Tinder's lack of encryption allows spying
nakedsecurity.sophos.com
Tinder's lack of encryption allows spying
1–10 of 35 posts
Re: Tinder's lack of encryption allows spying
#2So where is the github link that let's us play with this?
Re: Tinder's lack of encryption allows spying
#3I remember this issue with S3 files and being unable to configure certificate correctly. What's the correct steps to get that to work?
Also, clever find that there's a side channel on left vs right swipe. What caused these payload differences?
Re: Tinder's lack of encryption allows spying
#4I understand this might be a security issue, and I guess Checkmarx gets their name out. You can tell if someone swipped left or right on someone. However how is this information useful for someone?
Re: Tinder's lack of encryption allows spying
#5I understand this might be a security issue, and I guess Checkmarx gets their name out. You can tell if someone swipped left or right on someone. However how is this information useful for someone?
I can imagine ways that a stalker/abuser would find this "useful" information and use it to harm, taunt, threaten, scare or harm their target.
Re: Tinder's lack of encryption allows spying
#6I understand this might be a security issue, and I guess Checkmarx gets their name out. You can tell if someone swipped left or right on someone. However how is this information useful for someone?
There is the issue of the TLS connection of images fetched in the app (other things too?) being tied to a domain without a valid cert. In other words, you could MITM the TLS session between the wifi user and the Tindr servers for AT LEAST photos within the app, perhaps more (authentication? other app behavior?).
Because the app isn't strictly enforcing the validation of the cert of the photos domain it's trying to reach to pull photos, your MITM server is free to serve to the app as if it was the server on the Internet.
Re: Tinder's lack of encryption allows spying
#7I understand this might be a security issue, and I guess Checkmarx gets their name out. You can tell if someone swipped left or right on someone. However how is this information useful for someone?
The article says that it looks like profile images can be downloaded insecurely. So now you can snoop on what people are looking at. And liking. Opportunities for blackmail, doxxing, griefing, etc., abound.
Also, attacks don't have to exist in a vacuum. As part of a larger suite of attacks, it appears to be a useful tool that can help build up a profile of somebody.
The answer when it comes to hacking is almost never "why". Rather, it's usually "why not".
Re: Tinder's lack of encryption allows spying
#8The most surprising thing about this to me is how long it took to have a new cycle about it.
Firesheep was a 2010 invention. Once that happened, anyone could chill in a coffeeshop and watch the http traffic whizz by.
... as much as we want to excoriate Tinder, it's been reasonable for most of their users to have 'i dgaf' as their threat model.
Re: Tinder's lack of encryption allows spying
#9The most surprising thing about this to me is how long it took to have a new cycle about it. Firesheep was a 2010 invention. Once that happened, anyone could chill in a coffeeshop and watch the http traffic whizz by. ... as much as we want to excoriate Tinder, it's been reasonable for most of their users to have 'i dgaf' as their threat model.
Just a note, Firesheep didn't implement generic traffic sniffing, just cookie-cloning, and that only when someone implemented a Firesheep plugin with an appropriate regular expression or whatever for a given site. So the existence of Firesheep itself wouldn't allow people to passively watch traffic for arbitrary sites, and not even to perform attacks against newly popular sites if no community kept it up to date for those sites.
Re: Tinder's lack of encryption allows spying
#10I remember this issue with S3 files and being unable to configure certificate correctly. What's the correct steps to get that to work? Also, clever find that there's a side channel on left vs right swipe. What caused these payload differences?
I think unless you want to use your own custom DNS, you don't even need to set up certificates, *.amazonaws.com has HTTPS already, with amazon certs. If you want SSL on your own DNS, I think you're forced to use cloudfront - perhaps they didn't want to pay for that :|