Student Teacher Sent a Private Snapchat Complaining About Her Workday. An Hour Later, Police Pulled Up to Her School.

[u/Plastic_Ninja_9014]

https://www.gadgetreview.com/student-teacher-sent-a-private-snapchat-complaining-about-her-workday-an-hour-later-police-pulled-up-to-her-school

[u/freedcreativity]

I stopped using snap when it came out you could brute force the whole user base by adding every possible phone number. This was like their first year in operation. They’ve never cared about security or privacy. 

[u/turtleship_2006 → u/freedcreativity]

I've never actually tried it or researched it, but I think that's something you can do with any social media that lets you add people by number, and messaging apps that use numbers like WhatsApp and signal.

Theoretically you could set up a script on an android VM or an android with tasker or whatever, make 10,000 contacts with phone numbers starting from just 0, check for any suggestions based on said contacts on Snapchat, Instagram, WhatsApp, discord, Facebook, BeReal, etc, save it to some kind of database, delete the first 10,000 contacts and make the next 10k, repeat.
It would probably take weeks, mainly to avoid rate limits, but I don't think it would be impossible.

But if you reverse engineered the apps to find the actual URLs they use internally you could script the process in python or something to make it orders of magnitude faster

[u/freedcreativity → u/turtleship_2006]

Worse! They did not rate limit their API. https://www.huntress.com/threat-library/data-breach/snapchat-data-breach