How to go from zero to 400,000 push notifications in one day

Post by stickfigure » Mon, Feb 11, 2013, 6:16 PM UTC

mason55 wrote: post #7

stickfigure wrote: post #5

Do I understand correctly that StackMob lets your iOS client send push notifications directly to other users? How does this API prevent spammers from hijacking your app credentials to send pushes to all your users?

Sounds like you're responsible for ensuring that your app only sends broadcasts when appropriate. If you create an app that lets end users send push notifications to an arbitrary list of users then that's on you for allowing it to happen.

If the iOS application decides who to send messages to and what the content of the message should be, then anyone who downloads the app now has the ability to spam to any other user just by extracting the API key out of the binary and using the StackMob API directly.

Post by MProgrammer » Mon, Feb 11, 2013, 7:01 PM UTC

stickfigure wrote: post #10

MProgrammer wrote: post #9

Earlier quoted context omitted.

They're not sent "directly" -- they go through StackMob's servers. Urban Airship has a client library that can do the same thing, and it's widely used. I can see how it's certainly possible for a spammer to do that with hackery, but there's a mechanism to revoke API keys and so forth if needed.

Revoking your API key is the equivalent of taking your application offline. And there's no fix; as soon as you reissue your application (after waiting a week for Apple's approval) then the spammer has your API key again and can start sending pushes through StackMob/Urban Airship. I send a lot of push notifications through my own servers. I made sure that spammers would have a hard time abusing it by constraining (ser…

I think it would help a lot if broadcast were unavailable via the client-side API. Without broadcast, an attacker would have to find out usernames or device tokens to push to. I'll suggest that to StackMob and see what they think.

Re: How to go from zero to 400,000 push notifications in one day

Re: How to go from zero to 400,000 push notifications in one day