ikisusi

I hope that providers whose APIs responded and interacted fully over unencrypted HTTP would go back to their historical access logs and check how widespread using plaintext HTTP is. If they don't have access logs for their API then they could just sample next 24 hours for API accesses.

Popular providers have so many API users today that even a rare mistake could expose quite many users in absolute numbers. Would rather have providers to check this out rather than have this poor practice abused by the next DNS hijacking malware affecting home routers.

I was suddenly much more afraid of widespread router takeover botnets with DNS MITMs re-emerging after stumbling on this. Started thinking about the cheer number of API traffic today combined with the realisation that some of it may be using plain text by mistake because of this redirect practice. :(