Tag: API

Cloudflare Rolls Out API Abuse Detection

Cloudflare, one of the leading content delivery networks, has announced API Discovery and API Abuse Detection.

Application programming interfaces (APIs) are used by companies in every industry. APIs provide a way for different programs and platforms to communicate with each other or hardware components. Many companies use hundreds, or even thousands, of APIs. Unfortunately, despite their value, APIs can be easily abused.

Cloudflare is looking to address that issue with two tools: API Discovery and API Abuse Detection.

API Discovery is designed to help companies keep track of the APIs they have. In some cases, companies have so many that they lose track of them, or easily confuse similar ones.

API Abuse Detection uses a two-prong approach to detecting abuse: volume and sequence. Based on the estimated volume a company should realistically expect on a given API, Cloudflare can detect when volume is higher than it should be.

Similarly, an API has a valid sequence of events when it’s used properly. Cloudflare can monitor an API for calls that are out of sequence, a likely indication it’s being abused.

The new tools are currently available in early access.

March 26, 2021
UK Set to Adopt Apple/Google API For Contact Tracing

The UK has reversed course, adopting Apple and Google’s API for its contact tracing efforts.

Contact tracing has been touted as one of the main components to successfully combatting the coronavirus pandemic. Efforts to roll out the technology have split along two lines. Some countries have focused on solutions that store data in a centralized, government database, while others have adopted the privacy-focused API that Apple and Google created.

Initially, the UK went with the centralized approach, but is now going with the API instead.

“Following rigorous field testing and a trial on the Isle of Wight, we have identified challenges with both our app and the Google/Apple framework,” says the Department of Health and Social Care.

“This is a problem that many countries around the world, like Singapore, are facing and in many cases only discovering them after whole population roll-out.

“As a result of our work, we will now be taking forward a solution that brings together the work on our app and the Google/Apple solution. This is an important step, allowing us to develop an app that will bring together the functionality required to carry out contact tracing, but also making it easy to order tests, and access proactive advice and guidance to aid self-isolation.”

While the press release does not specifically mention privacy, it likely played a role in the overall decision. As a rule, centralized solutions have not been widely adopted by users, who view them with suspicion due to privacy concerns. Apple and Google’s solution, on the other hand, is built around a decentralized, privacy-first approach that many are more comfortable with.

June 19, 2020
Twitter Rolls Out ‘Hide Replies’ to Developers

Twitter’s Hide Replies feature is now available to developers as an API that can be included in their own software.

Twitter, as well as most social media platforms, have been under fire for not always doing enough to combat trolls and online harassment. Back in November, Twitter unveiled the Hide Replies feature, giving users more power over the discussion in their threads.

Now the company is making the Hide Replies API available to developers so they can include that same functionality in their tools. According to TechCrunch, “these sorts of tools will be of particular interest to businesses and brands who maintain a Twitter presence, but whose accounts often get too many replies to tweets to properly manage on an individual basis. With Hide Replies now available as a new API endpoint, developers can create tools that automatically hide disruptive tweets based on factors important to their customers — like tweets that include certain prohibited keywords or those that score high for being toxic, for example.”

Twitter worked with a small group of developers prior to the API’s launch and the company says it is making improvements based on their feedback. It remains to be seen if the feature will be a success or not, as some critics worry it could create as many problems as it attempts to solve if it ends up being used to censor speech.

February 28, 2020
Twitter Suffers Serious Security Incident: Usernames Matched to Phone Numbers

Twitter has disclosed a serious security incident that allowed bad actors to link usernames with phone numbers.

According to a blog post on the company’s privacy site, on December 24, 2019, Twitter “became aware that someone was using a large network of fake accounts to exploit our API and match usernames to phone numbers.”

The company took immediate action to suspend the fake accounts but, upon further investigation, Twitter discovered additional accounts that may have been exploiting the API. The API in question allows users to find other people they know by using their phone number, provided the other person has the “Let people who have your phone number find you on Twitter” option turned on and have a phone number linked to their account. The fake accounts, however, misused the API to link phone numbers and usernames of accounts they had no connection to.

Although the fake accounts’ IP addresses traced back to locations all around the globe, Twitter says there was an unusually high number that traced back to Iran, Israel, and Malaysia. As a result, Twitter says it’s “possible that some of these IP addresses may have ties to state-sponsored actors.”

The company has changed how the API works to make sure this can’t be exploited in the future and apologized to its users for the incident.

February 4, 2020
New Google Chrome Feature May Drive Users to Firefox

The Register is reporting on a new feature in an upcoming version of Google Chrome that has privacy-conscious users worried. A recent API called getInstalledRelatedApps may allow websites to determine what apps are installed on a user’s device.

At first glance, the API seems to have an admirable purpose. If users have both web and native applications installed, they could be bombarded by duplicate sets of notifications. If a website can determine that its native app is installed, it would then prioritize notifications for the native app. Unfortunately, the API doesn’t really seem to be aimed at improving the experience—not for the user at least.

In response to a question from Opera developer Daniel Bratell, expressing concern about how this API would help users, Google engineer Rayan Kanso wrote:

“Although this isn’t an API that would directly benefit users, it indirectly benefits them through improved web experiences,” Kanso wrote. “We received very positive OT [off-topic] feedback from partners using this API, and the alternative is them using hacks to figure whether their native app is installed.”

In other words, this API is more about making it easier for web and app developers’ marketing needs than it is truly making users’ lives easier.

The privacy implications are clear: If websites can determine what apps are installed on a person’s phone or tablet, it can provide a relatively complete picture, otherwise known as a fingerprint, about that person’s habits.

As The Register points out, Peter Snyder, a privacy researcher at browser maker Brave, voiced his own concerns:

“I don’t follow the claim about non-fingerprint-ability. If I’m a company with a large number of apps (e.g. google), with 16-32 apps registered in app stores, the subset of which apps any user has installed is likely to be a very strong semi-identifier, no, and so be extremely risky for the user / valuable for the fingerprinter, no?

“Apologies if I’m misunderstanding, but this seems like a very clear privacy risk.

Put differently, if this isn’t a privacy risk, whats the rational behind disallowing this in private browsing mode?”

With browsers like Firefox and Safari placing an emphasis on privacy and security, it’s a safe bet this is yet another move that will drive users away from Chrome.

December 7, 2019
Roughly 100 Developers May Have Improperly Accessed FaceBook Groups Data

The last few weeks have seen the news go from bad to worse for Facebook, especially on the privacy front. Now the company is admitting that roughly 100 developers may have improperly accessed Groups member data.

In April 2018, Facebook made changes to the Groups API to limit what information administrators could access. Prior to the change, admins could see identifiable information, such as member names and profile pictures. Following the change, group members would have to opt-in for an admin to see that information—at least in theory.

According to Konstantinos Papamiltiadis, Facebook’s Platform Partnerships Head, an ongoing review discovered that some 100 developers had retained access to member information. Papamiltiadis said the company had taken steps to address the issues.

“We have since removed their access. Today we are also reaching out to roughly 100 partners who may have accessed this information since we announced restrictions to the Groups API, although it’s likely that the number that actually did is smaller and decreased over time. We know at least 11 partners accessed group members’ information in the last 60 days. Although we’ve seen no evidence of abuse, we will ask them to delete any member data they may have retained and we will conduct audits to confirm that it has been deleted.”

The post also made a point of promising that the company would continue to improve moving forward.

“We aim to maintain a high standard of security on our platform and to treat our developers fairly. As we’ve said in the past, the new framework under our agreement with the FTC means more accountability and transparency into how we build and maintain products. As we continue to work through this process we expect to find more examples of where we can improve, either through our products or changing how data is accessed. We are committed to this work and supporting the people on our platform.”

Given the current political climate, with politicians on both sides of the aisle increasingly looking at Facebook as a threat to privacy—and some even calling for its breakup—the company will need to do better to convince authorities and users alike that it can be trusted.

November 29, 2019
Truecaller Flaw Puts 150 Million Users at Risk

Zak Doffman at Forbes is reporting on a newly discovered vulnerability in the Truecaller app that puts 150 million iOS and Android users at risk.

Truecaller is one of the premier caller ID apps, identifying unknown calls from mobile, landline and prepaid phones. It also provides the ability to block numbers and auto-block robocalls and telemarketers. The app also offers VoIP calling, call recording, SMS and group chat, as well banking and payments.

Truecaller just recently passed the 500 million download mark, with 150 million daily users. Of those, 100 million are in India, where the app has surpassed Facebook in popularity. According to the company’s blog, “every tenth active user in India has linked their bank account to Truecaller Pay.” The app’s popularity, not to mention the breadth of services offered, makes the vulnerability even more concerning since it is a flaw in the Truecaller API.

According to Mr. Doffman, “India-based researcher Ehraz Ahmed discovered the flaw, disclosing it to local media and the company and waiting for a fix before going public. He explained to me that ‘the flaw allows an attacker to inject his malicious link as the profile URL. The user viewing the attacker’s profile by search or through a popup gets exploited.’ Ahmed has said the flaw could be used to mount serious attacks on target machines, although this was not the scope of the proof of concept and has been played down by the company.

“What Ahmed did manage through his POC was ‘to fetch a user’s information like IP address, User-Agent, and time. The user visiting the profile would not notice this as it all happens in the background, and for the user, it would look like any other profile.’ With the now-patched flaw impacting Truecaller’s API, it is a potential threat to all apps and platforms.”

Mr. Ahmed worked with Truecaller to identify the bug and a patch was immediately released. Because the issue was with the app’s API, the company was able to patch the flaw on their end, although all users should update to the latest version to be on the safe side.

As more and more apps offer services that cross a range of industries, such as communication and banking, flaws like this will represent a much greater threat to users.

November 24, 2019
Twitter Adds Features Making Embedding Easy

Twitter has made it easier to add rich, responsive Tweet displays directly to your website or CMS. There are now 3 options:

1. Factory Functions – Allows you to easily generate timelines for any web app.
2. oEmbed API – Integrate profile, list, like, or collection timelines directly into your CMS.
3. publish.twitter.com – A website that lets you customize the feed and get the code you need to copy and paste into your site.

List template example:

National Park Tweets – Curated tweets by TwitterDev

Grid template example:

National Park Tweets

Timeline types – User timeline:

Tweets by TwitterDev

Find more examples of what you can do at publish.twitter.com here.

Per the Twitter blog:

As part of these improvements, we’ve also removed the need to create and save widgets to your account. Of course, if you already have timeline widgets, you can always access them in your Twitter settings. But, going forward, you won’t need to log in to create or configure embedded timelines, and you’ll never need another widget ID again. All you need is a public profile, list, like, or collection URL to get started.

June 7, 2016
Uber Launches API, Affiliate Program for Developers

Uber thinks that “any app with a map is a potential Uber API partner” – so with that in mind, the on-demand car company is opening the Uber API to all developers.

Uber is launching the API with eleven flagship partners who have already begun to use it – Expensify, Hinge, Hyatt Hotels & Resorts, Momento, OpenTable, Starbucks, Tempo Smart Calendar, Time Out, TripAdvisor, TripCase, and United Airlines.

The API currently allows third-party apps to “pass a destination address to the Uber app, display pickup times, provide fare estimates, access trip history and more,” according to Uber. The company is being a bit more cautious with their main functionality – requesting rides. Since that action would actually send an Uber driver to pick someone up, Uber is releasing that part of the API “in a more controlled fashion.”

“At Uber, our mission is to bring transportation as reliable as running water to everyone, everywhere: just tap a button and your car arrives in minutes. While simple on the surface, the seamlessness of the Uber experience belies the enormous complexity that powers it. But now that we have this fundamental capability in place—a capability we like to think of as converting bits to atoms—in over 40 countries around the world, there are so many things we would love to see built on top of it,” says the company.

To sweeten the pot for developers, Uber has also opened up the API Affiliate Program, which promises Uber credits and other rewards for integrating Uber into their services. Those “other rewards” will include cash at some point in the future.

Image via Uber

August 20, 2014
Google Details Google Drive Android API

Earlier this month, Google upgraded Google Play Services to version 4.1. One of the big features in this latest upgrade was the inclusion of a Google Drive Android API. Now Google has offered more details on what it says provides developers “a faster, seamless experience that enables your apps to integrate with the Drive backend within minutes.”

To start us off, Google says the Drive API will sync app data stored locally with Google Drive storage in the cloud. This happens automatically so a users locally stored data will always be backed up on Google Drive. If the user happens to be offline when creating new local data, the Google Drive API will sync that data with the cloud the next time they get online.

With this being Android, the Google Drive Android API has been designed to work on pretty much every device. There are three specific features you should be aware of though:
There’s minimal impact on the weight of your apps. As the client library is a stub to Google Play Services, incorporating the API has minimal impact on the size of your .apk binaries, resulting in faster downloads, fewer updates, and smaller execution footprint.
User files are automatically synced between different devices (provided the app has the same namespace and is signed with the same key).
Any device running the Gingerbread or later releases of Android and Google Play Services will automatically have support for the Google Drive Android API.

If you don’t want to build your own UI for the new Drive functionality, Google says this initial release comes with both file picker and creator user interface components.

Specific to Android 4.4, Google notes that the Storage Access Framework is a generic client API that allows apps to communicate with multiple storage providers. They encourage developers to use the the Google Drive Android API as it provides “specialized functionality for interacting with files stored on Google Drive.”

To learn more about the Google Drive Android API, check out the documentation and Google’s GitHub page. You can also watch a quick video introduction to the API below:

Image via Google Developers Blog

January 16, 2014

At the Facebook Home unveiling, Mark Zuckerberg said that people are increasingly consuming content on mobile. It’s true for Facebook as is it true for just about everything else. That’s why Facebook needs to step up its mobile game, and it did just that today.

At its Mobile Developer Conference in New York City, Facebook announced that Open Graph is coming to mobile in a big way. The first step is making sure everybody can integrate Open Graph into their mobile apps without having to deal with the complexity of the Graph API. The answer is the Object API – tools that let developers “directly create Open Graph objects” while no longer needing “to host webpages with Open Graph tags.” The new API is available to both mobile and Web apps so that nobody is left out.

To make things even easier, Facebook is also introducing the Object Browser. It’s a “simple visual interface that helps you easily interact with the object data you publish.” For more on the Object API and the Object Browser, check out Facebook’s documentation.

One of the core tenets of Facebook is sharing, and the social network is making it even easier on mobile with the Native Share Dialog. This particular tool allows people to share in-app actions without having to open or log into the Facebook app. It’s also incredibly easy to implement as it only requires a single line of code. The Native Share Dialog is available starting today in a limited beta on iOS with Android support coming soon. Check out Facebook’s documentation for more info.

Users can look forward to an even friendlier Facebook mobile login experience as well as the social network is rolling out a number of enhancements to make things faster and more secure. The first is that Facebook has rebuilt its Login Dialog on mobile and Web to make it 20 percent faster. All Login Dialogs on mobile and non-game Web apps will be automatically upgraded to the new dialog today, but mobile apps can get even faster dialogs in the latest iOS and Android SDKs. If you want more info on Login Dialogs, check out Facebook’s documentation.

As for security, Facebook has split Facebook permissions in mobile apps into two separate dialogs. The first is a mandatory dialog that asks users to share their Facebook data with the app. The second asks users if the app can post content to their Facebook wall on their behalf. In the second dialog, users can either agree, skip the step or customize which people the app can share stories with.

On a final note, Facebook also released the latest version of its SDK for iOS. Version 3.5 of the iOS SDK includes support for all the above enhancements. The latest SDK only supports iOS 5 and above. You can download it here.