Live data from Hacker News

Tinder's lack of encryption allows spying

nakedsecurity.sophos.com

31–35 of 35 posts

Re: Tinder's lack of encryption allows spying

#31
post #3

I remember this issue with S3 files and being unable to configure certificate correctly. What's the correct steps to get that to work? Also, clever find that there's a side channel on left vs right swipe. What caused these payload differences?

Left = 4 characters, Right = 5?

Re: Tinder's lack of encryption allows spying

#32
post #13

Earlier quoted context omitted.

> Firesheep was a 2010 invention. Once that happened, anyone could chill in a coffeeshop and watch the http traffic whizz by. That's incorrect. Firesheep performed session hijacking using unencrypted session cookies.

Which part of the comment is incorrect?

> Which part of the comment is incorrect?

I quoted the incorrect part of the comment. Then, I posted a correction to the comment that is incorrect. Firesheep doesn't display the HTTP traffic whizzing by but steals cookies for a session - allowing the malicious party to view information from the server, not the information between the sever and client.

Re: Tinder's lack of encryption allows spying

#33

Earlier quoted context omitted.

CloudFront is cheaper than S3. S3 is for storage, CloudFront is for distribution.

Right, I think you would need to put cloudfront in front of s3 in this case, which is what makes it more expensive.

I’m sorry, I don’t understand. S3 storage is cheap, bandwidth is expensive. CF is free storage for in-cache items, refreshed from the S3 backend when expired, serving that bandwidth. You can’t lose money as compared to a pure S3 setup.

Re: Tinder's lack of encryption allows spying

#34

The next thing you should look at is who they send your personal data to and what data they send. There was rumors a year ago that they sent personal data to known advertiser IPs.

Does tinder have ads? How do they monetize their service?

You link it with your facebook id, anything you share in addition about your personal preferences is always of great interest.

Re: Tinder's lack of encryption allows spying

#35

Earlier quoted context omitted.

Right, I think you would need to put cloudfront in front of s3 in this case, which is what makes it more expensive.

I’m sorry, I don’t understand. S3 storage is cheap, bandwidth is expensive. CF is free storage for in-cache items, refreshed from the S3 backend when expired, serving that bandwidth. You can’t lose money as compared to a pure S3 setup.

Hmm, well it seems S3 to CF bandwidth is free (didn't realize this), and bandwidth from CF to internet vs S3 to internet is approximately the same (also surprising to me). So it costs approximately the same.
Post reply on HN