Slashdot Mirror
Tinder's Lack of Encryption Lets Strangers Spy on Your Swipes (wired.com)
Tinder's mobile apps still lack the standard encryption necessary to keep your photos, swipes, and matches hidden from snoops, a security firm reports. From Wired: On Tuesday, researchers at Tel Aviv-based app security firm Checkmarx demonstrated that Tinder still lacks basic HTTPS encryption for photos. Just by being on the same Wi-Fi network as any user of Tinder's iOS or Android app, the researchers could see any photo the user did, or even inject their own images into his or her photo stream. And while other data in Tinder's apps are HTTPS-encrypted, Checkmarx found that they still leaked enough information to tell encrypted commands apart, allowing a hacker on the same network to watch every swipe left, swipe right, or match on the target's phone nearly as easily as if they were looking over the target's shoulder. The researchers suggest that lack of protection could enable anything from simple voyeuristic nosiness to blackmail schemes.
whoopty fuckin doo.
i could live a little longer in this prison
Checkmarx found that they still leaked enough information to tell encrypted commands apart, allowing a hacker on the same network to watch every swipe left, swipe right, or match on the target's phone nearly as easily as if they were looking over the target's shoulder.
When different user actions result in widely different application behavior, it will always be easy to infer the user action. E.g., if matching is the only action that does not result in a new profile being presented, then observation of the smaller data exchange will lead to that inference.
The only way to avoid this is to make the network traffic identical for all cases, which is extremely wasteful of bandwidth and, presumably, battery life.
That said, encryption of all data should be standard now. There is some overhead, but it's not the 1990s---crypto is not that burdensome.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Maybe if you've got a stalker watching who you swipe on Tinder, you should ask him/her out on a date instead? Problem solved.
Come on, these people are hooking up strangers, and they will be concerned about security?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
she 4ad no fear Risk lookTing even
These seems like some really shoddy and/or lazy development. More than this particular issue it makes you wonder what other shortcuts or sloppy development they have hiding in their app?
Social media makes your personal information public! Film at 11! Another amazingly, intellectual stimulating contribution by msmash! It's a HOOK UP app for one night stands for crying out loud!
We'll make great pets
What could they possibly learn from the fact that I swipe right on everyone, other than I'm incredibly lonely?
Imagine a 'mess with Tinder' app that sits on your phone, and allows you to inject images of your choice into the stream of anyone using the same local connection.
I would actually love to see the United States evolve forward to 22nd Century homestead life just to watch Assholes be completely clueless about how to survive.
I don't get it.
To be usable the Tinder app requires you to post pictures of yourself, presumably looking as attractive as possible in some way, and a come-on line and a few personal details such as what gender you are and what gender you are looking for. Anybody can view all that.
So after exposing all that what you swipe on is supposed to be a "risk" of some kind? Seems to me that ship already sailed.
Possibility #1: You care about privacy. If you actually care about privacy you are already routing all of your internet traffic through a no-logging VPN paid for through an anonymous crypto-currency wallet. Result: this problem doesn't affect you because all your traffic to the VPN provider is encrypted anyway.
Possibility #2: You don't care about privacy. Result: this also doesn't affect you because you don't care anyway.
Conclusion: non-issue.
I was recommended to this professional hacker, He helped me to expose all my partner’s secret that kept my marriage intact, who he was cheating with and allHe has video proofs, Contact him on: dloxvichackskool @ g m a i l . com contact phone : +1 6 1 9 6 3 2 5 9 2 6 his services include hacking (hint: mobile phones, Instagram, Facebook, gmail,twitter, whatsapp, kik, bank account, iphones, MeetMe, Snapchat, WeChat, hike etc.), tracking, cloning ,upgrading result,preventing you from been hacked or tracked,Adding any important account to your account without account owner knowing he can also help you to spy on your spouse so that you'll know whether he or she is cheating. he can also teach hacking at a very affordable price.
This random stranger is able to see me trying to hook up with random strangers! This security vulnerability leaves me open to being seen by a total stranger, but not necessarily one of the ones I want to be seen by, as far as I know, since they are all strangers.
- For the complete works of Shakespeare: cat
I thought it was "Timber", the dating app for lumberjacks!
"I'm a lumberjack and I'm OK, I work all night and I sleep all day!"