Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in the Feeld dating app

fortbridge.co.uk

Post reply on HN
Print view View original

121–130 of 150 posts

Re: Vulnerabilities in the Feeld dating app

#121

Post by diggan »

ChiperSoft wrote: post #116
elric wrote: post #99

The online dating space (I use the term liberally) is a huge fucking mess. There's only 2 or 3 companies with an offering that is anywhere near useful, and they're either evil, incompetent, or both. Maybe it's time for an open source federated dating service or something. Or at least something that doesn't sell your data, doesn't leak your nudes, or doesn't get you beaten up/raped/murdered. Probably easier said than…

I’ve been conceptualizing one for a few years, but just don’t have the free dopamine to build it alongside my day job. ActivityPub even has the mechanics to facilitate it through publishing Person records. There is MASSIVE space for innovation, especially if you prioritize on non-monogamy, non-heterosexual, non-gender-conforming needs. Dating apps are a REALLY hard space to get into, however. You need a cumulative ma…

Now you've piqued my interest, especially if it could be done in a safe but distributed way, without a focus on profits.

How you'd envision it to work, considering the open nature of ActivityPub but the need/want from the users to remain private when using dating applications/protocols?

Re: Vulnerabilities in the Feeld dating app

#122

Post by consteval »

valenterry wrote: post #40
Cu3PO42 wrote: post #17

Earlier quoted context omitted.

Ultimately, I don't disagree. However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.

Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.

They shouldn't have to - the architecture should be made in such a way that permission checks are done without you specifically having to call them every time. This is the entire reason middleware exists!

Re: Vulnerabilities in the Feeld dating app

#123

Post by valenterry »

consteval wrote: post #122
valenterry wrote: post #40

Earlier quoted context omitted.

Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.

They shouldn't have to - the architecture should be made in such a way that permission checks are done without you specifically having to call them every time. This is the entire reason middleware exists!

Well, but apparently they let people create the architecture who just shouldn't have touched the backend code. That's the whole point. Since it was not just a single endpoint or so - it was everywhere!

Re: Vulnerabilities in the Feeld dating app

#124

Post by consteval »

strken wrote: post #90
mewpmewp2 wrote: post #57

Earlier quoted context omitted.

Still I think this type of thing is much more likely to happen with GraphQL including various N + 1 and even worse performance issues. Like if you imagine having junior engs they will be much more likely to make the mistake with GraphQL than otherwise and it is harder to review as well. The permissions checking becomes a real spaghetti and difficult to understand in practice compared to just one by one checks.

The permissions checking is one-by-one checks. It's exactly as hard a mistake to make in GraphQL as it is in REST unless you've got more resolvers than an equivalent REST app would have, which is unlikely and would mean GraphQL wasn't a good choice. I do think that you've got a good point about how the knowledge isn't widespread yet, that it's easier for frontend engineers to write awful expensive queries, and that G…

> The permissions checking is one-by-one checks

Not true, authorization can be done in middleware. You can deny requests automatically, even scenarios you never considered.

Re: Vulnerabilities in the Feeld dating app

#125

Post by jrm4 »

greybox wrote: post #109
fire_lake wrote: post #18

God damn it. People deserve better than this. Almost inclined to take a pay cut to go and fix this mess.

They don't need your charity, they need to be fined

And the fact that this, the literal only solution that has any chance of succeeding, is this far buried down in the comments, says so much about this industry.

Re: Vulnerabilities in the Feeld dating app

#126

Post by dfedbeef »

Cu3PO42 wrote: post #17
dfedbeef wrote: post #15

Earlier quoted context omitted.

You shouldn't be touching the server-side code if you find this hard to keep straight.

Ultimately, I don't disagree. However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.

u are wise and right

Re: Vulnerabilities in the Feeld dating app

#127

Post by dfedbeef »

dfedbeef wrote: post #15
Cu3PO42 wrote: post #7

It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community…

You shouldn't be touching the server-side code if you find this hard to keep straight.

I feel bad now I'm sorry to the person I replied to lol. I didn't mean 'you' I meant a generalized third party person.

Re: Vulnerabilities in the Feeld dating app

#128

Post by dfedbeef »

blitzar wrote: post #101
XenophileJKO wrote: post #92

Earlier quoted context omitted.

This is so true. I've seen this so many times. The darling of product, who can deliver so fast. They leave a trail of smoking rubble and half working features behind them.

Why can't you be more like darling of product over there. What do you even do around here; all you seem to ever do is take darling of products code and make a few changes (which I don't understand) and committing it as your own work. It appears you are either trying to take credit for darling of product or are sabotaging their amazing 10x work.

Are you my manager

Re: Vulnerabilities in the Feeld dating app

#129

Post by throwaway-xdfef »

(This is a throwaway account but I've been on HN for a decade)

I just read this and attempted to delete mine and my partners profile data. The process is currently totally broken in-app. There is no way to proceed past a certain point. There's nothing self-identifying about us in the app but still.... I'm furious.

Re: Vulnerabilities in the Feeld dating app

#130

Post by throwaway-xdfef »

mikkelam wrote: post #71

This is pretty funny. I've been abusing this shitty API for a while to see who likes me in this dating app. I didn't realise the problems were this bad. They've had massive issues with their tech stack from a user POV. I've multiple times had my phone running incredibly hot while using it.

It gets worse. As of this moment it's impossible to delete your account data due to errors.

(Ask me how I know)

Post reply on HN