I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/
Which could then be used for the purpose of exploiting Instagram's private API, like so: https://gist.github.com/will3942/8113903#file-app-rb
A few personal questions arose out of this:
- Is there anything else the Instagram security engineers could have done to prevent this from happening? I assume they are extremely talented software engineers, but does having a user in possession of an app, in this case in the form of an android
.apk, make it always inherently easier/always possible for people to discover secret keys?
- Are web apps inherently more secure than mobile apps? Let's say that the Instagram web app is identical to their mobile app. Would it still be possible for someone to extract the web app secret keys, or is this much more difficult, if not impossible, to do because the user will never be in possession of the full source code of the web app.