An absolute slog to read, but interesting vulnerability nonetheless.
Vulnerability in Bumble dating app reveals any user's exact location
21–30 of 50 posts
Re: Vulnerability in Bumble dating app reveals any user's exact location
#22I, for one, enjoyed the writing style. It made it enjoyable to read, and it wasn't dry like other security vulnerability posts.
I find Rob's writing highly enjoyable too. It is witty without talking to the reader like he is 10.
Not very HN-y, but I recommend his serie on being a parent : https://robertheaton.com/married-with-kids/
Re: Vulnerability in Bumble dating app reveals any user's exact location
#23Earlier quoted context omitted.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
What about a constant, random, per-match offset? An error applied to a match's position that can't be averaged out, because it is always wrong by the exact same amount. Use a different error in a different direction for each unique match so one can't figure it out once and apply it system wide. I suppose the downside is that this could put someone else at risk if the tweaked position happens to be on top of their hou…
It’s the same thing but more time consuming.
If you knew this was happening, you’d create N accounts, match with the same person, and average queries over account pairs.
Also, if the error is constrained to be the same, then the attack is reduced to estimating the radius of a circle where you are given points on the perimeter, which you should be able to do in very few queries (3?). I haven’t worked out the triangulation math but you’d basically solve for x^2+y^2=r^2.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#24Earlier quoted context omitted.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
What about a constant, random, per-match offset? An error applied to a match's position that can't be averaged out, because it is always wrong by the exact same amount. Use a different error in a different direction for each unique match so one can't figure it out once and apply it system wide. I suppose the downside is that this could put someone else at risk if the tweaked position happens to be on top of their hou…
1. The attacker can use multiple accounts to collect data, so an offset specific to the viewer wouldn't work
2. If you can collect the offset location over a longer time, you can correlate it with likely travel paths (e.g. along major roads) to figure out what the offset is.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#25This seems like a potential use-case for differential privacy. Normally DP is used for protecting individuals within aggregates, but the careful analysis of how much (and what kind) of noise to add could be brought to bear here.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
Yeah, its an overcomplicated, breakable solution. Just decide the minimum safe uncertainty, assign grid cells that provide it, and only report distance quantized to grid cells.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#26This seems like a potential use-case for differential privacy. Normally DP is used for protecting individuals within aggregates, but the careful analysis of how much (and what kind) of noise to add could be brought to bear here.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
Apple’s coarse location, iirc, chooses your location in such a manner that it can’t be averaged out.
Maybe by limiting updates as well?
Re: Vulnerability in Bumble dating app reveals any user's exact location
#27I am not very knowledgable about security bounties, but 2k seems laughably small. Every female using the app was gravely in danger because of this bug. There are a lot of creeps on dating apps. That it got awarded just 2k and no resignation of CTO is a joke
Gravely in danger, for all 18+ (within the US at least) is a bit of a stretch.
You can find the current/last known address of nearly any registered voter with a simple Google search. I'm not exactly sure why or how, but you can.
There are also services, that aren't exactly expensive, in which you can buy the phone number or address of nearly everybody in the U.S.
If you think being able to triangulate and pinpoint the location of somebody via a dating app constitutes grave danger... Well, there are much graver dangers that can't be fixed by any $ bounty all around us.
I'm not trying to say that what happened with Bumble isn't bad, and it makes the company look somewhat foolish, but in 2021, finding the location of somebody in most developed countries, aside from your ultra secure OPSEC average HN user, is quite a simple task.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#28Earlier quoted context omitted.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
Apple’s coarse location, iirc, chooses your location in such a manner that it can’t be averaged out. Maybe by limiting updates as well?
One way is to hash the user_ID to generate the “noise” that is consistent for that user. Then repeated queries are the same, so the average is identical to all samples. Averages only work if your samples aren’t correlated.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#29Earlier quoted context omitted.
It’s only a partial solution; you still need to limit the queries. Otherwise, just sample a large number of coordinates and average out the noise.
Yeah, its an overcomplicated, breakable solution. Just decide the minimum safe uncertainty, assign grid cells that provide it, and only report distance quantized to grid cells.
Agreed, but you still have some trouble if the grid cell is aligned next to a body of water or some other obstruction, since you can deduce a higher certainty then.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#30I don't see why apps like that should give you an exact distance instead of some rough estimate.
"X is a few miles away", "X is less than a,mile away", "X is several yards away" (which is, say, within 30-50 yards) — and more precision is not needed. If users want contact, they need to explicitly coordinate.
This approach, of course, should not be centered on the exact user location, but use some rough and slightly irregular grid, so that the best one could do is to determine the cell of that grid (again, like 50 yards wide), without any idea where in that cell the target user is.
This, and query throttling so that scanning more often than once in 5 minutes isn't possible.