Reversing Safeway's private APIs to automate coupon collection • Hacker News Board

Re: Reversing Safeway's private APIs to automate coupon collection

#101

Post by cjslep » Mon, Oct 14, 2019, 9:26 PM UTC

This reminds me of a very similar case a decade ago I never figured out.

Anyone remember Coupon Guy from 4chan in the 2009/2010 timeframe? You could make your own "Buy 1 Get 1 Free" or variant (for both N, "buy 1 get 10", or for kind of coupon, like "buy 1 get half off") Tv, Xbox 360, near anything etc. For Walmart, Best Buy, other chains etc. The tools were passed around stegonographically in the instruction images. Since coupons weren't properly accounted for until they hit a place in Texas, whole threads full of Anons over the course of weeks fabricating working coupons.

Until they stopped working, and of course rumors of "the FBI" apparently grabbing the guy.

I never did figure out what happened tech wise under the hood there.

Re: Reversing Safeway's private APIs to automate coupon collection

#102

Post by huangc10 » Mon, Oct 14, 2019, 9:34 PM UTC

Mister_Snuggles wrote: post #92

huangc10 wrote: post #21

On a slightly unrelated note, I was trying to figure out why this guy is using a .ca domain when I realized, his name is Jon Luca. At first I thought his name was Jon Lu (and therefore asian). Good use of domain name.

I'm in Canada and shop at Sobeys, which owns the Safeway brand up here, thought there might be some relevance to me thanks to the .ca domain name. Unfortunately, there was no relevance but it was still an interesting read. On a side note, Safeway and Sobeys in Canada don't have a loyalty program, instead they piggy back off of Air Miles. All of the special offers available just amount to bonus Air Miles, so they're n…

What a blast from the past. I am actually Canadian but have been living in the Bay Area for over 10 years so I've already forgotten that you can collect Air Miles through Safeway (which was why I clicked on this article in the first place thinking of the .ca)

I don't think Air Miles are completely useless. I do remember redeeming air miles at least once in the past for a one-way trip somewhere...

Re: Reversing Safeway's private APIs to automate coupon collection

#103

Post by icelancer » Mon, Oct 14, 2019, 9:42 PM UTC

cjslep wrote: post #101

This reminds me of a very similar case a decade ago I never figured out. Anyone remember Coupon Guy from 4chan in the 2009/2010 timeframe? You could make your own "Buy 1 Get 1 Free" or variant (for both N, "buy 1 get 10", or for kind of coupon, like "buy 1 get half off") Tv, Xbox 360, near anything etc. For Walmart, Best Buy, other chains etc. The tools were passed around stegonographically in the instruction images.…

>> The tools were passed around stegonographically in the instruction images

Whoa, really? I remember the coupons flying around 4chan of course. Had no idea the tools were in the images.

Re: Reversing Safeway's private APIs to automate coupon collection

#104

Post by pravda » Mon, Oct 14, 2019, 9:43 PM UTC

bredren wrote: post #10

Another tip: (area code) 867-5309 works for Safeway club card discounts in most area codes while piping tracking of your purchases to essentially null. Yes, Jenny’s number.

Whenever I give that number to the cashier, I half expect them to say "hey, wait...."

I thought that number was drilled into everyone's brain, but I guess you have to be a certain age.

According to my last receipt, my YTD "savings" has been $959.68

So I am not the only Jenny out there!

Re: Reversing Safeway's private APIs to automate coupon collection

#105

Post by greyfox » Mon, Oct 14, 2019, 9:54 PM UTC

Anyone know if the dev lurks here? I'm wondering if there's a way to fork his code or add Kroger functionality to it. If im not mistaken Kroger is a safeway acquisition that is a popular grocer in the south/southwest of the USA. this would be very helpful for those of us without safeways.

Re: Reversing Safeway's private APIs to automate coupon collection

#106

Post by lozaning » Mon, Oct 14, 2019, 9:54 PM UTC

taurath wrote: post #99

bduerst wrote: post #76

Earlier quoted context omitted.

The max discount I've ever seen is $0.20 for Chevron, but tends to be $0.10. Chevron is much less rare than a Safeway-branded gas station. Currently west coast gasoline is ~$4.00/g, so that's about 2.5-5.0% discount, which is in line with GP said.

For that $1 off/gallon gasoline, you need to have spent $1000 on groceries. So if your fillup is 10 gallons and gas costs $3/gallon, you will have spent $1000 to save $10. You aren't likely to spend $1000 between each fillup.

Im not, but thats the glory of using (XXX)867-5309. Tons of people know to use that number when buying groceries, many less so when buying gas.

Re: Reversing Safeway's private APIs to automate coupon collection

#107

Post by OkGoDoIt » Mon, Oct 14, 2019, 9:56 PM UTC

taurath wrote: post #99

bduerst wrote: post #76

Earlier quoted context omitted.

The max discount I've ever seen is $0.20 for Chevron, but tends to be $0.10. Chevron is much less rare than a Safeway-branded gas station. Currently west coast gasoline is ~$4.00/g, so that's about 2.5-5.0% discount, which is in line with GP said.

For that $1 off/gallon gasoline, you need to have spent $1000 on groceries. So if your fillup is 10 gallons and gas costs $3/gallon, you will have spent $1000 to save $10. You aren't likely to spend $1000 between each fillup.

But if you are using someone else’s phone number then maybe, especially if it’s a widely used generic number like in the grandparent comment.

Re: Reversing Safeway's private APIs to automate coupon collection

#108

Post by natch » Mon, Oct 14, 2019, 9:59 PM UTC

mgiampapa wrote: post #12

Next time you are at the store look at the circular. There is a barcode you can scan with their app that adds everything to you app that week.

That doesn’t fix the information overload which the OP’s solution solves.

Re: Reversing Safeway's private APIs to automate coupon collection

#109

Post by OkGoDoIt » Mon, Oct 14, 2019, 10:00 PM UTC

bredren wrote: post #10

Another tip: (area code) 867-5309 works for Safeway club card discounts in most area codes while piping tracking of your purchases to essentially null. Yes, Jenny’s number.

Similar trick works at AMC movie theaters with their rewards program. You can use it to get discount tickets on Tuesdays and popcorn discounts.

Similarly for all these other rewards programs you see at restaurants nowadays. I will never understand the idea of using a phone number as authentication without any additional PIN or text message or anything. If I have an acquaintance that I know goes to a lot of movies, and I either know or can find their phone number, I can drain their rewards account. Or you can drain their Safeway rewards account, etc. I wonder how much longer the situation will last?

Re: Reversing Safeway's private APIs to automate coupon collection

#110

Post by Scoundreller » Mon, Oct 14, 2019, 10:21 PM UTC

penagwin wrote: post #72

jonluca wrote: post #50

Earlier quoted context omitted.

I agree - I actually built the thread pool stuff for work while I was testing, since I had the code from a previous project. If I was more worried about Safeway catching on I'd probably do something as you suggested (at the very least I'd add user agent headers and the other cookies expected from a real session, as right now it's trivial to detect my requests). Sneaker bots do this exceedingly well - it's a constant…

I highly recommend not making more then say 5req/s - and preferably do it at like 2am. These projects are fun IMO, but it's best to not hammer anyone's servers if it isn't necessary.

But at 2AM your traffic will create a more noticeable spike...

It doesn’t blend in as well...