Terrible response by the Puffchat guy: <a href="https://twitter.com/MikeSuppo" rel="nofollow">https://twitter.com/MikeSuppo</a> (Google Play's dev listing goes to the Puffchat blogspot site, which links to this Twitter account.)<p><pre><code> "This is a friendly message to advise that you remove all web based content about Puffchat"
"Please remove within 1 hour."
"Puffchat will be fixed in due course. Every piece of content with the original author's name attached to it after GMT scheduled will only provide evidence that can be used against him."
</code></pre>
Edit: Actually, this could just be a publicity stunt. Do something boneheaded like this, get some exposure. Take flak from users that don't necessarily matter, and hope to score a lot more users. If you're not getting the growth you hoped for, what do you have to lose?
You can read the founder's response to the disclosures on Twitter <a href="https://twitter.com/MikeSuppo" rel="nofollow">https://twitter.com/MikeSuppo</a>
And it is all over the internet:<p><i>Blog’s going offline while we bump the specs so we can deal with all the traffic, bear with.</i><p>I expect to see some articles tomorrow.<p>First one: <a href="http://www.tuaw.com/2014/03/03/snapchat-competitor-puffchat-is-incredibly-insecure-founder-thr/" rel="nofollow">http://www.tuaw.com/2014/03/03/snapchat-competitor-puffchat-...</a>
I'm not too impressed with the blog's author either. He documents breaking into another website in a previous blog post:
<a href="http://faptrackr.org/blog/?p=45" rel="nofollow">http://faptrackr.org/blog/?p=45</a>
1. Create snapchat alternative to try to harvest sensitive content & info.
2. Profit.<p>There is no platform or space, in someone else's control, that you can or should trust this way.
Ultimate Streisand effect - I have literally never heard of this app that seems geared towards drug users; and yet I learn about it from it's incompetance.<p>How do people release public API's without THE MOST BASIC OF SECURITY CHECKS. Really? You can add a friend without any checks and even send messages as someone else? Christ.<p>A) Who funds these guys?<p>B) How can I get a piece of that seemingly-easy-as-hell-to-get pie?
Hmm, did you just post this "disclosure" on your blog before informing the company? Well, now everyone is at risk if your claims are true. Poor form.<p>Proper course is to disclose to company first, then disclose after fix is in place in reasonable amount of time. Why risk everyone for your benefit?