Hacker News new | past | comments | ask | show | jobs | submit login

> 32-byte push token unique to a given device/app pair. It is likely based on the device's global id (UDID) and the application's appid and certificates.

This isn't quite correct, the device token is not unique per app, it's unique per device. (Technically, a device will have two tokens, one for the APNS sandbox, and the second for production.)

The device token can't be derived by mere mortals, it is a cryptographic identifier returned from APNS to the device.




Unfortunately, by a bit of digging I was able to reveal some actual push tokens. I could now send messages to an app that is not mine!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: