Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Unless they have changed something under the hood I would NOT trust this service due to the insecure nature of the Snapchat API.

There are many 3rd-party API clients for Snapchat that can access all parts of the API (send message, send picture, get picture, etc.). I even wrote one for Java. They are easily accessed from a console with a username/password combo.

Considering how many password dumps are out there, it's reasonable to assume that many people have had their Snapchat login credentials compromised. Now I can use that info, log in from a command line, and start "snapping" myself money.

I know that getting someone's username/password is a pretty high barrier, but not high enough for the ability to send money instantly. Maybe there are more security details, but I wouldn't put my info into this just yet.



How do you propose Snapchat, a company primarily producing a mobile application, prevent usage of its API?

You act like someone can't (with your username and password) (automatically or otherwise) scrupulously transact on your behalf with PayPal.

If you have the username/password - in a non-MFA system - you have access to everything.


True. One problem specific to Snapchat is that there are already a ton of 3rd party clients that users trusted with their username and password. That user/pass combo now suddenly has the potential for financial abuse without any new permissions. It's bad to add scope to previously granted authentication, especially when you're talking about finance.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: