> fun / weird / creative

Recently had lots of fun testing software security in creative ways. For example found that various sites use the login page as an unwalled gate and don't validate an actual session, so anyone can jump in, no matter if cookies are encrypted. Also unpacked APK's and found all the Firebase keys in plain text. Put together a quick Firebase client in Javascript and accessed their DBs. It's a weird and amusing world, and I'm not even a security expert to enjoy the whole thing.