IPhone Devs, don't put your private keys for push notification in your webroot

That is a good question: https://encrypted.google.com/search?sourceid=chrome&ie=U...

I expect that is why they are indexed - they aren't exactly going to link to their private key from another page.

No - each user is assigned a token that you would also need to use in combination with the private key.

If you get the device tokens too, possibly. Unfortunately it looks like some of these are ALSO exposed. Argh.

http://developer.apple.com/library/ios/documentation/Network...

A UIApplication method (registerForRemoteNotificationTypes:) negotiates with apples servers using device information to obtain a 32-byte push token unique to a given device/app pair. It is likely based on the device's global id (UDID) and the application's appid and certificates. Someone should figure out the exact network handshake.

Any app developer is capable of collecting UDIDs using their released apps (the UDID is constant and visible across all apps). Note, having the UDID does not necessarily mean you can obtain the push token. But you may be able to derive the push token from it and from information contained in the app.

Assuming you could figure out someone's push token, you could to cause a push to show up in the name of the app whose certificate/key you've obtained!