News for hackers. Stuff that matters.

A comment on Thousands of secret keys found in Android apps. Parent comment

Re:Thousands of secret keys found in Android apps by kuschku on Thursday June 19, 2014 @05:47AM (#7915374)
Some Websites require you to pay money for access to their API.

Some of them also have a HTML5-App (with a wrapper) available for Android. This app uses the same API.

So some malicious developer could just unzip the app, read the JavaScript and find the API-key, and use their key instead of paying for one.

And as the website usually has many accesses from the same IP (due to mobile users being behind NATs), the Website will never find out that someone is abusing their API.

[ Parent | on HN ]
Re:Thousands of secret keys found in Android apps by Guillaume86 on Thursday June 19, 2014 @07:32AM (#7915575)
And some websites do not have public APIs at all. I've already used this technique to "discover" the private API and the access keys, nothing sensitive and only for personal use of course.
[ Parent | on HN ]