Hacker News Reader

Reddit is going to lock down who can use an API key

One can always reverse whatever internal API the main site uses, and/or steal the API key from the official app.

If they really want to be dicks they can limit it to only accept connections from their official signed app.

How?

As an aside, if anyone has any good resources on inspecting cert-pinned traffic using an Android VM and Frida, I’m all ears.

> How?