I’m not an engineer, but I can say that for a very long time Grindr felt like it was basic, poorly built, and generally unreliable. A couple of years ago it felt like there was a serious wave of investment in the app - the UI got better, it stopped dropping messages and having random outages - but clearly the DNA of the company hasn’t really changed.
Hacking Grindr Accounts with Copy and Paste
101–110 of 202 posts
Re: Hacking Grindr Accounts with Copy and Paste
#102Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?
It makes automated testing of pw reset flow easier. Otherwise you'd need some out of band method to get the token.
You should be able to get the token from your database, unless you're doing black box testing, which I am not a fan of for reasons such as this.
Re: Hacking Grindr Accounts with Copy and Paste
#103A startup I worked for had this exact same security issue. I brought it up to the tech lead/CEO but they were in denial about it. Handrolled password reset by dummies basically
Couldn't you just demonstrate the exploit by resetting any password? (by a willing participant, so as not to be considered as doing something illegal). I wonder how your tech lead could deny that.
Re: Hacking Grindr Accounts with Copy and Paste
#104Grinder was owned by a Chinese video game company from 2016 to 2020. Under pressure from from the US government it was sold to a southern california company.
Re: Hacking Grindr Accounts with Copy and Paste
#105If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day. I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.
lol you don't need a serious security team to prevent stupid bugs like this. you just need a competent person.
Re: Hacking Grindr Accounts with Copy and Paste
#106Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?
This is frighteningly standard across most companies with no serious planning phase for new features, and no code review process. Fact is, some developer was told to create a REST API for password resets, and to return the secret token so that the (internal to the company!) client can send the email containing that token. This developer did their job correctly.
At some point, a different developer was told to consume this endpoint, send the related email, and tell the end user (browser client) that the email was sent. This second developer is not part of the "senior services team" who designed the above API, which is perfectly valid. Instead, this is a junior developer taking on their first task at the company. "Take this password reset API endpoint, and integrate it". In addition to queuing the password reset email with the token embedded within it, they also accidentally proxy the password reset service's payload to the browser. No intermediate or senior develop reviewed this new employee's PR; if they did bother to look at it, they only checked for coding standard violations (eg. indentation), without taking the effort to understand the logic of the code.
This is actually extremely common, unfortunately. The server-side layer that directly interacts with clients (ie. browsers) is generally delegated to the most junior developers, because it's menial and uninteresting work to connect the backend services to the browser. The current senior developers spent years working on that kind of garbage already, and they'd rather work on the "more interesting/advanced" backend work. Thus, the junior developers whose skills aren't yet honed are stuck–typically unsupervised–working on the front-facing components.
Also, this routinely happens at companies which rush every feature out the door with modern "agile" practices. The sprint is almost over! Quick, deliver all features by tomorrow to keep up our velocity and avoid a sprint review with negative feedback! Just merge it and push to prod without QA on a Friday at 4pm!
If only the above was a comedy routine, rather than what it truly is: the genuine reality at a large number of companies.
Re: Hacking Grindr Accounts with Copy and Paste
#107A startup I worked for had this exact same security issue. I brought it up to the tech lead/CEO but they were in denial about it. Handrolled password reset by dummies basically
Why people are still hand rolling common stuff like this is baffling to me. I'm treading on offensive waters here, but I'd guess this is from a nodejs backend, for some reason it seems to be more common to hand roll stuff like this in node than pretty much any other web language/framework I've worked with.
> Why people are still hand rolling common stuff like this is baffling to me
Don't most systems hand roll their own password reset? Using any backend tech, I mean. This isn't crypto, where hand rolling your own solution is almost always a mistake.
Re: Hacking Grindr Accounts with Copy and Paste
#108Earlier quoted context omitted.
I've never been gay or bi, and I've never used Grindr, but I have held government security clearances for almost 40 years. It's a lot different today than it was back then. Early on, I knew several people who had "experimented" in college, and they were denied clearances. (Actually the government never officially denied them because that would require an explanation of the criteria used for the denial. Instead, it wa…
It’s not really being bi that’s the problem here so much as cheating on a wife secretly
Are bi guys that much more likely to do this than straight ones? I could believe 2x, but it doesn't seem like an order of magnitude kind of difference
Re: Hacking Grindr Accounts with Copy and Paste
#109Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?
I wonder how many bootcamps that promise to make you a "fullstack developer" in X weeks even cover the basics of security.
Re: Hacking Grindr Accounts with Copy and Paste
#110Earlier quoted context omitted.
It’s not really being bi that’s the problem here so much as cheating on a wife secretly
Are bi guys that much more likely to do this than straight ones? I could believe 2x, but it doesn't seem like an order of magnitude kind of difference
It's more about them keeping it secret; secrets are some of the most valuable currency.