Hacker News Reader

What stops the sites from just creating another API key (and call it something obfuscated if they were using something obvious before).

Or, just run strings on the Twitter iOS app bundle... or just look at traffic in Charles...

View on HN

A better question would be what would stop a site from creating hundreds of Twitter accounts and doing some good old scraping.

That would work, but just finding a key with strings is much less effort (no code changes required).

Nothing, but breaking the ToS means they'll always be shut down before they can become big.

I haven't read the story or followed it all.

But I create API key for site: xyz.com where I use the stream API to get all tweets from users a-z

Then I push those to site zyx.com

There is no way for twitter to know what API generated those tweets. Especially if site xyz.com DOES obey the delete notifications (which also triggers site zyx.com to go into action in checking the deleted tweet)

I don't see how this is a total non-story

They would be able to be shut down if they're using Twitter's own API keys - or iOS's built-in keys. These types of things can typically be easily found with strings or a proxy (Charles).

Reply on news.ycombinator.com