Foursquare iPhone app sends passwords in plain text, don't use

Re:Foursquare iPhone app sends passwords in plain text, don'... by kidsat on Saturday August 21, 2010 @05:29PM (#1623700)

HTTP port 80 traffic from Android app:

  GET /v1/checkins?geolat=34.2842613&geolong=-118.2471837&geohacc=112.0 HTTP/1.1
  User-Agent: com.joelapenna.foursquared:2010080500
  Host: api.foursquare.com
  Connection: Keep-Alive
  Authorization: Basic dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA==

HTTP port 80 traffic from iPhone app:

  POST /v1/checkin.json HTTP/1.1
  Host: api.foursquare.com
  User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_2 like Mac OS X; en-us)
  Content-Type: application/x-www-form-urlencoded
  Authorization: Basic dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA==
  Accept-Encoding: gzip
  Accept: */*
  Accept-Language: en-us
  Content-Length: 250
  Connection: keep-alive

[ Parent | on HN ]

Re:Foursquare iPhone app sends passwords in plain text, don'... by woodrow on Saturday August 21, 2010 @08:43PM (#1623964)

In case this wasn't clear or you didn't read the article, 4sq is using HTTP Basic authentication:

  >>> base64.decodestring("dXNlckBleGFtcGxlLmNvbTpwYXNzd29yZA==")
  '[email protected]:password'

[ Parent | on HN ]