Hacking Grindr Accounts with Copy and Paste • Hacker News Board

Re: Hacking Grindr Accounts with Copy and Paste

#161

Post by komarov_om » Sat, Oct 03, 2020, 9:39 AM UTC

anchpop wrote: post #137

matt123456789 wrote: post #97

Earlier quoted context omitted.

It’s possible that the emailed link contains extra query params which are logged. Checking for the existence of these query params in requests would enable them to verify that reset requests to date were clicked from email rather than using this method.

Also, the referrer header may be different too? Although it's likely nobody thought to log it.

I would expect a "Referer" value to be empty in both cases:

  - directly navigating to a URL after doing a copy-paste
  - opening a link from an email

Re: Hacking Grindr Accounts with Copy and Paste

#162

Post by carlob » Sat, Oct 03, 2020, 9:43 AM UTC

chepaslaaa wrote: post #129

kortilla wrote: post #98

Earlier quoted context omitted.

It’s not really being bi that’s the problem here so much as cheating on a wife secretly

It's only cheating if you're breaking a rule to not sleep with other people. Swingers aren't cheating (assuming they're respecting any agreed upon boundary) when they're having an orgy for example. A bi man with a wife and a family could very well be having sexual encounters with men once in a while with the agreement of his wife (who could well have her own stuff going on too) and it could be a very healthy thing in…

You might be right morally, but in a lot of countries it is still the case that 'not having sex with other people' is a compulsory clause of the marriage contract. So legally it's a little bit murkier.

People have been advocating for marriage contracts that are a bit like the CC license, where you can pick the parts that you agree on.

Re: Hacking Grindr Accounts with Copy and Paste

#163

Post by beaker52 » Sat, Oct 03, 2020, 9:50 AM UTC

I've fixed this exact vulnerability (sans QR code) for a client of mine in the last 2 years. I place the cause for these kinds of issues on the split between "frontend" and "backend" developers, with many frontend developers coming out of code camps able to build client-side rendered single page applications and being very proficient in JavaScript but not having experience with aspects of security-related software design. Back in the olden days, coming through learning PHP which was all server-side, you got a lot more exposure to that. Less so with these React-heavy code camps.

Re: Hacking Grindr Accounts with Copy and Paste

#164

Post by foldr » Sat, Oct 03, 2020, 10:01 AM UTC

ojosilva wrote: post #38

> Hey, do you have a Grindr account? > Lol I can understand this is most probably a private lol by a surprised. But how about we at least stop making these are you gay? Lol! a public moment worth screenshooting? An Ashley Madison data leak is a national embarrassment whereas a Grindr one, a "national security threat" [1]. Being on AM is just a vaudevillian indiscretion, being on Grindr is bro lol that feeds hate and…

The photo used for the account is also kind of mildly offensive in the same vein. (To non-gay readers: this is not actually how gay men pose for their grindr pics.)

Update: I decided to make the same point in the comments on his post and he responded in about the douchiest low-key homophobic way imaginable: http://disq.us/p/2c9pnno Tech has a long way to go on homophobia :(

Re: Hacking Grindr Accounts with Copy and Paste

#165

Post by tsimionescu » Sat, Oct 03, 2020, 10:02 AM UTC

Shouldn't this incur a massive fine under the GDPR? Isn't this gross negligence in data protection?

Re: Hacking Grindr Accounts with Copy and Paste

#166

Post by Saint_Genet » Sat, Oct 03, 2020, 10:13 AM UTC

willio58 wrote: post #96

helios_invictus wrote: post #95

As far as I can tell Grindr has had crappy security and a willful negligent response to security concerns for its entire existence. Don't forget that location tracking in real time of people with Grindr. Don't use Grindr.

I'm not a user of Grindr, but isn't the real time location tracking a feature that users actually like?

It’s how you try to find out if the hot guy across the bar might be up for it.

Re: Hacking Grindr Accounts with Copy and Paste

#167

Post by dzhiurgis » Sat, Oct 03, 2020, 10:24 AM UTC

function_seven wrote: post #64

Nextgrid wrote: post #59

Earlier quoted context omitted.

I don't mean to downplay the issue, but why would LGBT-hostile nation-states target Grindr's infrastructure when it's much easier to detect users at the network level based on TLS SNI (since encrypted SNI is still not a thing thanks to corporate influence)?

Because at the application level, you get so much more data. Who they're talking to, who they're meeting. HIV status, photos, etc.

Grindr doesn't require real email address...

Re: Hacking Grindr Accounts with Copy and Paste

#168

Post by progre » Sat, Oct 03, 2020, 10:29 AM UTC

ruiseal wrote: post #150

Why was it necessary for Troy to create an account on behalf of someone else?

He didn't, his friend created the account. It's usefull to have someone else, on a diffrent device, and IP block to create the account to confirm that it's possible to take over an account that you have no previous connection to.

Re: Hacking Grindr Accounts with Copy and Paste

#169

Post by gentlewater » Sat, Oct 03, 2020, 10:31 AM UTC

I've been on Grindr for years, and I know first hand that their support is as bad as it can get. _Seriously_. I know because they also have a big automated ban problem. In trying to fight their bot issue, they've started auto-banning accounts that trigger their filter in some way or another. I've been banned 4 times without cause. Each time you have to contact support, who seemingly are either unable or not allowed to answer with anything other than canned responses. Three times the support person realized the ban was erroneous and lifted it without further ado. One time the person affirmed it, all while refusing to break from the canned responses or provide any justification. Most frustrating experience I've ever had with a digital service.

Re: Hacking Grindr Accounts with Copy and Paste

#170

Post by mgbmtl » Sat, Oct 03, 2020, 10:34 AM UTC

carlob wrote: post #162

chepaslaaa wrote: post #129

Earlier quoted context omitted.

It's only cheating if you're breaking a rule to not sleep with other people. Swingers aren't cheating (assuming they're respecting any agreed upon boundary) when they're having an orgy for example. A bi man with a wife and a family could very well be having sexual encounters with men once in a while with the agreement of his wife (who could well have her own stuff going on too) and it could be a very healthy thing in…

You might be right morally, but in a lot of countries it is still the case that 'not having sex with other people' is a compulsory clause of the marriage contract. So legally it's a little bit murkier. People have been advocating for marriage contracts that are a bit like the CC license, where you can pick the parts that you agree on.

Marriage is on its way out in many places. In my region of Canada (Quebec), less than 50% of couples with kids are married. That number keeps going down every year.

(There are some automatic protections in the event of a separation.)