Loved the read. I read enough dry stuff all day so this was a nice break :)
Vulnerability in Bumble dating app reveals any user's exact location
11–20 of 50 posts
Re: Vulnerability in Bumble dating app reveals any user's exact location
#12Earlier quoted context omitted.
Pretty sure tinder just makes the minimum miles away shown to be 2 miles. Simply one if statement.
You need to dither that by a half-mile as well so that the baddies can't use the border between e.g. 2 and 3 miles to do the same test.
This is a trick I use when doing competitive analysis for a certain type of sensor. I need to measure the amount of noise in the system, but a dead-band or quantization is almost always included. So, I insert a signal that bumps up against the boundaries of the dead-band or quantization. Doing this repeatedly gives me a sampling of the noise.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#13At one point I was working on a project with user locations/distance sharing. My solution was just to Math.floor both of their lat/lng to be in increments of .25 miles. You could still use the triangulation trick to find that point, but .25 miles seemed like more than enough to obfuscate things. Had I made the display in increments of miles only, that would have probably been even better.
Pretty sure tinder just makes the minimum miles away shown to be 2 miles. Simply one if statement.
Tinder actually has a fairly interesting solution to this, they divide the world up into mile grids and use those. Funnily enough, a blog post by the same writer as OPs link.
https://robertheaton.com/2018/07/09/how-tinder-keeps-your-lo...
Re: Vulnerability in Bumble dating app reveals any user's exact location
#14I, for one, enjoyed the writing style. It made it enjoyable to read, and it wasn't dry like other security vulnerability posts.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#15I am not very knowledgable about security bounties, but 2k seems laughably small. Every female using the app was gravely in danger because of this bug. There are a lot of creeps on dating apps. That it got awarded just 2k and no resignation of CTO is a joke
Re: Vulnerability in Bumble dating app reveals any user's exact location
#16So the exact same triangulation vulnerability exposed and subsequently fixed in every dating app? How is this not Step #2 after “Build a dating app that Match Group will eventually acquire”
Not just dating apps, but really _any_ app with location based chat. Telegram hit the top page of HN a few months ago with a similar vulnerability[0]. There's other apps that sell this as a feature! Snapchat does this and you can see people down to the exact corner of the street they're standing on. Ads (used to) allow you to do it too[1]
[0] https://www.androidpolice.com/2021/01/05/telegrams-people-ne...
Re: Vulnerability in Bumble dating app reveals any user's exact location
#17This seems like a potential use-case for differential privacy. Normally DP is used for protecting individuals within aggregates, but the careful analysis of how much (and what kind) of noise to add could be brought to bear here.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#18This seems like a potential use-case for differential privacy. Normally DP is used for protecting individuals within aggregates, but the careful analysis of how much (and what kind) of noise to add could be brought to bear here.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#19This seems like a potential use-case for differential privacy. Normally DP is used for protecting individuals within aggregates, but the careful analysis of how much (and what kind) of noise to add could be brought to bear here.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
What about a constant, random, per-match offset? An error applied to a match's position that can't be averaged out, because it is always wrong by the exact same amount. Use a different error in a different direction for each unique match so one can't figure it out once and apply it system wide.
I suppose the downside is that this could put someone else at risk if the tweaked position happens to be on top of their house.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#20I am not very knowledgable about security bounties, but 2k seems laughably small. Every female using the app was gravely in danger because of this bug. There are a lot of creeps on dating apps. That it got awarded just 2k and no resignation of CTO is a joke
> Every female using the app was gravely in danger
You left out a very important key word, "potentially." The article did not say a single person out of millions using Bumble was actually attacked via this method.