What you need to know
- It's reported that hundreds of emails were leaked through the Shot on OnePlus app.
- An unencrypted access key was used to access user information.
- Email addresses could be cycled through using an insecure gid.
Privacy is an ever-increasing topic of discussion in our world, with companies like Facebook and Google regularly coming under fire for slip-ups here and there. Now, it's OnePlus's time to shine as a report shows that it's been leaking names and emails for hundreds of users of its Shot on OnePlus app.
If you have a OnePlus phone, you're probably familiar with Shot on OnePlus. It can be accessed through the wallpaper selector, and if you upload a photo to it, you can share it with other OnePlus users for them to download.
According to 9to5Google, the API used to connect the app to OnePlus's server is highly unprotected. The API is hosted on open.oneplus.net, and to access its information, all you need is an access token. Another key is required to get that token, but it's unencrypted and seemingly easy to get your hands on.
With access to the API, you can access a heap of personal information for Shot on OnePlus users, including their name, email address, country of residence, phone model, and more. Along with having access to that information, it can also be changed/updated.
Making matters worse is the Shot on OnePlus gid — an alphanumeric code that's associated with each Shot on OnePlus user. With access to the API, you can cycle through gid numbers as you please and look at information for user after user.
OnePlus has been aware of this since early May, and after being contacted by 9to5Google, OnePlus "quickly made changes to the API...and it is no longer leaking the gid and email of users whose photos are posted publicly."
Email addresses are also now obscured on the API, showing asterisks in place of the proper address.
OnePlus has yet to publicly comment on the findings, but should that change, we'll update this article accordingly.
With a single update, OnePlus ruined OxygenOS for me
OnePlus is embarking on a new visual identity with OxygenOS 11, with the manufacturer switching away from stock Android and offering a UI that's similar to Samsung's One UI. Here's why I'm not on board with the new design.
You can preorder the Surface Duo at Best Buy right now
If you're waiting to preorder your Surface Duo from Best Buy, wait no more. The big-box retailer has preorders available for both models, with prices starting at $1,400.
An all-new Cortex-X Exynos chip will supercharge the industry
An Exynos chip with AMD graphics and custom Cortex-X cores could be just what we wanted — and what the industry needs.
These are the best OnePlus phones you can buy in 2020
Thinking about joining Team OnePlus but aren't sure which of the company's gadgets is right for you? Let us help you find the perfect OnePlus phone!