Hacking Grindr Accounts with Copy and Paste • Hacker News Board

Re: Hacking Grindr Accounts with Copy and Paste

#181

Post by swilliamsio » Sat, Oct 03, 2020, 12:28 PM UTC

GarrisonPrime wrote: post #131

DevX101 wrote: post #53

If your company is being actively targeted by nation states (and rest assured, Grindr is), you should have a serious security team where this sort of stuff shouldn't have seen the light of day. I'm not exaggerating when I say this bug may have gotten people locked up, or been the lever for corporate/government espionage.

Honestly, I wouldn't be surprised if this was an intentional back door (...) that Grindr was required to create and let foreign authorities know about in exchange for being allowed to market the app in their country.

"Never attribute to malice that which is adequately explained by stupidity."

Re: Hacking Grindr Accounts with Copy and Paste

#182

Post by goguy » Sat, Oct 03, 2020, 12:29 PM UTC

developer2 wrote: post #106

sebmellen wrote: post #4

Wow, password reset tokens returned directly in-browser; that's hard to believe. I wonder how long this had been going on?

This is frighteningly standard across most companies with no serious planning phase for new features, and no code review process. Fact is, some developer was told to create a REST API for password resets, and to return the secret token so that the (internal to the company!) client can send the email containing that token. This developer did their job correctly. At some point, a different developer was told to consume…

I'd expect even a junior to at a minimum test and view the response payload, see the token and think "bad idea".

Re: Hacking Grindr Accounts with Copy and Paste

#183

Post by woutr_be » Sat, Oct 03, 2020, 12:33 PM UTC

tiku wrote: post #139

Must be some framework that has this behaviour as default. Else it would be really really bad.

This seems to be fairly deliberate, the QR code might probably give you some clues. They needed to generate a QR code so the user could just scan it and reset their password.

Re: Hacking Grindr Accounts with Copy and Paste

#184

Post by davewritescode » Sat, Oct 03, 2020, 12:44 PM UTC

I’ve worked on these types of features and this is egregiously bad. Where I work, we won’t even tell you the full email address that we’re sending the password reset to.

Re: Hacking Grindr Accounts with Copy and Paste

#185

Post by lol768 » Sat, Oct 03, 2020, 12:51 PM UTC

goguy wrote: post #182

developer2 wrote: post #106

Earlier quoted context omitted.

This is frighteningly standard across most companies with no serious planning phase for new features, and no code review process. Fact is, some developer was told to create a REST API for password resets, and to return the secret token so that the (internal to the company!) client can send the email containing that token. This developer did their job correctly. At some point, a different developer was told to consume…

I'd expect even a junior to at a minimum test and view the response payload, see the token and think "bad idea".

Agreed, this is far too basic for the "oh yeah, a junior developer might not have noticed it" excuse.

Hacker News seems to assume juniors are useless, from the comments I've seen to date - but they should be able to _think_ and solve problems, even if they're less experienced at interacting with stakeholders, designing system architecture etc.

Re: Hacking Grindr Accounts with Copy and Paste

#186

Post by _tk_ » Sat, Oct 03, 2020, 12:58 PM UTC

foldr wrote: post #164

ojosilva wrote: post #38

> Hey, do you have a Grindr account? > Lol I can understand this is most probably a private lol by a surprised. But how about we at least stop making these are you gay? Lol! a public moment worth screenshooting? An Ashley Madison data leak is a national embarrassment whereas a Grindr one, a "national security threat" [1]. Being on AM is just a vaudevillian indiscretion, being on Grindr is bro lol that feeds hate and…

The photo used for the account is also kind of mildly offensive in the same vein. (To non-gay readers: this is not actually how gay men pose for their grindr pics.) Update: I decided to make the same point in the comments on his post and he responded in about the douchiest low-key homophobic way imaginable: http://disq.us/p/2c9pnno Tech has a long way to go on homophobia :(

I feel the same way about this issue (the chat and the photo) and the response by Troy just feels... abysmal.

He starts out by saying:

"The photo, however, is the one most consistent with others I saw on Grindr during this exercise." and then continues to agree with the following statement: "... you didn't choose this pose by looking at typical Grindr profile photos."

Re: Hacking Grindr Accounts with Copy and Paste

#187

Post by isbvhodnvemrwvn » Sat, Oct 03, 2020, 1:46 PM UTC

Nextgrid wrote: post #60

8bitsrule wrote: post #37

That 'bug' is so stupid and elementary that I'm disinclined to think it's a bug. If they had any security people, it'd never have existed. So ... they just don't give a shit . Surprise?

"Security people" spend most of their time dealing with dubious compliance requirements that rarely improve security (in most cases they annoy users and force them to use even less secure workarounds) than actual security like reviewing code to catch things like this and implement policies to make sure unreviewed code doesn't make it to production.

And the standards for getting into security vary, a lot. I've worked with extremely knowledgeable security researchers, and people who were promoted from helpdesk (typically in areas like compliance), with very little knowledge outside of some certificates. With the latter I often had to explain pretty basic stuff, like how digital signatures work and why the client needs to know the public key.

Re: Hacking Grindr Accounts with Copy and Paste

#188

Post by nefitty » Sat, Oct 03, 2020, 1:56 PM UTC

beaker52 wrote: post #163

I've fixed this exact vulnerability (sans QR code) for a client of mine in the last 2 years. I place the cause for these kinds of issues on the split between "frontend" and "backend" developers, with many frontend developers coming out of code camps able to build client-side rendered single page applications and being very proficient in JavaScript but not having experience with aspects of security-related software de…

Any recommended resources to improve on this specific gap? Ie backend security for frontend devs

Re: Hacking Grindr Accounts with Copy and Paste

#189

Post by bufferoverflow » Sat, Oct 03, 2020, 6:08 PM UTC

offtop5 wrote: post #32

Considering Egypt is using apps like this to persecute LGBT people, this is absolutely horrifying. I'm so glad I've gone social media free, all the big players in this space have shown repeatedly they don't care about the safety of their users. Grindr was already caught sharing HIV status information with 3rd parties. Eventually these horrible companies will be regulated, but tons of people are going to be harmed bef…

Well, it's not like this vulnerability would stop Egyptian theocrats from figuring out who uses the app. All it takes is creating an account and arranging dozens (or hundreds) of dates.

Re: Hacking Grindr Accounts with Copy and Paste

#190

Post by neltnerb » Sat, Oct 03, 2020, 6:36 PM UTC

learnstats2 wrote: post #180

sneak wrote: post #73

Earlier quoted context omitted.

Governments. It was likely used by governments. Bi men who live straight lives with a wife and family are ridiculously common. The ability to blackmail those people is extremely valuable to certain state organizations.

I'm not sure why being on Grindr is being seen here as a blackmail risk. If you are visible on Grindr, you have made a kind of public testimony. So, you have reduced your blackmail risk - since you're already at least somewhat prepared for this information to be public.

A lot of the information a user who owns an account can see is not visible to the public. I don't see why being on Grindr in 2020 would be a blackmail risk IN COUNTRIES WHERE BEING GAY IS LEGAL.