AppSec California 2016

Snapchat does not offer a public API to access its service. Motivated third parties have taken great lengths to reverse-engineer our protocol and build applications on top of it, which could put our users at greater risk of account compromise. In 2014, one such third party was breached and exposed some user data they’d collected from Snapchatters. Their breach reinforced our desire to continue to do more to protect our users from third-party abuse.

In this talk we cover a number of defenses we have put in place both client and server-side since then, in a long-running cat and mouse game with determined third parties. We’ll expand on what worked, what didn’t, and what we learned from our efforts -- which we believe are unique in the social networking space.