Decrypting Blind's Encrypted API
blog.jldc.me
Decrypting Blind's Encrypted API
1–10 of 40 posts
Re: Decrypting Blind's Encrypted API
#2Is there any point in encrypting API payloads when the traffic is going via TLS?
Re: Decrypting Blind's Encrypted API
#3Is there any point in encrypting API payloads when the traffic is going via TLS?
Potentially to prevent MITM proxies on company computers from being able to sniff the traffic. Maybe because of what blind is about, that would make sense? Otherwise, if it's secure TLS, then no reason at all
Edit: maybe the reason they use public key for transmission is because you can't reverse that, and that would potentially be where your anonymous complaints your complaints (or whatever you do on blind) would be?
Re: Decrypting Blind's Encrypted API
#4Is there any point in encrypting API payloads when the traffic is going via TLS?
Reasons I can think of: depends whether you assume TLS is not going to be broken again and whether the TLS termination happens before the component you want to process the data, to do any sort of check, e.g., web application firewall. With the goal of reducing insider threat and reducing exposure of sensitive data to components that don't need to know such data. However usually it's a bad idea to solely rely on javascript crypto: https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
Re: Decrypting Blind's Encrypted API
#5Is there any point in encrypting API payloads when the traffic is going via TLS?
For blind? yes. It is designed to be anonymous from your employer. Many employers, especially those for which employees would enjoy anonymous complaining, have TLS-intercepting middleboxes.
Re: Decrypting Blind's Encrypted API
#6Is there any point in encrypting API payloads when the traffic is going via TLS?
For blind? yes. It is designed to be anonymous from your employer. Many employers, especially those for which employees would enjoy anonymous complaining, have TLS-intercepting middleboxes.
How would that work, unless the Blind posters are posting from corp-managed phones which have company-signed certs installed?
Re: Decrypting Blind's Encrypted API
#7Nice article! I always wonder what the legal aspects of publishing a reverse engineering article for a private API are? Does the company that the API belongs to have rights to an obligatory take down request?
Re: Decrypting Blind's Encrypted API
#8I've gone through this same exercise in the past in order to mass-delete a large number of comments on different threads. I was afraid that Blind may one day suffer a data leak. I attempted to reroll the crypto in Ruby, but ultimately failed and went the JS route, same as the author. I also had to roll my own sesion-token refresh logic. Finally I was wondering if any kind of data mining could be done with the tool, but I never took it that far. Thanks for the writeup!
Re: Decrypting Blind's Encrypted API
#9I've gone through this same exercise in the past in order to mass-delete a large number of comments on different threads. I was afraid that Blind may one day suffer a data leak. I attempted to reroll the crypto in Ruby, but ultimately failed and went the JS route, same as the author. I also had to roll my own sesion-token refresh logic. Finally I was wondering if any kind of data mining could be done with the tool, b…
Well they already had at least one breach: https://techcrunch.com/2018/12/20/blind-anonymous-app-data-e...
Re: Decrypting Blind's Encrypted API
#10Earlier quoted context omitted.
For blind? yes. It is designed to be anonymous from your employer. Many employers, especially those for which employees would enjoy anonymous complaining, have TLS-intercepting middleboxes.
How would that work, unless the Blind posters are posting from corp-managed phones which have company-signed certs installed?
lots of places use an MDM profile if you connect to work email, for instance.