“I decided to get a friends key, put it in, and then see what I could access, and sure enough, as I was leaving him messages and as he was receiving messages, I was getting their content verbatim in close to real-time,” writes thecodingdude. If this API key falls into the wrong hands, then there’s a good chance your data will, too. That includes your text messages and email previews, URLs, and any files you send through the service. Every Pushbullet user is assigned an API key - you can find yours on your account page - which allows apps to connect to your Pushbullet “stream” and read the data flowing through it. “Information is sent from the socket and back down to the client, which can then make use of any data it receives.”

“Recently, I noticed that Pushbullet released a new API which makes use of websockets, a new real-time communication methodology between you and the server,” explains thecodingdude. Before you rush off to uninstall the app, however, you should know that it isn’t as bad as it sounds.

When I wrote a post about the latest Pushbullet update last week, and gushed about how much I loved using it, I was unaware of a security concern that was recently revealed by a third-party developer on Reddit.

The company is working hard to implement the OAuth authorization framework to provide users with limited and revocable API keys that will make their data more secure - but it insists that your data is safe in the meantime just as long as you don’t share your existing key. Pushbullet has acknowledged a major security concern with its popular Android app and promised to make improvements in future updates.

Pushbullet get api key