Hacker News new | ask | show | jobs
by frankPants 5385 days ago
There's no need for encryption of anything. Send the service a number plate, it returns you an image, tick if that's you're car, and it'll tell you where it is. If it's not it goes to the next one in the list. The issue here, is that the server team haven't tailored the API for the app. They've just dumped everything out to the app via a queryable url string, and let all the logic in there.

/api/v3/plate_search?plate=ABC123 and it can return you the closest match. Search it again from the same phone, get the second mate(track the cookie). It's not that hard, it just takes some thought, and the Westfield, and the vendor have tried to cut corners.