Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Grindr Accounts with Copy and Paste

troyhunt.com

Post reply on HN
Print view View original

191–200 of 202 posts

Re: Hacking Grindr Accounts with Copy and Paste

#191

Post by Saint_Genet »

nestorD wrote: post #160
anonymousiam wrote: post #90

Earlier quoted context omitted.

I've never been gay or bi, and I've never used Grindr, but I have held government security clearances for almost 40 years. It's a lot different today than it was back then. Early on, I knew several people who had "experimented" in college, and they were denied clearances. (Actually the government never officially denied them because that would require an explanation of the criteria used for the denial. Instead, it wa…

> gay/bi people can get cleared, as long as they are open about it That's what I have been told is the current policy in France. As long as you cannot be blackmailed with it, it is good.

I have Swedish security clearance, and I was never even asked during the interview but I must assume the know since an even cursory glance at my social media would reveal I’m gay.

Re: Hacking Grindr Accounts with Copy and Paste

#192

Post by learnstats2 »

neltnerb wrote: post #190
learnstats2 wrote: post #180

Earlier quoted context omitted.

I'm not sure why being on Grindr is being seen here as a blackmail risk. If you are visible on Grindr, you have made a kind of public testimony. So, you have reduced your blackmail risk - since you're already at least somewhat prepared for this information to be public.

A lot of the information a user who owns an account can see is not visible to the public. I don't see why being on Grindr in 2020 would be a blackmail risk IN COUNTRIES WHERE BEING GAY IS LEGAL .

OK, but in that case you're at (potentially much) greater risk than blackmail.

Why is blackmail the risk that people on this page are going to, then, is my question. If you're willing to make a public statement then blackmail is lower risk, not higher risk.

Re: Hacking Grindr Accounts with Copy and Paste

#194

Post by lexicality »

foldr wrote: post #176
rini17 wrote: post #175

Earlier quoted context omitted.

I am gay and don't find it offensive or homophobic* at all , just a bit cringey. To non-gay readers: yes actually some gays do pose with grimaces. * I'm even inclined to say you are kind of abusing these Big Words, but not care to start argument.

I did say "mildly" offensive. There's lots of screenshots of the Grindr profile grid posted online. I'd be surprised if you could find one including a profile photo that looks much like this one. But really the point isn't that no gay man has ever posed for a photo like this. (I'm sure some straight men have too.) The point is that the photo is used to make a joke about how ridiculous Scott would look if he was gay.…

> The point is that the photo is used to make a joke about how ridiculous Scott would look if he was gay.

You seem to have decided that Troy is homophobic and therefore this picture is mocking gay people, and not just mocking Scott's attempts at being sexy.

> He couldn't just have a normal dating profile photo.

They both delight in getting unflattering pictures of each other into every security presentation they can. I think you're reading into this too much.

What would be the point of changing the photo if it didn't annoy Scott when he saw it?

Re: Hacking Grindr Accounts with Copy and Paste

#195

Post by foldr »

lexicality wrote: post #194
foldr wrote: post #176

Earlier quoted context omitted.

I did say "mildly" offensive. There's lots of screenshots of the Grindr profile grid posted online. I'd be surprised if you could find one including a profile photo that looks much like this one. But really the point isn't that no gay man has ever posed for a photo like this. (I'm sure some straight men have too.) The point is that the photo is used to make a joke about how ridiculous Scott would look if he was gay.…

> The point is that the photo is used to make a joke about how ridiculous Scott would look if he was gay. You seem to have decided that Troy is homophobic and therefore this picture is mocking gay people, and not just mocking Scott's attempts at being sexy. > He couldn't just have a normal dating profile photo. They both delight in getting unflattering pictures of each other into every security presentation they can.…

There is clearly no technical reason for Scott's involvement in the first place, as Troy could just have created an account himself using any photo whatsoever. The whole post is structured as a joke about the idea of Scott being gay and having a Grindr account.

Do I think Troy is a raging homophobe? No. But his initial response to my comment was to claim that he chose the photo because it looked like a typical Grindr profile photo (!), rather than to just admit that it was a joke. That doesn't increase my confidence that the photo was chosen with good intentions. You apparently think that there is another explanation for the choice of photo relating to some inside baseball between Troy and Scott (which I frankly don't care about, not knowing either of these guys). If that is the real reason then Troy could just have said so himself.

In general, making in-jokes in public blog posts that anyone can read doesn't always go over so well. I'm not saying "Troy is a class A homophobe and must be deleted from the internet". I'm just registering that I'm one gay dude who is bored of this kind of gay joke.

Re: Hacking Grindr Accounts with Copy and Paste

#196

Post by lexicality »

foldr wrote: post #195
lexicality wrote: post #194

Earlier quoted context omitted.

> The point is that the photo is used to make a joke about how ridiculous Scott would look if he was gay. You seem to have decided that Troy is homophobic and therefore this picture is mocking gay people, and not just mocking Scott's attempts at being sexy. > He couldn't just have a normal dating profile photo. They both delight in getting unflattering pictures of each other into every security presentation they can.…

There is clearly no technical reason for Scott's involvement in the first place, as Troy could just have created an account himself using any photo whatsoever. The whole post is structured as a joke about the idea of Scott being gay and having a Grindr account. Do I think Troy is a raging homophobe? No. But his initial response to my comment was to claim that he chose the photo because it looked like a typical Grindr…

> There is clearly no technical reason for Scott's involvement in the first place, as Troy could just have created an account himself using any photo whatsoever.

"I was able to log into my own account after resetting the password" isn't a particularly good attention grabber

> The whole post is structured as a joke about the idea of Scott being gay and having a Grindr account.

Scott is married, I'm pretty sure the joke is about him being on a dating app in the first place.

> [...]

I guess at this point, Troy assumes he's famous enough that everyone who sees his blog will know about him and Scott as well as all the shenanigans they get up to with each other.

Tech and infosec definitely have a lot of problems with inclusivity towards anyone that's not a straight white male, but I really don't think that this blog post was written from the perspective of "ha ha ha ha imagine being gay".

Still, he usually takes criticism, let's see if he does a followup.

Re: Hacking Grindr Accounts with Copy and Paste

#197

Post by foldr »

lexicality wrote: post #196
foldr wrote: post #195

Earlier quoted context omitted.

There is clearly no technical reason for Scott's involvement in the first place, as Troy could just have created an account himself using any photo whatsoever. The whole post is structured as a joke about the idea of Scott being gay and having a Grindr account. Do I think Troy is a raging homophobe? No. But his initial response to my comment was to claim that he chose the photo because it looked like a typical Grindr…

> There is clearly no technical reason for Scott's involvement in the first place, as Troy could just have created an account himself using any photo whatsoever. "I was able to log into my own account after resetting the password" isn't a particularly good attention grabber > The whole post is structured as a joke about the idea of Scott being gay and having a Grindr account. Scott is married, I'm pretty sure the jok…

>"I was able to log into my own account after resetting the password" isn't a particularly good attention grabber

You’d still be resetting the password in a way that doesn’t require access to the associated email account but only knowledge of the email address. It doesn’t make any difference whether you created the account yourself or got a friend to do it for you. You're still showing that anyone who knows my email address can access my Grindr account, which surely ought to grab people's attention.

From my point of view, its a precursor to a sensible discussion about this that we acknowledge that Troy had Scott make the profile purely to add a little humor to the post. There’s of course nothing wrong with adding humor to a blog post. However, subtly mocking people for being gay is a pretty ingrained part of our culture, and it’s easy for straight people to thoughtlessly slip into doing it.

I know that you have given an alternative explanation of the intention behind the photo, but unfortunately it's not the explanation that Troy himself gave in the comments.

Re: Hacking Grindr Accounts with Copy and Paste

#198

Post by JetSpiegel »

DevX101 wrote: post #62
Nextgrid wrote: post #59

Earlier quoted context omitted.

I don't mean to downplay the issue, but why would LGBT-hostile nation-states target Grindr's infrastructure when it's much easier to detect users at the network level based on TLS SNI (since encrypted SNI is still not a thing thanks to corporate influence)?

I'm sure a government could detect that a citizen visited grindr.com, but it'd be harder to guarantee that they actually had intent to commit "crimes" without access to unencrypted internal messages. I'm also concerned about antagonist nation state that gets the personal emails of top officials at Department of Defense. Goes through a targeted list in an attempt to find out who's a member. And if a match found, then…

> I'm sure a government could detect that a citizen visited grindr.com, but it'd be harder to guarantee that they actually had intent to commit "crimes" without access to unencrypted internal messages.

Why would that hypothetical government care about that? Just lock everyone up!

Re: Hacking Grindr Accounts with Copy and Paste

#199

Post by megous »

ativzzz wrote: post #102
megous wrote: post #86

Earlier quoted context omitted.

It makes automated testing of pw reset flow easier. Otherwise you'd need some out of band method to get the token.

You should be able to get the token from your database, unless you're doing black box testing, which I am not a fan of for reasons such as this.

I'm not justifying it.

Just saying that this might have been one reason for such data to be returned.

You may not have access to the database if you're doing frontend testing using headless browser.

Re: Hacking Grindr Accounts with Copy and Paste

#200

Post by neltnerb »

learnstats2 wrote: post #192
neltnerb wrote: post #190

Earlier quoted context omitted.

A lot of the information a user who owns an account can see is not visible to the public. I don't see why being on Grindr in 2020 would be a blackmail risk IN COUNTRIES WHERE BEING GAY IS LEGAL .

OK, but in that case you're at (potentially much) greater risk than blackmail. Why is blackmail the risk that people on this page are going to, then, is my question. If you're willing to make a public statement then blackmail is lower risk, not higher risk.

I'm not sure, sorry. I'm not honestly sure why there's so much discussion about security clearances.

If someone gets your grindr account they can get your (a) address, (b) phone number, and (c) private photos, none of which would otherwise be public. So let's just get that out there. A reasonable user would not expect that any of those three things are readily available to a stranger that they've never talked to who merely has their email address. Especially if they turn off distances specifically to avoid triangulation attacks on their location.

Those pieces of information can be used together to harrass, commit violence, or threaten to leak your photos or personal (albeit sure, not "private") conversations. Those are the obvious ones, but other information in there can also hidden from public view, like HIV status.

With this bug a malicious person could knowingly target you based on email address instead of finding you and even putting the work into catfishing you into sending them embarrassing photos.

I'd say that's a higher blackmail risk but only because of the hack, a little. Catfishes still existed but this makes doing it invisible and massive in scale while associating it with a public ID like your email address.

Post reply on HN