Hacker News Reader

Some previous commentary https://news.ycombinator.com/item?id=34123707

It's not just real email addresses, but this leak (if real) could have also de-anonymized a bunch of people if they were foolish enough to use their real name, or their email address that has this info

View on HN

>The seller told me they scraped the data using the same set of weaknesses in Birdsite APIs that allowed the scraping (and publishing) early this year of profile data on 5.4M Twitter users.

Sigh... So many of the massive social media leaks are just people taking advantage of their publicly documented APIs.

I fear more services will stop providing public APIs and maybe even use constantly changing obfuscation like Snapchat and TikTok to make it harder to use their internal APIs.

It's using a vulnerability, you should not be able to get emails and phone numbers for any profile except yours using any Twitter API.

> constantly changing obfuscation like Snapchat and TikTok to make it harder to use their internal APIs.

That sounds interesting. Can you point me to some resources to learn more about this?

Snapchat's API call obfuscation:

https://hot3eed.github.io/snap_part1_obfuscations.html

This one about TikTok was recently on the HN front page:

https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

Reply on news.ycombinator.com