How not to write an API

#1

Post by gebe » Sun, Mar 09, 2014, 9:16 PM UTC

How not to write an API
ghost.teario.com

Re: How not to write an API

#2

Post by octatone2 » Sun, Mar 09, 2014, 9:58 PM UTC

What the, why? Who thought this matched any sane API authentication pattern?

Re: How not to write an API

#3

Post by Mithaldu » Sun, Mar 09, 2014, 10:05 PM UTC

Short version: http://criticker.com sells access to their API for apps. Any API account can retrieve a list of all users it registered on the site, then retrieve the cleartext password for each user it created.

There are so many WTFs in this whole situation that it's a wonder criticker has managed to keep the website online. Which is a shame, as it looks like a really useful website.

Re: How not to write an API

#4

Post by LukeB_UK » Sun, Mar 09, 2014, 10:05 PM UTC

I hope that the author notified Criticker about these issues before putting them out there on the internet. Not doing so would be extremely irresponsible and is sort of screwing over the users of Cricketer.

Re: How not to write an API

#5

Post by minimaxir » Sun, Mar 09, 2014, 10:06 PM UTC

-0.036264

Wait, did their API return a negative processing time?

Re: How not to write an API

#6

Post by austinz » Sun, Mar 09, 2014, 10:07 PM UTC

Wait, just to be clear - so anyone who downloads this app can trivially retrieve the username and password for all 2000+ users of the app? Did I misunderstand the article?

Re: How not to write an API

#7

Post by pille » Sun, Mar 09, 2014, 10:09 PM UTC

LukeB_UK wrote: post #4

I hope that the author notified Criticker about these issues before putting them out there on the internet. Not doing so would be extremely irresponsible and is sort of screwing over the users of Cricketer.

He claims to have notified Criticker in 2010, and links to a post on their forum (username teario):

http://www.criticker.com/forum/viewtopic.php?f=8&t=2063#p188...

Re: How not to write an API

#8

Post by greglindahl » Sun, Mar 09, 2014, 10:10 PM UTC

minimaxir wrote: post #5

-0.036264 Wait, did their API return a negative processing time?

When you trade security for speed, amazing things can happen!

Re: How not to write an API

#9

Post by LukeB_UK » Sun, Mar 09, 2014, 10:12 PM UTC

pille wrote: post #7

LukeB_UK wrote: post #4

I hope that the author notified Criticker about these issues before putting them out there on the internet. Not doing so would be extremely irresponsible and is sort of screwing over the users of Cricketer.

He claims to have notified Criticker in 2010, and links to a post on their forum (username teario): http://www.criticker.com/forum/viewtopic.php?f=8&t=2063#p188...

Thanks for that, I skipped over that paragraph.

Re: How not to write an API

#10

Post by fake-name » Sun, Mar 09, 2014, 10:12 PM UTC

LukeB_UK wrote: post #4

I hope that the author notified Criticker about these issues before putting them out there on the internet. Not doing so would be extremely irresponsible and is sort of screwing over the users of Cricketer.

If you read the link, you'll see he did....

in 2010! It remains unchanged.

*Beat to the point by pille