#mobile
-
No Login Required: Breaking Down NumberBook's Caller-ID API
NumberBook asks for your entire contact list, then answers reverse phone lookups through a backend that has no authentication, no rate limiting, and 'encrypts' its responses with a key that ships inside the app itself.
-
From a Google Search Result to a Live Cloud Key: Inside the StoryGo App's Backend
A random IP in a Google result led to the Alibaba-Cloud backend of a reading app — a self-hosted GitLab/ZenTao/InfluxDB box, and a long-term Alibaba Cloud AccessKey hardcoded into the APK that a live proxy capture proved is still valid.