itzael

Fastmail supports regex and wildcards off the top of my head, as I have them set up with my own personal domain. My financial accounts for example are in the format of “bank+xxxxx@domain.tld”

I’ve had this come up a few times when doing API snooping, and what I’ve done is decompiling the Android version (if available) of their app using jadx [1]. You get pretty legible Java, sometimes with Kotlin artifacts, sometimes with obfuscation, but in combination with some MITM snooping you can see how auth/headers/hashes are done. Sometimes you even find internal API endpoints with a security issue or two.

[1]: https://github.com/skylot/jadx

This is what I experienced with Tap Tap Revenge on iOS. What used to be one of the highlights of iPhone and iPod touch gaming was eventually bought out by Disney, ported to Android (poorly), and then phased out. Luckily, users had dumped some of the song packs and put then online, and with some reverse engineering and hooking, you could swap the game’s server endpoint with a custom one and play it again. This was my main side project in high school junior/senior year and a highlight in my college application.

Unfortunately, it also became victim to Apple’s discontinuation of 32bit apps.