FTX US’s wallets appear to be hacked, $600M leaving the exchange

Re:FTX US’s wallets appear to be hacked, $600M leaving the e... by fshbbdssbbgdd on Saturday November 12, 2022 @01:45AM (#33570676)

It’s pretty common for apps to load some external content from a server to show to the user. This is useful in part because it allows you to update the content without going through the slow app review process. Potentially, if your backend got hacked, the hackers could change this content.

[ Parent | on HN ]

Re:FTX US’s wallets appear to be hacked, $600M leaving the e... by graeme on Saturday November 12, 2022 @01:54AM (#33570724)

Sure, but your onboarding flow popup buttons? I don’t think app review allows those to be loaded from a website

[ Parent | on HN ]

Re:FTX US’s wallets appear to be hacked, $600M leaving the e... by liamfd on Saturday November 12, 2022 @08:42AM (#33572956)

You can definitely serve content like that from your server and have the app render it (no website required). The review process would not block that.

You could also serve a change like this with an OTA update, again no app store review required, which ios and android allow (as long as you don't fundamentally change the app, and even then they could only catch that retroactively.

Not sure if they'd care if you load it in a webview as long as the UX wasn't substantially different. I seem to recall getting bounced to web auth flows pretty often.

[ Parent | on HN ]