Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse-engineering the Starbucks ordering API

blog.tendigi.com

Post reply on HN
Print view View original

61–70 of 157 posts

Re: Reverse-engineering the Starbucks ordering API

#61

Post by djrogers »

veritas3241 wrote: post #47
rconti wrote: post #41

Excellent writeup. I have to take issue with the "Starbucks app is great" line, though. I think I've had more problems with it (on iOS) than any other app. It's the only app that (for a period of many months if not a year) was regularly unable to find my location. Even if I opened up Maps or some other location enabled app and found my location before launching Starbucks, it would just bomb out. Overall the app seems…

I just wish I could customize the requests on breakfast items. I want no cheese on my sandwich. I can request it in person. Can't on the app.

Select the sandwich, tap on Sandwich Options, tap the google for No Cheese. You've been able to customize orders for as long as I've been using it to order stuff.

Re: Reverse-engineering the Starbucks ordering API

#62

Post by vinhboy »

rconti wrote: post #41

Excellent writeup. I have to take issue with the "Starbucks app is great" line, though. I think I've had more problems with it (on iOS) than any other app. It's the only app that (for a period of many months if not a year) was regularly unable to find my location. Even if I opened up Maps or some other location enabled app and found my location before launching Starbucks, it would just bomb out. Overall the app seems…

Agreed. I'd also add that the UI for the app needs work. Ordering coffee for a group of people becomes a huge hassle on my phone because their search is not precise, and customizing drinks is a bit cumbersome.

I spent like 20 minutes trying to order 5 drinks the other day. It was also annoying because when I left the app, all my selected items disappeared.

Re: Reverse-engineering the Starbucks ordering API

#64

Post by coworkerblues »

I want to write a similar write-up for a company which basically does everything over HTTP with their own half-baked hardcoded AES key in app for sending credit card info. and that their confirmation checkup is stupid (for SMS) and can be bypassed.

The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips for me ?

Re: Reverse-engineering the Starbucks ordering API

#65

Post by thisisit »

dsacco wrote: post #24
flyinfungi wrote: post #18

Earlier quoted context omitted.

Any chances you would be willing to share some of the online resources you use for this? I have recently been getting into mobile security development professionally.

I don't use online resources. I mostly used a combination of dex2jar and apktool. Some custom coding to automate the process. When I'm doing this on iOS I use Hopper.

I think he meant about learning from ground up as a start. If not, I am really interested in one :)

Re: Reverse-engineering the Starbucks ordering API

#66

Post by Spivak »

BHSPitMonkey wrote: post #60
shortstuffsushi wrote: post #48

Earlier quoted context omitted.

Why would their API need to be anything more than what they offer to their app? Why not something like "hey, you can use our stuff, but you've only got access to the same set of APIs we use in our app, and we may change it as we please. Oh btw, here are the auto-gen'd docs, hope those are enough" That seems like it'd be both developer friendly and no more maintenance than they're already putting into it. The alternat…

You can't make breaking changes to a public API, for starters. Needing to maintain/version APIs you want to deprecate has a nonzero cost.

Why not? The real cost would be documenting it, but a lot of devs would be willing to accept essentially being on a mailing list for breaking changes a few weeks in advance. It's not like Starbucks can roll out breaking changes to their own API instantly.

It would only really be used by enthusiasts and techies who are used to this sort of thing.

Re: Reverse-engineering the Starbucks ordering API

#67

Post by benmoot »

joombaga wrote: post #45

I did this with the Papa John's webapp a while back (which was waaaay simpler btw). They limited duplicate toppings to (I think) 3 of the same, but "duplicate_item" was just a numerical property on the (e.g.) "bacon" object. Turns out you could just add multiple "bacon" members to the toppings array to exceed the limit, and they didn't charge for duplicates, so I ordered a pizza with like 50 bacons. It definitely did…

Haha that's awesome.

Re: Reverse-engineering the Starbucks ordering API

#68

Post by 13of40 »

joombaga wrote: post #45

I did this with the Papa John's webapp a while back (which was waaaay simpler btw). They limited duplicate toppings to (I think) 3 of the same, but "duplicate_item" was just a numerical property on the (e.g.) "bacon" object. Turns out you could just add multiple "bacon" members to the toppings array to exceed the limit, and they didn't charge for duplicates, so I ordered a pizza with like 50 bacons. It definitely did…

Whenever you do this sort of thing, you should check whether they do negative number checking on the client side or in the API itself. You might be able to get 1 pizza with bacon and (1) pizza without, all for the price of the bacon.

Re: Reverse-engineering the Starbucks ordering API

#69

Post by torstenvl »

rconti wrote: post #41

Excellent writeup. I have to take issue with the "Starbucks app is great" line, though. I think I've had more problems with it (on iOS) than any other app. It's the only app that (for a period of many months if not a year) was regularly unable to find my location. Even if I opened up Maps or some other location enabled app and found my location before launching Starbucks, it would just bomb out. Overall the app seems…

Agreed. The app has definitely sent a different order than was on screen before; until recently it refused to work with Apple Pay unless your Apple Pay address matched character-for-character what your bank had on file (if one used # and one used APT, or one used VA and one used Virginia, it would fail), and we've lost the ability to customize orders as much as we used to (e.g. you can no longer order a flat white with chai unless it's saved as a previous order).

Re: Reverse-engineering the Starbucks ordering API

#70

Post by joombaga »

13of40 wrote: post #68
joombaga wrote: post #45

I did this with the Papa John's webapp a while back (which was waaaay simpler btw). They limited duplicate toppings to (I think) 3 of the same, but "duplicate_item" was just a numerical property on the (e.g.) "bacon" object. Turns out you could just add multiple "bacon" members to the toppings array to exceed the limit, and they didn't charge for duplicates, so I ordered a pizza with like 50 bacons. It definitely did…

Whenever you do this sort of thing, you should check whether they do negative number checking on the client side or in the API itself. You might be able to get 1 pizza with bacon and (1) pizza without, all for the price of the bacon.

Good advice; I'm not sure I tried that. The goal wasn't to steal toppings or get free pizza though; it was an impromptu response to my desire for lots of bacon and encountering the duplicate limit, and then a busy signal on the phone. Once I figured out it didn't charge me for more, I just wanted to see what would happen. I figured they'd think it was a system glitch and call when they received the order.
Post reply on HN