Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Grindr Accounts with Copy and Paste

troyhunt.com

Post reply on HN
Print view View original

131–140 of 202 posts

Re: Hacking Grindr Accounts with Copy and Paste

#131

Post by GarrisonPrime »

DevX101 wrote: post #53

If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day. I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.

Honestly, I wouldn't be surprised if this was an intentional back door (...) that Grindr was required to create and let foreign authorities know about in exchange for being allowed to market the app in their country.

Re: Hacking Grindr Accounts with Copy and Paste

#132

Post by rocqua »

grayfaced wrote: post #25
Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

I was disturbed by that statement as well. It's pure PR spin based on turning a blind eye. They could detect mass malicious activity if a single IP was resetting thousands of accounts. But I'm skeptical they even checked based on the horrible initial flaw and specious response.

saying they are working on the disclosure system is good especially because it seems unprompted.

Re: Hacking Grindr Accounts with Copy and Paste

#133

Post by rocqua »

Nextgrid wrote: post #59
DevX101 wrote: post #53

If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day. I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.

I don't mean to downplay the issue, but why would LGBT-hostile nation-states target Grindr's infrastructure when it's much easier to detect users at the network level based on TLS SNI (since encrypted SNI is still not a thing thanks to corporate influence)?

proof wise, there is a difference.

Blackmail wise, there is an even bigger difference. "I know you use grindr" vs "this is your last conversation on grindr". These have very different credibility and impact when leaked.

Re: Hacking Grindr Accounts with Copy and Paste

#134

Post by joosters »

wyattpeak wrote: post #120
chki wrote: post #68

Earlier quoted context omitted.

If that's an intentional backdoor it's a very weird backdoor. Wouldn't you at least obfuscate things a little bit? Simply mixing up the characters in that string in some pre-planned order would be enough.

While I doubt it's an intentional backdoor, I wouldn't assume that backdoors would be obfuscated. You can't deny knowledge of an obfuscated backdoor, while an obvious one could plausibly be a simple mistake.

If you stick with that logic, you’ll think every mistake is a backdoor !

Re: Hacking Grindr Accounts with Copy and Paste

#135

Post by lwhi »

thaumasiotes wrote: post #93
on_and_off wrote: post #80

Earlier quoted context omitted.

I wonder why you are getting downvoted so much. I don't know how common bi-men are (probably more than bi erasure makes us believe) but it feels like a least a portion of them are not ready to come out as bi.

> I don't know how common bi-men are (probably more than bi erasure makes us believe) They're not that common. The literature shows a bimodal straight/gay distribution of homosexual tendency in men and a more Gaussian distribution in women.

Literature?

Seriously?

Surely the way someone identifies public doesn't necessarily match with reality.

Re: Hacking Grindr Accounts with Copy and Paste

#136

Post by SebastianKra »

ed25519FUUU wrote: post #89
megous wrote: post #88

One reason why generating random email address for each registered account is a good practice if you care about security, and can sometimes save you.

This is why I love sign up with Apple. Even though developers don’t like it, it’s good for users privacy and security.

In theory, yes. But since it itself has had significant security flaws, since it's so difficult to log in without apple devices, and since you cant trust Apple to be neutral (they recently deleted all Sign-In-With-Apple Accounts from Epic, even though that has very little to do with their dispute and will hurt customers more than Epic), I'd rather reuse my email a couple of times than sell even more of my soul to this volatile company.

Re: Hacking Grindr Accounts with Copy and Paste

#137

Post by anchpop »

matt123456789 wrote: post #97
Nextgrid wrote: post #18

> we believe we addressed the issue before it was exploited by any malicious parties I wonder how they are sure of this. In their logs, there would be no difference between a legitimate password reset and a malicious one, given that even a legitimate flow would result in an initial request from some IP address, then when the user receives the email with the reset link they will most likely click on that from the same…

It’s possible that the emailed link contains extra query params which are logged. Checking for the existence of these query params in requests would enable them to verify that reset requests to date were clicked from email rather than using this method.

Also, the referrer header may be different too? Although it's likely nobody thought to log it.

Re: Hacking Grindr Accounts with Copy and Paste

#138

Post by thefreeman »

sneak wrote: post #125
anonymousiam wrote: post #90

Earlier quoted context omitted.

I've never been gay or bi, and I've never used Grindr, but I have held government security clearances for almost 40 years. It's a lot different today than it was back then. Early on, I knew several people who had "experimented" in college, and they were denied clearances. (Actually the government never officially denied them because that would require an explanation of the criteria used for the denial. Instead, it wa…

Foreign governments blackmailing US government staff is only one side of the equation. There is, of course, the whole "but what would the wife/churchfellows think?" issue, still, but there are still many countries that do not take the same enlightened view that the US does. It's entirely possible that even the ability to verify that a particular email address has a Grindr account may be enough to threaten a person wi…

verifying that an email has an account is unfortunately always unavoidable. all you need to do is attempt to register with that email.

Re: Hacking Grindr Accounts with Copy and Paste

#140

Post by solumos »

GarrisonPrime wrote: post #131
DevX101 wrote: post #53

If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day. I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.

Honestly, I wouldn't be surprised if this was an intentional back door (...) that Grindr was required to create and let foreign authorities know about in exchange for being allowed to market the app in their country.

Assuming that's true, why would they publicly expose the back door as an anonymous API endpoint that's used in a standard flow within the product? Incompetence seems much more likely.

I'm not even sure that would constitute a "back door" - it's more of an "additional front door with no lock whatsoever".

Post reply on HN