4 ms·
Sacrificing users' security just to load ads and generate revenue says a lot about this company's ethics.
by johnnycash 12y ago
Sacrificing users' security just to load ads and generate revenue says a lot about this company's ethics.
- chrisrogers 12y agoto me it speaks more about poor security auditing. Treating the User ID as a public key instead of a private one to me signals lax security policy.
- smt88 12y agoClient-side code (even native apps) must be considered public. That means your API is also publicly discoverable. A user ID is fine to use as a public key, but it must be paired with something private. Generally some sort of unique, crypographically-secure auth token is fine when combined with forced HTTPS connections.
- tedks 12y agoDo you know anything about Yik Yak? It doesn't have ads, at least not on Android.
- johnnycash 12y agoThe article says they temporarily disable HTTPS to make a call to Flurry, which is an advertising/analytics company. They must be accessing the analytics side.
- hrrsn 12y agoTo be fair to YikYak, they didn't switch off HTTPS, Flurry switches it off by default. Maybe they didn't know of that? In any case, they should enable it and Flurry should make it the default.