Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Grindr Accounts with Copy and Paste

troyhunt.com

Post reply on HN
Print view View original

91–100 of 202 posts

Re: Hacking Grindr Accounts with Copy and Paste

#91

Post by thaumasiotes »

013a wrote: post #84

This issue is incredibly strange and severe. One thing I did notice, though: The timestamps on the Twitter DMs, which were used as evidence to assert that they're unresponsive in DMs, cover a time period of 90 minutes. The language the twitter client is set to is also not english (maybe French? the original discovery was made by someone who lives in France. I don't know), which introduces the possibility that it wasn…

> This issue is incredibly strange and severe.

Severe, yes. It doesn't seem that strange.

You could have a flow like:

Reset page receives email address and passes it to some backend functionality. The backend checks whether the email address corresponds to an account on the site. It does, so the backend generates a reset token and emails it to the address on the affected account.

All of that is supposed to happen. What's also happening is that the reset token is being returned to the reset page, where the person requesting the reset can see it. This is very bad, but it seems likely to have come from some sort of automatic connect-your-frontend-pages-to-backend-services framework solution.

Re: Hacking Grindr Accounts with Copy and Paste

#92

Post by thaumasiotes »

perardi wrote: post #19
sebmellen wrote: post #13

Earlier quoted context omitted.

Uh... One part of it is not returning password reset tokens in the browser. If you know remotely anything about web security this is the most glaring security flaw you could ever encounter. Other steps are nice to think about, but ensuring basic security measures would preempt 99% of data breaches and "hacks".

Yeah, in this particular case, they were just glaringly stupid. Just gaming out ideas in my head. I have friends from rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance, and I’m just thinking of better ways to structure a system.

> rather more repressive countries, namely China, where being gay is still a grey area in terms of legality and acceptance

...what?

Re: Hacking Grindr Accounts with Copy and Paste

#93

Post by thaumasiotes »

on_and_off wrote: post #80
sneak wrote: post #73

Earlier quoted context omitted.

Governments. It was likely used by governments. Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

I wonder why you are getting downvoted so much. I don't know how common bi-men are (probably more than bi erasure makes us believe) but it feels like a least a portion of them are not ready to come out as bi.

> I don't know how common bi-men are (probably more than bi erasure makes us believe)

They're not that common. The literature shows a bimodal straight/gay distribution of homosexual tendency in men and a more Gaussian distribution in women.

Re: Hacking Grindr Accounts with Copy and Paste

#94

Post by [deleted] »

on_and_off wrote: post #80
sneak wrote: post #73

Earlier quoted context omitted.

Governments. It was likely used by governments. Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

I wonder why you are getting downvoted so much. I don't know how common bi-men are (probably more than bi erasure makes us believe) but it feels like a least a portion of them are not ready to come out as bi.

[deleted]

Re: Hacking Grindr Accounts with Copy and Paste

#96

Post by willio58 »

helios_invictus wrote: post #95

As far as I can tell Grindr has had crappy security and a willful negligent response to security concerns for its entire existence. Don't forget that location tracking in real time of people with Grindr. Don't use Grindr.

I'm not a user of Grindr, but isn't the real time location tracking a feature that users actually like?

Re: Hacking Grindr Accounts with Copy and Paste

#97

Post by matt123456789 »

Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

It’s possible that the emailed link contains extra query params which are logged. Checking for the existence of these query params in requests would enable them to verify that reset requests to date were clicked from email rather than using this method.

Re: Hacking Grindr Accounts with Copy and Paste

#98

Post by kortilla »

anonymousiam wrote: post #90
sneak wrote: post #73

Earlier quoted context omitted.

Governments. It was likely used by governments. Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

I've never been gay or bi, and I've never used Grindr, but I have held government security clearances for almost 40 years. It's a lot different today than it was back then. Early on, I knew several people who had "experimented" in college, and they were denied clearances. (Actually the government never officially denied them because that would require an explanation of the criteria used for the denial. Instead, it wa…

It’s not really being bi that’s the problem here so much as cheating on a wife secretly

Re: Hacking Grindr Accounts with Copy and Paste

#99

Post by Havoc »

Troy is obviously a good guy but I think he may be stepping into murky waters here with the switch from logging pwns to actively investigating.

Think he'll do a legit job either way but it seems like a gamble to me. Investigative stuff is well...more murky

Re: Hacking Grindr Accounts with Copy and Paste

#100

Post by kbos87 »

willio58 wrote: post #96
helios_invictus wrote: post #95

As far as I can tell Grindr has had crappy security and a willful negligent response to security concerns for its entire existence. Don't forget that location tracking in real time of people with Grindr. Don't use Grindr.

I'm not a user of Grindr, but isn't the real time location tracking a feature that users actually like?

The real-time location tracking is very central to the app. It’s a grid of people organized by distance.
Post reply on HN