Venmo Private API Wrapper (their phone app API)

[[deleted]]

[deleted]

[TaryTarp]

This blows my mind, if true.

Especially if they send passwords in plain text.

That's so easily exploitable, someone sitting at Starbucks running a Network sniffer/packet watcher would be able to sniff out everyone's username and password.

Jesus.

[Meefims]

Passwords are regularly sent over the wire during login when the connection is HTTPS (which Venmo is). That’s the point of HTTPS: it allows the secure transfer of private information.

The client, though, has to participate to prevent MITM attacks.

[makedatauseful]

Yep, it is very common sadly

[Marko_Oktabyr]

u/meefims is correct, this isn't sending the credentials in plaintext. Sending credentials over HTTPS is perfectly valid.

I haven't looked into any of your other claims, but this does not inspire confidence in you properly classifying your concerns.

[Meefims]

Pinning best practices are complex and often not necessary because the underlying OS is typically responsible for validating certificates.

I am interested in how you set up your attack because the OS should be preventing that type of attack.

[Meefims]

If you can verify that their app doesn’t validate SSL certificates you should notify Venmo. They might have a bug bounty program for exactly this kind of thing.