Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

111–120 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#111

Post by mewpmewp2 »

pistoleer wrote: post #97
strken wrote: post #36

Earlier quoted context omitted.

It's pretty easy. Treat each resolver that retrieves data like it's a REST endpoint and secure it, and add a query allowlist that you append items to during your CI builds. You don't need to touch the AST or understand the context of the rest of the query. Just answer the question "can user ABC see the photos of user XYZ?" in the resolver that fetches the photos. If this is inefficient then prefetch some data or use…

How do you guys bridge the abstraction gap/wall between resolvers to prevent N+1 queries? I have the suspicion that GraphQL is great for exposing a really generic API, useful when you have no idea what shape the front end will take (how often is that?). But it comes at a heavy price; genericity is always the opposite of specialization. And optimization can only occur during specialization. Having worked with it for a…

Also if it's really the problem with HTTP Requests, you could still technically abstract multiple REST API/RPC calls into a single HTTP Request.

Re: Vulnerabilities in the Feeld dating app

#112

Post by sureglymop »

advael wrote: post #45
intothemild wrote: post #35

They were in the press a lot this week, but for earning money. https://www.theguardian.com/technology/article/2024/sep/08/t...

It's been observed by many that making bad things seems to be a lot more profitable these days than making good things

Its been a long running joke between me and some friends that if you want to get rich, you should make a dating app.

1. Desperate men come in hordes. 2. You will probably get bought out by match group for millions.

Of course there are moral qualms and also it may not be actually just as easy as that.

Re: Vulnerabilities in the Feeld dating app

#113

Post by strken »

mewpmewp2 wrote: post #110
strken wrote: post #90

Earlier quoted context omitted.

The permissions checking is one-by-one checks. It's exactly as hard a mistake to make in GraphQL as it is in REST unless you've got more resolvers than an equivalent REST app would have, which is unlikely and would mean GraphQL wasn't a good choice. I do think that you've got a good point about how the knowledge isn't widespread yet, that it's easier for frontend engineers to write awful expensive queries, and that G…

Wouldn't it seem contra to the principles of GraphQL if you treat resolvers like rest endpoints? At this point, it's just RPC, no? It's not really a graph. Why didn't I just use RPC/Rest the whole time?

You don't treat resolvers like RESTful endpoints. You check that the user has permission to access the object (edit: or other value) which the resolver returns. This has nothing to do with RPC and does not stop you using the "graph" part of GraphQL.

For the purposes of comparing a REST API, where permissions checking is done for every endpoint, to a GraphQL API, where permissions checking is done for any resolver which loads data, it is necessary to compare the number of permissions checks you would need across the two services. This does not mean resolvers are in any way equivalent to RESTful endpoints except for comparing how many times you'd need to write `ctx.can('read', photo);` across the two, and even then the numbers will almost certainly be different because the APIs will be different.

Re: Vulnerabilities in the Feeld dating app

#115

Post by stef25 »

throwaway2037 wrote: post #102
rollcat wrote: post #79

Earlier quoted context omitted.

Applies to all dating apps, really: just treat any info you put in your profile as 100% public, for anyone, worldwide. Location is easily faked, other filtering options are about as effective as a lone "do not enter" sign with no fence - I can put any info I like into my profile to fit your criteria and have you show up in my feed. Chats? The only IM apps with functional E2EE are: Signal, iMessage, WhatsApp; and even…

Lots of great points in your post. Real question: Has WhatsApp ever had a security leak that we know about? Example: Someone can break into accounts, or chats were leaked?

Those types of bugs can be sold for millions so you probably won't hear about them

Re: Vulnerabilities in the Feeld dating app

#116

Post by ChiperSoft »

elric wrote: post #99

The online dating space (I use the term liberally) is a huge fucking mess. There's only 2 or 3 companies with an offering that is anywhere near useful, and they're either evil, incompetent, or both. Maybe it's time for an open source federated dating service or something. Or at least something that doesn't sell your data, doesn't leak your nudes, or doesn't get you beaten up/raped/murdered. Probably easier said than…

I’ve been conceptualizing one for a few years, but just don’t have the free dopamine to build it alongside my day job.

ActivityPub even has the mechanics to facilitate it through publishing Person records. There is MASSIVE space for innovation, especially if you prioritize on non-monogamy, non-heterosexual, non-gender-conforming needs.

Dating apps are a REALLY hard space to get into, however. You need a cumulative mass of users in a given area before they’re useful, and monetizing it inevitably means making the app less useful. There’s a reason okcupid went to shit after it stopped being a non-profit.

And then there’s the moderation problem…

Re: Vulnerabilities in the Feeld dating app

#117

Post by nailer »

xenospn wrote: post #25
1_1xdev1 wrote: post #12

Earlier quoted context omitted.

I used the app briefly a few months prior to their discovery. The app was riddled with bugs. Things like chats not loading (received the push notification, but in the app not visible until force quit/reload). I’m not surprised it took them so long to remediate. I would guess a shoestring contractor dev team.

This is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.

The founder used attend node.js events in London. Not sure why you think he’s non technical.

Re: Vulnerabilities in the Feeld dating app

#118

Post by pistoleer »

robertlagrant wrote: post #108
pistoleer wrote: post #95

Earlier quoted context omitted.

A software penetration tester has the same techniques and suite of tools for pwning as "the internet".

I don't see how that statement follows mine. Can you connect them at all?

I thought you were making the comparison that a pentester is like a missile shot at a bridge whereas the internet is the army walking over the bridge.

Re: Vulnerabilities in the Feeld dating app

#119

Post by NoGravitas »

Coolbeanstoo wrote: post #59

I'm not terribly surprised. I use it but would describe it as incompetently put together as my bank app? maybe worse, it barley functions at all. I dont know how they managed it.

When I used it, I enjoyed the community, but the app was never competently written. Then a while back they had a flag day where they rolled out a new app and a new server to everyone all at once, and most people were not able to log in; those that were lost their premium perks if they were paying customers, likes and chats got lost, etc. I was never actually able to log in, and just dropped the app at that point.

Re: Vulnerabilities in the Feeld dating app

#120

Post by diggan »

throwaway2037 wrote: post #102
rollcat wrote: post #79

Earlier quoted context omitted.

Applies to all dating apps, really: just treat any info you put in your profile as 100% public, for anyone, worldwide. Location is easily faked, other filtering options are about as effective as a lone "do not enter" sign with no fence - I can put any info I like into my profile to fit your criteria and have you show up in my feed. Chats? The only IM apps with functional E2EE are: Signal, iMessage, WhatsApp; and even…

Lots of great points in your post. Real question: Has WhatsApp ever had a security leak that we know about? Example: Someone can break into accounts, or chats were leaked?

> Real question: Has WhatsApp ever had a security leak that we know about? Example: Someone can break into accounts, or chats were leaked?

Yes, a bunch of them. I don't remember any of the years, but from the top of my head:

- Pegasus was installable via Whatsapp calls that didn't need to be installed, probably the most famous vulnerability with the largest impact

- Bunch of multimedia vulnerabilities that allowed attackers remote execution

- At least one huge database dump was released at some point

Post reply on HN