Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

21–30 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#21

Post by jfoutz »

dfedbeef wrote: post #15
Cu3PO42 wrote: post #7

It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…

You shouldn't be touching the server-side code if you find this hard to keep straight.

Eternal September. Everyone starts somewhere, it’s just all the time now. In ten years, the dev will explain to a junior how bad they messed up, and why they have to validate this way. Well, I don’t know, but that’s what I hope.

Re: Vulnerabilities in the Feeld dating app

#22

Post by benoau »

dfedbeef wrote: post #15
Cu3PO42 wrote: post #7

It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…

You shouldn't be touching the server-side code if you find this hard to keep straight.

Junior developer probably opened a Jira ticket, saw a UI of a permission dialog, and did exactly that task with nobody senior enough to know better. That's how you reproduce the bugs that were in-fashion 15 - 20 years ago in my experience!

Re: Vulnerabilities in the Feeld dating app

#23

Post by FragrantRiver »

dfedbeef wrote: post #15
Cu3PO42 wrote: post #7

It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…

You shouldn't be touching the server-side code if you find this hard to keep straight.

They didn't ;)

Re: Vulnerabilities in the Feeld dating app

#24

Post by aitchnyu »

throwuxiytayq wrote: post #3

Criminal negligence levels of failure, especially given the category of app.

I was that cheap contractor. My bosses were oblivious to anything but schedule and bugs surfacing to the client's reviewer. Guess threats of imprisonment in US and EU and data and insurance for data (if photos are not suitable for LinkedIn, you pay eye-watering prices) will be only deterrent.

Of course, the incentives shouldn't promote coverups.

Re: Vulnerabilities in the Feeld dating app

#25

Post by xenospn »

1_1xdev1 wrote: post #12
Incipient wrote: post #5

Earlier quoted context omitted.

I think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.

I used the app briefly a few months prior to their discovery. The app was riddled with bugs. Things like chats not loading (received the push notification, but in the app not visible until force quit/reload). I’m not surprised it took them so long to remediate. I would guess a shoestring contractor dev team.

This is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.

Re: Vulnerabilities in the Feeld dating app

#26

Post by ramimac »

a091 wrote: post #6

interesting read - anyone have pointers to other app pentesting walk throughs like this?

https://github.com/juliocesarfort/public-pentesting-reports is a substantial collection of public reports

Off the top of my head, DoyenSec has some good reports in there targeting web apps

Re: Vulnerabilities in the Feeld dating app

#27

Post by tgv »

And that’s a very good reason never to fill in exact personal data, e.g. date of birth. Especially dating apps seem to need them, but don’t do it. Fill in something within a year or so from your real birthday.

And while this dating app isn’t well known, it caters to people with different tastes (such as bdsm and group sex) and queer people. Needless to say that this is very sensitive in many parts of the world.

Re: Vulnerabilities in the Feeld dating app

#29

Post by qingcharles »

0xbadcafebee wrote: post #20

I am honestly amazed that these researchers held off for as long as they did on publishing. If crappy startups are given 6 months to close egregiously bad privacy holes like this, they will continue to abuse the privilege they have in collecting this information to begin with. I say give them 2 months and then release. Fuckers need to learn not to play dice with people's private information.

The question is -- did others know about it?

e.g. https://news.ycombinator.com/item?id=41517747

Re: Vulnerabilities in the Feeld dating app

#30

Post by doix »

Cu3PO42 wrote: post #7

It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…

> Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community at large what needs to be done, but getting everyone to apply this consistently is... not so easy.

I don't see those as the same. Buffer overflow checks are a very specific implementation (and language) detail and can happen absolutely anywhere in a codebase. Permission checks happen at a specific boundary and are related to how you design your application.

Whenever I had any say on how a project was developed, I'd always insist on a clear separation between the development of the backend API and the frontend client code. In my experience, it makes things like this much easier to avoid (and test for). You also get a developer API for "free" (which to be honest, is the main reason I prefer to do it that way).

Post reply on HN