11–20 of 40 posts
Is there any point in encrypting API payloads when the traffic is going via TLS?
In practice: possibly, because many companies use TLS proxies that probably aren't doing that?
I've gone through this same exercise in the past in order to mass-delete a large number of comments on different threads. I was afraid that Blind may one day suffer a data leak. I attempted to reroll the crypto in Ruby, but ultimately failed and went the JS route, same as the author. I also had to roll my own sesion-token refresh logic. Finally I was wondering if any kind of data mining could be done with the tool, b…
Well they already had at least one breach: https://techcrunch.com/2018/12/20/blind-anonymous-app-data-e...
Earlier quoted context omitted.
For blind? yes. It is designed to be anonymous from your employer. Many employers, especially those for which employees would enjoy anonymous complaining, have TLS-intercepting middleboxes.
How would that work, unless the Blind posters are posting from corp-managed phones which have company-signed certs installed?
Earlier quoted context omitted.
Well they already had at least one breach: https://techcrunch.com/2018/12/20/blind-anonymous-app-data-e...
You'd think that engineers from top - tier tech companies would know better, before sharing sensitive information on some random website.
Nice article! I always wonder what the legal aspects of publishing a reverse engineering article for a private API are? Does the company that the API belongs to have rights to an obligatory take down request?
Also it helps if you don't have to use objects (with keys) to transfer data. What I mean is that there's little reason to use
{
"alias": "b6WJEDTp",
"member_nickname": "faRw33",
"created_at": "4d",
"is_auth": "Y",
"board_id": 114961,
[
"b6WJEDTp",
"faRw33",
"4d",
"Y",
114961,
Both of these approaches also cut down on the amount of data transferred over the wire, so it saves data and helps speed up the site for users too.
Is there any point in encrypting API payloads when the traffic is going via TLS?
Potentially to prevent MITM proxies on company computers from being able to sniff the traffic. Maybe because of what blind is about, that would make sense? Otherwise, if it's secure TLS, then no reason at all Edit: maybe the reason they use public key for transmission is because you can't reverse that, and that would potentially be where your anonymous complaints your complaints (or whatever you do on blind) would be…
This is yet another reminder that good JS minification tools exist that can absolutely change object properties into short minimal strings instead of descriptive names. It's called the Closure Compiler in advanced mode. You do have to have quite a bit of discipline in writing the JS to have that though. Some languages like ClojureScript actually do this by default, so it doesn't take much effort. Also it helps if you…
Nice article! I always wonder what the legal aspects of publishing a reverse engineering article for a private API are? Does the company that the API belongs to have rights to an obligatory take down request?
Is it really "private" if everyone with a browser and a brain can see what it's doing...?
Earlier quoted context omitted.
How would that work, unless the Blind posters are posting from corp-managed phones which have company-signed certs installed?
This kind of deep packet inspection is in no way limited to phones.