Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

101–110 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#101

Post by blitzar »

XenophileJKO wrote: post #92
intelVISA wrote: post #73

Earlier quoted context omitted.

9 out of 10 PMs love this one hack to boost velocity they were probably thinking what a 10x engineer they'd found to be so rapid at delivery...

This is so true. I've seen this so many times. The darling of product, who can deliver so fast. They leave a trail of smoking rubble and half working features behind them.

Why can't you be more like darling of product over there.

What do you even do around here; all you seem to ever do is take darling of products code and make a few changes (which I don't understand) and committing it as your own work. It appears you are either trying to take credit for darling of product or are sabotaging their amazing 10x work.

Re: Vulnerabilities in the Feeld dating app

#102

Post by throwaway2037 »

rollcat wrote: post #79
wasma wrote: post #68

Who do you trust? Would tinder and bumble have the same mindset?

Applies to all dating apps, really: just treat any info you put in your profile as 100% public, for anyone, worldwide. Location is easily faked, other filtering options are about as effective as a lone "do not enter" sign with no fence - I can put any info I like into my profile to fit your criteria and have you show up in my feed. Chats? The only IM apps with functional E2EE are: Signal, iMessage, WhatsApp; and even…

Lots of great points in your post.

Real question: Has WhatsApp ever had a security leak that we know about? Example: Someone can break into accounts, or chats were leaked?

Re: Vulnerabilities in the Feeld dating app

#103

Post by greybox »

This is utterly horrifying, clearly absolutely zero thought was put into security at all.

I'm a game developer and we put more effort into keeping our game fair than this company does in keeping it's users safe. They should be sued into oblivion.

Re: Vulnerabilities in the Feeld dating app

#104

Post by rollcat »

throwaway2037 wrote: post #102
rollcat wrote: post #79

Earlier quoted context omitted.

Applies to all dating apps, really: just treat any info you put in your profile as 100% public, for anyone, worldwide. Location is easily faked, other filtering options are about as effective as a lone "do not enter" sign with no fence - I can put any info I like into my profile to fit your criteria and have you show up in my feed. Chats? The only IM apps with functional E2EE are: Signal, iMessage, WhatsApp; and even…

Lots of great points in your post. Real question: Has WhatsApp ever had a security leak that we know about? Example: Someone can break into accounts, or chats were leaked?

> Has WhatsApp ever had a security leak that we know about?

I don't know of any, but I distrust anything Meta/FB/MZ does, out of principle.

I have more trust in iMessage, but it's incredibly tightly tied to Apple's devices (as far as I can tell, part of its security architecture relies on the hardware/SEP).

Signal (as a non-profit org) could have been a neutral third party everyone could feel safe to trust, but they've lost my confidence when they introduced support for cryptocurrencies - I can no longer trust their motives. It also does not offer any choice over some security/usability trade-offs (like syncing your chat history to a new device); I understand this is critical for e.g. whistleblowers, but a deal-breaker for many of the rest of us.

Re: Vulnerabilities in the Feeld dating app

#105

Post by forgotacc240419 »

greybox wrote: post #103

This is utterly horrifying, clearly absolutely zero thought was put into security at all. I'm a game developer and we put more effort into keeping our game fair than this company does in keeping it's users safe. They should be sued into oblivion.

Zero thought was put into anything.

Before I realised the app was a buggy mess I was very surprised to see it had an interests section that provided no context for the interests. For example: virtually everyone had Domination or Submission as one of their interests but no context whatsoever of which role they wanted. To not realise how fundamentally wrong this is for that scene implies they're clueless across the board.

Re: Vulnerabilities in the Feeld dating app

#107

Post by [deleted] »

forgotacc240419 wrote: post #87
fire_lake wrote: post #82

Earlier quoted context omitted.

Given the overlap between those communities and OSS people I’m amazed no one has created a B Corp that does this stuff right.

No one migrates from the first big thing so it's a waste of time. Feeld should be killed by this and it'll barely make a dint

[deleted]

Re: Vulnerabilities in the Feeld dating app

#108

Post by robertlagrant »

pistoleer wrote: post #95
robertlagrant wrote: post #86

Earlier quoted context omitted.

No one hires someone to test what happens when a bridge is shot with a missile from 6000 miles away. The bridge "works" in the same way that the software "works".

A software penetration tester has the same techniques and suite of tools for pwning as "the internet".

I don't see how that statement follows mine. Can you connect them at all?

Re: Vulnerabilities in the Feeld dating app

#110

Post by mewpmewp2 »

strken wrote: post #90
mewpmewp2 wrote: post #57

Earlier quoted context omitted.

Still I think this type of thing is much more likely to happen with GraphQL including various N + 1 and even worse performance issues. Like if you imagine having junior engs they will be much more likely to make the mistake with GraphQL than otherwise and it is harder to review as well. The permissions checking becomes a real spaghetti and difficult to understand in practice compared to just one by one checks.

The permissions checking is one-by-one checks. It's exactly as hard a mistake to make in GraphQL as it is in REST unless you've got more resolvers than an equivalent REST app would have, which is unlikely and would mean GraphQL wasn't a good choice. I do think that you've got a good point about how the knowledge isn't widespread yet, that it's easier for frontend engineers to write awful expensive queries, and that G…

Wouldn't it seem contra to the principles of GraphQL if you treat resolvers like rest endpoints?

At this point, it's just RPC, no? It's not really a graph. Why didn't I just use RPC/Rest the whole time?

Post reply on HN