Swipe Left: Privacy Practices of Online Dating Apps • Hacker News Board

Re: Swipe Left: Privacy Practices of Online Dating Apps

#31

Post by cporios » Sat, Oct 21, 2017, 8:27 PM UTC

Very relevant paper: "Hardened dildo.io, A Cryptographically Secure, Usable Matchmaking Service"

https://courses.csail.mit.edu/6.857/2016/files/13.pdf

I've actually implemented this paper in a hackathon, but we never launched it. It's basically like tinder, but no central server has access to anyone's likes. Yet, by using homomorphic encryption and a calculation performed on the server (through which no information is revealed), you can know if someone you liked likes you back. It's pretty cool!

Re: Swipe Left: Privacy Practices of Online Dating Apps

#32

Post by mandelbrotwurst » Sat, Oct 21, 2017, 9:53 PM UTC

wolco wrote: post #6

How in the world is logging in using facebook more secure than email. People can create a facebook account people can create an email. Author is fooled into false sense of security around facebook profiles. A facebook account can be just as fake as an email address.

While that is correct, and I would also personally prefer that we continued to use e-mail based authentication for other reasons, Facebook does have measures in place now that make it more difficult to create loads of fake accounts.

Specifically, they now require a phone number to create an account. Getting a new phone number is more difficult than creating an e-mail address, so this will prevent at least some of the fakes.

Re: Swipe Left: Privacy Practices of Online Dating Apps

#33

Post by the_stc » Sat, Oct 21, 2017, 11:26 PM UTC

bogomipz wrote: post #22

the_stc wrote: post #16

Our app has a somewhat Tinder-like feel, though it's paid (escorts). I don't want to go overboard plugging, so see my profile for details. For fun, here's how we score on the article's items: 1. No scammers. We require providers to be vetted in some way (references). Clients are going to need to provide screening to see providers. 2-A. We use our custom login system. Verifying your social media account is just a read…

From you link: >"Servers use full disk encryption and the key must be manually entered at boot." I am curious how do you handle key rotation and storage of encryption keys?

Only a few people have access to the keys, plus a set of third parties (think lawyers) that have a shard of an SSS setup. Changing the boot key can be done now and then.

But we think it is feasible to drop the disks entirely for the main servers. So the disk encryption is an issue for the systems holding our CI and imaging platforms.

Re: Swipe Left: Privacy Practices of Online Dating Apps

#34

Post by the_stc » Sat, Oct 21, 2017, 11:29 PM UTC

rhizome wrote: post #26

alexbecker wrote: post #21

Earlier quoted context omitted.

"Extrajurisdictional" is an interesting euphemism for a criminal enterprise.

In some places, operating a driving school that caters to women is a criminal enterprise.

Escorting might not be viewed as fundamental a right as driving, but yes, same idea. We put morality over legality.

Extrajurisdictional does not just mean criminal. It means that we operate in a way that no specific jurisdiction can apply itself to us. It isn't a wild card to just do whatever we want. We fully intend to pay taxes where possible. We want to be as transparent as possible to avoid money laundering. We have a strict no drugs policy. Strict age requirements, and, as far as possible, no coercion/trafficking/pimping. (If we see one device managing multiple accounts, we'll investigate/ban.)

Re: Swipe Left: Privacy Practices of Online Dating Apps

#35

Post by the_stc » Sat, Oct 21, 2017, 11:35 PM UTC

CPLX wrote: post #28

the_stc wrote: post #16

Our app has a somewhat Tinder-like feel, though it's paid (escorts). I don't want to go overboard plugging, so see my profile for details. For fun, here's how we score on the article's items: 1. No scammers. We require providers to be vetted in some way (references). Clients are going to need to provide screening to see providers. 2-A. We use our custom login system. Verifying your social media account is just a read…

I have to admit, combining prostitution, securities fraud, and blockchain technology in one single project is impressively ambitious even by normal startup standards.

Calling it securities fraud is rather unfair if you ask me. Why do you say fraud? Sure, we do not follow the SEC rules. In fact, the SEC opinion on ICOs is what galvanized us to go all out and insist on offering real equity to investors. It's far better than the nonsense ICOs come up with to tokenize themselves.

People like the Tezos group, asking for donations... it is disgusting that investors go for that. Demand equity. We always choose morality over legality. Following SEC rules technically, while ripping off investors ... I'd rather be in the clear ethically.

The blockchain part is for payments, so not that big of a deal. Though to raise money, we'd be better off finding a blockchain angle to the platform! Truthfully though, our app is not breaking new tech ground, apart from privacy and security (see the link in my original post).

We are ambitious though! I think we'll be the first blockchain-funded unicorn. Escorting is fragmented and high friction, and we're going to fix it. Our VP of Product is an active sex worker and very tuned in to the real issues facing workers and clients.

Re: Swipe Left: Privacy Practices of Online Dating Apps

#36

Post by the_stc » Sat, Oct 21, 2017, 11:39 PM UTC

odammit wrote: post #17

the_stc wrote: post #16

Our app has a somewhat Tinder-like feel, though it's paid (escorts). I don't want to go overboard plugging, so see my profile for details. For fun, here's how we score on the article's items: 1. No scammers. We require providers to be vetted in some way (references). Clients are going to need to provide screening to see providers. 2-A. We use our custom login system. Verifying your social media account is just a read…

Uh- That is a really cool article you shared. Very impressive stuff. Would love to read a write up on: > Our servers don't have persistent storage, RAM only. (At boot, it's a manual restore from something like Tarsnap.)

We may write up more when we have things stably working after a while. But we are very cautious mentioning any specific tools, as that gives attackers a head-start. We won't mention OS, stack, DB, etc.

But think something like secure boot, serve up a basic image, download full image from provisioning servers, turn on DB, restore from backups.