Highlights:<p>* They encrypt all snaps with the same encryption key (AES in ECB mode). The key is embedded in the app and is the same key on iOS and android.<p>* They have an API that, given a phone number, will return a users snapchat handle and name if the phone is valid. This is a batch API with no limit. The security firm was able to successfully send a request with 75k phone numbers.<p>Not mentioned in the post is that snapchat appears to run over HTTP and sends an auth token. Anyone listening to traffic should be able to grab that auth token as well.