Background: I made Splatoon2.ink, a site that shows the current and upcoming map schedules for Nintendo’s Splatoon 2. It pulls data from SplatNet2, their app/site that connects you to game info via the Nintendo Switch mobile app. More information about the SplatNet 2 API can be found here, and source code for Splatoon2.ink can be found here.
Yesterday, a number of sites and tools that pull data from SplatNet 2 stopped working. This seems to be caused by a change to the Nintendo Switch app’s login procedure:
Looks like there’s some new 64-char hash value called “f” on the call to /Account/Login, I’m guessing that’s it. Not sure how it’s generated pic.twitter.com/Nqu2h8xmwx
— Matt Isenhower (@mattisenhower) September 14, 2017
This new parameter appears to be an HMAC SHA256 hash that is likely made up of several pieces of user data and, potentially, a secret key stored within the app itself. Depending on how they’ve implemented this, it may be difficult or impossible to determine how to calculate this hash.
Continue reading SplatNet 2 Login Changes (and How to Avoid Making Nintendo Angry)