I played a little with reverse engineering Kik a while ago. I'm not sure about the messages, but I was able to siphon off the plaintext password using ngrep. It's XMPP, btw.
When they originally launched, they were not using SSL, and were using plain text authentication. Since then, they changed the authentication so it wouldn't be sent in plain text. Then they later added SSL. Then in the middle of last year, they updated their SSL setup so it actually did certificate verification.
It took them a while to get there, but it's secure now.
Comments
I played a little with reverse engineering Kik a while ago. I'm not sure about the messages, but I was able to siphon off the plaintext password using ngrep. It's XMPP, btw.
When they originally launched, they were not using SSL, and were using plain text authentication. Since then, they changed the authentication so it wouldn't be sent in plain text. Then they later added SSL. Then in the middle of last year, they updated their SSL setup so it actually did certificate verification.
It took them a while to get there, but it's secure now.