Live data from Hacker News

Tinder's lack of encryption allows spying

nakedsecurity.sophos.com

11–20 of 35 posts

Re: Tinder's lack of encryption allows spying

#11

I understand this might be a security issue, and I guess Checkmarx gets their name out. You can tell if someone swipped left or right on someone. However how is this information useful for someone?

The article says that it looks like profile images can be downloaded insecurely. So now you can snoop on what people are looking at. And liking. Opportunities for blackmail, doxxing, griefing, etc., abound. Also, attacks don't have to exist in a vacuum. As part of a larger suite of attacks, it appears to be a useful tool that can help build up a profile of somebody. The answer when it comes to hacking is almost never…

disclaimer: let's have https everywhere and all that.

That said, you've described the 'why not'. All of the attacks you've identified are targeted and require significant investment. This opening doesn't allow for economically profitable mass-collection and exploitation (like say, grabbing credit cards or hacking into email accounts).

Re: Tinder's lack of encryption allows spying

#12

I understand this might be a security issue, and I guess Checkmarx gets their name out. You can tell if someone swipped left or right on someone. However how is this information useful for someone?

There is the issue of the TLS connection of images fetched in the app (other things too?) being tied to a domain without a valid cert. In other words, you could MITM the TLS session between the wifi user and the Tindr servers for AT LEAST photos within the app, perhaps more (authentication? other app behavior?). Because the app isn't strictly enforcing the validation of the cert of the photos domain it's trying to re…

Personally, I'm resisting the urge to MITM a coffee shop wireless AP and replacing all profile image requests with a request for a random picture of Donald Trump.

Re: Tinder's lack of encryption allows spying

#13

The most surprising thing about this to me is how long it took to have a new cycle about it. Firesheep was a 2010 invention. Once that happened, anyone could chill in a coffeeshop and watch the http traffic whizz by. ... as much as we want to excoriate Tinder, it's been reasonable for most of their users to have 'i dgaf' as their threat model.

> Firesheep was a 2010 invention. Once that happened, anyone could chill in a coffeeshop and watch the http traffic whizz by.

That's incorrect. Firesheep performed session hijacking using unencrypted session cookies.

Re: Tinder's lack of encryption allows spying

#14
post #2

So where is the github link that let's us play with this?

Why would they make a github repo with this exploit for a seemingly not-fixed bug? If you're a security researcher it shouldn't be that hard for you to replicate it, and if you're not, there's no reason for you to have access to an app that lets you easily MITM someone's tinder results.

Re: Tinder's lack of encryption allows spying

#15
Funny, I remember setting up a mitm proxy on a Raspberry Pi for Tinder when I was designing an interactive display of my tinder likes and dislikes. Even used the content-length trick to bypass installing a custom root cert on my phone to decrypt swipe status. Didn't think about the security implications about it at the time but in hindsight it was terrible security practice.

Re: Tinder's lack of encryption allows spying

#18

Earlier quoted context omitted.

The article says that it looks like profile images can be downloaded insecurely. So now you can snoop on what people are looking at. And liking. Opportunities for blackmail, doxxing, griefing, etc., abound. Also, attacks don't have to exist in a vacuum. As part of a larger suite of attacks, it appears to be a useful tool that can help build up a profile of somebody. The answer when it comes to hacking is almost never…

disclaimer: let's have https everywhere and all that. That said, you've described the 'why not'. All of the attacks you've identified are targeted and require significant investment. This opening doesn't allow for economically profitable mass-collection and exploitation (like say, grabbing credit cards or hacking into email accounts).

That's a bad line of thinking. Privacy doesn't work this way: there are a lot of things that you do every day and keep private even though they cannot easily be exploited. It's human nature.

Re: Tinder's lack of encryption allows spying

#19
post #3

I remember this issue with S3 files and being unable to configure certificate correctly. What's the correct steps to get that to work? Also, clever find that there's a side channel on left vs right swipe. What caused these payload differences?

I think unless you want to use your own custom DNS, you don't even need to set up certificates, *.amazonaws.com has HTTPS already, with amazon certs. If you want SSL on your own DNS, I think you're forced to use cloudfront - perhaps they didn't want to pay for that :|

CloudFront is cheaper than S3. S3 is for storage, CloudFront is for distribution.

Re: Tinder's lack of encryption allows spying

#20

Earlier quoted context omitted.

I think unless you want to use your own custom DNS, you don't even need to set up certificates, *.amazonaws.com has HTTPS already, with amazon certs. If you want SSL on your own DNS, I think you're forced to use cloudfront - perhaps they didn't want to pay for that :|

CloudFront is cheaper than S3. S3 is for storage, CloudFront is for distribution.

Right, I think you would need to put cloudfront in front of s3 in this case, which is what makes it more expensive.
Post reply on HN