Slashdot Mirror
Tinder's Lack of Encryption Lets Strangers Spy on Your Swipes (wired.com)
Tinder's mobile apps still lack the standard encryption necessary to keep your photos, swipes, and matches hidden from snoops, a security firm reports. From Wired: On Tuesday, researchers at Tel Aviv-based app security firm Checkmarx demonstrated that Tinder still lacks basic HTTPS encryption for photos. Just by being on the same Wi-Fi network as any user of Tinder's iOS or Android app, the researchers could see any photo the user did, or even inject their own images into his or her photo stream. And while other data in Tinder's apps are HTTPS-encrypted, Checkmarx found that they still leaked enough information to tell encrypted commands apart, allowing a hacker on the same network to watch every swipe left, swipe right, or match on the target's phone nearly as easily as if they were looking over the target's shoulder. The researchers suggest that lack of protection could enable anything from simple voyeuristic nosiness to blackmail schemes.
Checkmarx found that they still leaked enough information to tell encrypted commands apart, allowing a hacker on the same network to watch every swipe left, swipe right, or match on the target's phone nearly as easily as if they were looking over the target's shoulder.
When different user actions result in widely different application behavior, it will always be easy to infer the user action. E.g., if matching is the only action that does not result in a new profile being presented, then observation of the smaller data exchange will lead to that inference.
The only way to avoid this is to make the network traffic identical for all cases, which is extremely wasteful of bandwidth and, presumably, battery life.
That said, encryption of all data should be standard now. There is some overhead, but it's not the 1990s---crypto is not that burdensome.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Being that is a popular app, there will be a lot of people using it.
There is a lot of taboos in our culture around dating and sexuality in general.
Realizing the perfectly normal seeming person has some sort of fetish, can often be used against them by making it public, making people feeling uncomfortable, or being a reason to separate them from a particular job, group. Or causing divorces and other things, from a moment of curiosity or bad judgement.
These types of services really should take privacy seriously. As breaches can ruin peoples lives.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Maybe if you've got a stalker watching who you swipe on Tinder, you should ask him/her out on a date instead? Problem solved.
Come on, these people are hooking up strangers, and they will be concerned about security?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
These seems like some really shoddy and/or lazy development. More than this particular issue it makes you wonder what other shortcuts or sloppy development they have hiding in their app?
There is also the opportunity for blackmail. A few choice photos that were "leaked" can ruin someone's career, or in some countries, have them executed.
I thought other places would have learned a lesson in protecting their users after the Ashley Madison breach, with the fallout that happened over that. However, guess not.
Time to swipe left on that service until they actually put some value into their internal security.
If you are using an App you may not have such visability even if you are doing a website, other then us tech guys who will dig down into the HTML and see the Pictures are not encrypted?
This argument is like that Microsoft did in the late 1990's to push Active X over Java. While the JavaApplet avoid writing and reading directly to your disk, limiting its functionality. This wasn't the factor in Active X. However the app would pop up an alert stating that this could be dangerous, figuring that the average person would be smart enough to avoid running the active X control from an outside site that isn't trustworthy. That wasn't the case. And in the early 2000's Microsoft got hit with a battery of hacks and spyware because of this.
The average person if trying to get something (A Video, play a game, see content) will click the link and accept the warnings to see such information. The real responsibility lies into the vendor releasing the products. Because people will be stupid, even the best of us, may have lapse in best security practices from time to time. That one Email that really looked legit where you clicked the link, a mistype in an URL bringing you to a phishing site...
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The issue is these people may not actually be perverts, but just looking for romance.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
If you are using the Internet you aren't taking privacy seriously.
That's why I never use the internet. I especially don't use it to post comments to a forum where anyone else might see my opinions on things.
"That's the way to do it" - Punch
I agree 100%. Only idiots use the Internet.
If you are using closed source software you REALLY shouldn't be concerned about privacy, because the software could literally be doing anything.
Imagine a 'mess with Tinder' app that sits on your phone, and allows you to inject images of your choice into the stream of anyone using the same local connection.
I don't get it.
To be usable the Tinder app requires you to post pictures of yourself, presumably looking as attractive as possible in some way, and a come-on line and a few personal details such as what gender you are and what gender you are looking for. Anybody can view all that.
So after exposing all that what you swipe on is supposed to be a "risk" of some kind? Seems to me that ship already sailed.
So unless someone is using Open Source with no internet connection (see also earlier post in this thread from this doofus) then they aren't serious about privacy? I was so sure banks were serious about their privacy too.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Possibility #1: You care about privacy. If you actually care about privacy you are already routing all of your internet traffic through a no-logging VPN paid for through an anonymous crypto-currency wallet. Result: this problem doesn't affect you because all your traffic to the VPN provider is encrypted anyway.
Possibility #2: You don't care about privacy. Result: this also doesn't affect you because you don't care anyway.
Conclusion: non-issue.
This random stranger is able to see me trying to hook up with random strangers! This security vulnerability leaves me open to being seen by a total stranger, but not necessarily one of the ones I want to be seen by, as far as I know, since they are all strangers.
- For the complete works of Shakespeare: cat