I once found and disclosed similar issues in an app.<p>The app didn't use HTTPS so it was trivial to intercept Bearer tokens.<p>For some reason, most API endpoints returned way more data than necessary (e.g., when receiving a message you also get the user's last location, their name, their latest known profile icon), so simply observing network traffic on an Insecure WiFi network would be enough to get all the information you could ever want (no need to actually use that Bearer token).<p>And of course the app collected the precise GPS location and would return a GPS location with full precision in virtually every API response (messaging a stranger, fetching their public profile, etc).<p>In my private, responsible disclosure sent to the creator I demonstrated how I could use their private API to track the creator everywhere he goes. I think that drove the message home ;)<p>I am always skeptical when an app wants my GPS location.<p>Since I am friends with the creator's wife, I never wrote a post about this.
I'm not the author of the post, but here are some notes on this app:<p>500,000-1,000,000 installs: <a href="https://play.google.com/store/apps/details?id=com.ferrero.magickinder.tablet&hl=en" rel="nofollow">https://play.google.com/store/apps/details?id=com.ferrero.ma...</a><p>Written by Ferrero SpA (Yes, the producers of Nutella... $8.4 billion in annual revenue): <a href="https://en.wikipedia.org/wiki/Ferrero_SpA" rel="nofollow">https://en.wikipedia.org/wiki/Ferrero_SpA</a>
"Last but not least, all communications are transmitted in clear text; no encryption is involved across the whole app."<p>It's pretty common to send and receive API requests in clear text, since the encryption for this part should be handled by HTTPS. But you're right, this app only uses HTTP
Another similar privacy leak affecting children on the VTech website a few months ago:<p><a href="http://www.troyhunt.com/2015/11/when-children-are-breached-inside.html" rel="nofollow">http://www.troyhunt.com/2015/11/when-children-are-breached-i...</a>
I wish the author would have listed the types of issues at work here.<p>Privacy violation is the result of a few types of issues including JSON injection and horizontal privilege (maybe vertical) escalation.<p>Also, providing fixes could help lend a hand to developers, both the creators and readers of this post.<p>Please don't take this post as negative, it's a very nice finding which I'm glad is public to the point of helping our user information become safer, and for that I thank you author.