Hacker News Reader

Sacrificing users' security just to load ads and generate revenue says a lot about this company's ethics.

Do you know anything about Yik Yak? It doesn't have ads, at least not on Android.

The article says they temporarily disable HTTPS to make a call to Flurry, which is an advertising/analytics company. They must be accessing the analytics side.

To be fair to YikYak, they didn't switch off HTTPS, Flurry switches it off by default. Maybe they didn't know of that? In any case, they should enable it and Flurry should make it the default.

I imagine it's disabled by default because at one point in time (not sure if it's changed in the last few years) any application on the iOS App Store using SSL required registration with the US Government for export control.

Really? That sounds... stupid.

to me it speaks more about poor security auditing. Treating the User ID as a public key instead of a private one to me signals lax security policy.

Client-side code (even native apps) must be considered public. That means your API is also publicly discoverable.

A user ID is fine to use as a public key, but it must be paired with something private. Generally some sort of unique, crypographically-secure auth token is fine when combined with forced HTTPS connections.

Reply on news.ycombinator.com