Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Grindr Accounts with Copy and Paste

troyhunt.com

Post reply on HN
Print view View original

111–120 of 202 posts

Re: Hacking Grindr Accounts with Copy and Paste

#111

Post by maybeanewone »

My understanding -

Grindr doesn't store your chat history, so logging in on a new device won't show your old chat messages. Phew.

Grindr is particularly bad at security. It was fairly easy to triangulate users locations until fairly recently and some users were being harassed, and grindr ignored their reports for a long time.

It was also fairly easy to use fake locations until fairly recently which was also causing problems for non-users.

Grindr regularly shuts down accounts with no process. It's very easy to lose your contacts.

Grindr lies about what information they retain. They claim to hold very little information, which they provide when your account is shut down. However they must retain a list of your blocks and favorites in order to function. They lie and say they don't retain this info.

Because of the nature of their service, they should be on top of all this stuff, but they are really bad at it.

Re: Hacking Grindr Accounts with Copy and Paste

#112

Post by maybeanewone »

maybeanewone wrote: post #111

My understanding - Grindr doesn't store your chat history, so logging in on a new device won't show your old chat messages. Phew. Grindr is particularly bad at security. It was fairly easy to triangulate users locations until fairly recently and some users were being harassed, and grindr ignored their reports for a long time. It was also fairly easy to use fake locations until fairly recently which was also causing p…

They lie and say they don't* retain this info.

Re: Hacking Grindr Accounts with Copy and Paste

#113

Post by caymanjim »

maybeanewone wrote: post #112
maybeanewone wrote: post #111

My understanding - Grindr doesn't store your chat history, so logging in on a new device won't show your old chat messages. Phew. Grindr is particularly bad at security. It was fairly easy to triangulate users locations until fairly recently and some users were being harassed, and grindr ignored their reports for a long time. It was also fairly easy to use fake locations until fairly recently which was also causing p…

They lie and say they don't* retain this info.

You can edit your own recent post.

Re: Hacking Grindr Accounts with Copy and Paste

#114

Post by anchpop »

thaumasiotes wrote: post #93
on_and_off wrote: post #80

Earlier quoted context omitted.

I wonder why you are getting downvoted so much. I don't know how common bi-men are (probably more than bi erasure makes us believe) but it feels like a least a portion of them are not ready to come out as bi.

> I don't know how common bi-men are (probably more than bi erasure makes us believe) They're not that common. The literature shows a bimodal straight/gay distribution of homosexual tendency in men and a more Gaussian distribution in women.

The "bi erasure" phenomenon is that if a man is bi, many will believe he's just gay but in denial. Because he may prefer to be seen as straight than gay, he may just let everyone think he's straight. This would reduce how many men appear to be bi in surveys.

Re: Hacking Grindr Accounts with Copy and Paste

#115

Post by setr »

ohyeshedid wrote: post #110
np_tedious wrote: post #108

Earlier quoted context omitted.

Are bi guys that much more likely to do this than straight ones? I could believe 2x, but it doesn't seem like an order of magnitude kind of difference

It's more about them keeping it secret; secrets are some of the most valuable currency.

But then it has nothing to do with being bi... unless they're secretely bi, in which case it has nothing to do with cheating...

Re: Hacking Grindr Accounts with Copy and Paste

#116

Post by djaque »

anchpop wrote: post #114
thaumasiotes wrote: post #93

Earlier quoted context omitted.

> I don't know how common bi-men are (probably more than bi erasure makes us believe) They're not that common. The literature shows a bimodal straight/gay distribution of homosexual tendency in men and a more Gaussian distribution in women.

The "bi erasure" phenomenon is that if a man is bi, many will believe he's just gay but in denial. Because he may prefer to be seen as straight than gay, he may just let everyone think he's straight. This would reduce how many men appear to be bi in surveys.

Alternatively, I'm gay and even though I grew up in an area of the US which wasn't that homophoboic. I still hated myself for being gay enough that if I had an even slight attraction to women then I would have just killed off the male attraction side to me. If you're bi and grow up in a world where everything tells you that being gay is wrong, then that part of you that is attracted to guys will probably never get explored.

Re: Hacking Grindr Accounts with Copy and Paste

#117

Post by fpig »

anonymousiam wrote: post #90
sneak wrote: post #73

Earlier quoted context omitted.

Governments. It was likely used by governments. Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

I've never been gay or bi, and I've never used Grindr, but I have held government security clearances for almost 40 years. It's a lot different today than it was back then. Early on, I knew several people who had "experimented" in college, and they were denied clearances. (Actually the government never officially denied them because that would require an explanation of the criteria used for the denial. Instead, it wa…

So were they denying clearances to openly gay people back in the old days? Because there wouldn’t be potential for blackmail in that case. Sorry I can’t tell what you’re saying changed about the policies.

Re: Hacking Grindr Accounts with Copy and Paste

#118

Post by thatguy0900 »

ohyeshedid wrote: post #110
np_tedious wrote: post #108

Earlier quoted context omitted.

Are bi guys that much more likely to do this than straight ones? I could believe 2x, but it doesn't seem like an order of magnitude kind of difference

It's more about them keeping it secret; secrets are some of the most valuable currency.

Doesn't everyone cheat on their wife secretly? Otherwise it's not even cheating.

Re: Hacking Grindr Accounts with Copy and Paste

#119

Post by caperfee »

013a wrote: post #84

This issue is incredibly strange and severe. One thing I did notice, though: The timestamps on the Twitter DMs, which were used as evidence to assert that they're unresponsive in DMs, cover a time period of 90 minutes. The language the twitter client is set to is also not english (maybe French? the original discovery was made by someone who lives in France. I don't know), which introduces the possibility that it wasn…

There is additional information in the post indicating that there was no adequate response to the original report even after 5 days:

The person who forwarded this vulnerability ... provided full details ... on September 24. ... after 5 days of waiting and not receiving a response, contacted me. He also shared a screenshot of his attempt to reach Grindr via Twitter DM

Re: Hacking Grindr Accounts with Copy and Paste

#120

Post by wyattpeak »

chki wrote: post #68
HenryBemis wrote: post #52

Earlier quoted context omitted.

It's not a bug. It is either a backdoor placed there from the design/implementation or super lazy programming. I don't want to think it's done on purpose (Hanlon's razor).

If that's an intentional backdoor it's a very weird backdoor. Wouldn't you at least obfuscate things a little bit? Simply mixing up the characters in that string in some pre-planned order would be enough.

While I doubt it's an intentional backdoor, I wouldn't assume that backdoors would be obfuscated. You can't deny knowledge of an obfuscated backdoor, while an obvious one could plausibly be a simple mistake.
Post reply on HN