Hacker News Reader

One can always reverse whatever internal API the main site uses, and/or steal the API key from the official app.

If they really want to be dicks they can limit it to only accept connections from their official signed app.

How?

As an aside, if anyone has any good resources on inspecting cert-pinned traffic using an Android VM and Frida, I’m all ears.

> How?