Puff Puff… Pass (opens in new tab)

Maybe. But a publicity stunt that highlights findings that run counter to what you're trying to sell the platform on seems dubious.

> @iH8sn0w @NinjaLikesCheez All content, including articles, scripts, reddit posts, tweets, everything. By 11.40pm today (3/3/2014).

Hahaha, that is a pretty hilarious bit of fail, there. I don't think it could really be intentional... it might make him kinda famous (in a probably unwanted way) but it won't net him new users.

Also https://twitter.com/Staceyythatsme

Yeah they are pretty awful, the funny thing is they're the most popular accounts on the app :/

Seems the founder thinks he can suppress speech through tweeting: https://twitter.com/NinjaLikesCheez/status/44064551256879513...

Reading his responses, the entire app feels like a bad attempt at trolling.

In any case, nice write up. I enjoyed reading it.

That website hosted pirated copies of iOS apps, so it's not as bad as it seems.

It was the content of the article, and not the title of the blog that left the bad impression?

Aren't burner phones that way because you want to ditch the entire phone to erase any link to you after using it in an incriminating way?

Even if this app was "secure", it wouldn't prevent the need to ditch a phone. LE can subpoena the company, find out which IP:port connected for whatever user/message. Then go to cell company and get records and track the cell.

Get an android and use textsecure if you actually care about people not reading your messages.

If you're using a burner I doubt the environment is your topmost concern.

Why would you even consider using this app?

11 (or is it 12?) months in, Andrew "Weev" Auernheimer is still serving a 3-year conviction (on appeal now) for "hacking" the AT&T iPad signup script to get email addresses out of it ... using a web request and random numbers. In case that's not clear enough, it was published, public data waiting to be requested, no security restrictions except the numbers to be guessed. I'd say that's the same for any such "private" (hah!) service that uses ID numbers to access data over public channels, wouldn't you?

I triggered executive-level uproar just yesterday by pointing out what should have been obvious security issues in an API we were about to be asked to integrate with. I was not the first technical person to look at the document we were given, and in fact I was the only one to look at it who couldn't actually read it in detail (it was in Chinese, I only speak English, but the identifiers were in English), but nobody else had spotted the problem.

I'm not a roving security consultant, so my sample size is limited, but I have seen little evidence that even basic security awareness is part of the toolkit any substantial number of developers have.

I can definitely see a developer's concerns being brushed aside as a "business decision" on the grounds that growing their userbase or adding new features is more important to the startup's survival than security at that time.

It's actually a pretty damn good line, and I think it's really, fantastically hard to know when your ethical responsibility as an engineer starts to outweigh your obligations as an employee.

"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."

At the bottom of the post it does state:

In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data.

Everyone was already at risk, but they didn't know it. They were already downloading this content to devices everywhere.

He also says that he tried to contact the developer but got no response.

The dev would have been much better off apologizing, pushing a fix, and asking for a temporary embargo while the fix is put into place.

FTA:

"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."

As you can read in the article, he did try to contact the developer.

That aside, though, when the issues are this egregious I'm honestly not sure what the right approach is. With flaws this bad it's hard to imagine that they're even capable of fixing the problems, let alone responding appropriately to the disclosure.

Puffchat put people at risk.

Fuck "Responsible Disclosure" in cases of utter incompetence like this.

TFA states precisely this:

"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."