How Hackney Works
Hackney is an app that lets you compare real-time prices across ride-hailing services. This blog post is a technical explanation of how the app works and how it keeps your credentials secure.
To use Hackney, you’ll need to log into the app with your ride-hailing accounts. The app pulls prices through your accounts, which allows the app to show accurate prices that reflect any discounts available to you. In addition to prices, the app uses your accounts to show your past rides across ride-hailing services in a unified view, and to present shortcuts to locations you’ve saved such as home and work.
Hackney works client-side. This means the app on your phone sends network requests directly to the servers of each ride-hailing platform, not to an intermediary server operated by Hackney. With this design, your credentials are not sent to Hackney’s servers, which keeps your accounts secure.
The following sections describe the app’s workings in detail and show actual network requests sent by the app so you can see that it communicates directly with ride-hailing services. These requests were captured using HTTP Toolkit.
Connect Accounts
When you sign into Hackney with a ride-hailing account, your login details are sent directly to that ride-hailing platform’s server. The server responds with an authentication token for your account, which Hackney stores locally on your device.
Uber
To connect Uber, Hackney presents Uber’s official login webpage, which is hosted on Uber’s servers. All data you enter on the site is sent directly to Uber.
Lyft
To connect Lyft, Hackney passes your login details directly to Lyft’s servers.
Waymo
To connect Waymo, Hackney presents a Google sign-in page. The page is operated by Google, and all information you enter is sent directly to Google’s servers.
Ride Prices
When you search for ride prices in Hackney, the app sends price requests to the servers of ride-hailing platforms. These requests include your account’s authentication token, so the prices you see reflect any discounts available to you. The app then locally parses the responses to display prices.
Uber
The app sends network requests directly to Uber’s servers for ride options and the route.
Lyft
The app sends network requests directly to Lyft for ride options and the route.
Waymo
The app sends a network request directly to Waymo’s servers for the price, wait time, and route.
Ride History
Hackney lets you see your past rides across ride-hailing services in a unified view. This is done client-side: the app sends network requests for ride history to ride-hailing services, then processes the responses on your device.
Below are requests sent by Hackney for past rides.
Uber
Lyft
Waymo
Why This Matters
With Hackney’s client-side approach, your phone stores your authentication tokens, makes requests directly to ride-hailing providers, and processes the responses on-device.
There are other apps for ride-hail price comparison that run server-side. Those apps ask you to log in with your ride-hailing accounts, then store your authentication tokens on their server. When you search for prices, their server sends requests to ride-hailing providers, processes each response, and sends the result to your phone. With that approach, their servers store tokens that grant full access to your ride-hailing accounts. You would need to trust the creators of those apps to use your accounts and data in a way that is aligned with your interests.
Hackney is designed so that your ride-hailing accounts remain private. That’s why it uses a client-side architecture that stores your authentication tokens on your phone. It’s built to be the app you can rely on when you need a ride.
Hackney is an independent app not affiliated with, or endorsed by, Uber, Lyft, or Waymo.
Uber is a trademark of Uber Technologies, Inc.
Lyft is a trademark of Lyft, Inc.
Waymo is a trademark of Waymo LLC.
Hi,
I read your blog post on Hackney and tried to replicate your method on the Ever app. However, despite setting up HTTP Toolkit and properly bypassing the SSL Pinning (which is usually the main hurdle), it's still not working at all.
Given that the tools you presented don't seem to yield any results on the current version of the app, I'm wondering if your article omitted some key steps, or if the app's security has been updated since you wrote it.
Could you clarify how exactly you achieved this? Did you have to deal with additional security layers (like custom request encryption, root detection, or specific Frida scripts) that weren't mentioned in the post?