouldn't really consider these "keys" or "secrets", they're more like a user identifier. Having them probably means you can now write another app to access the same data... and if that was in any way considered a security issue, it wouldn't be solved by not having those identifiers in the app either. (Of course there might be some APIs that allow doing more by interacting with them directly than what the app originally allowed, but I think those are just cases of bad design.)
- kuschku 12y agoSome Websites require you to pay money for access to their API. Some of them also have a HTML5-App (with a wrapper) available for Android. This app uses the same API. So some malicious developer could just unzip the app, read the JavaScript and find the API-key, and use their key instead of paying for one. And as the website usually has many accesses from the same IP (due to mobile users being behind NATs), the Website will never find out that someone is abusing their API.
- Guillaume86 12y agoAnd some websites do not have public APIs at all. I've already used this technique to "discover" the private API and the access keys, nothing sensitive and only for personal use of course.