Live data from Hacker News

Vulnerability in Bumble dating app reveals any user's exact location

robertheaton.com

41–50 of 50 posts

Re: Vulnerability in Bumble dating app reveals any user's exact location

#41

Earlier quoted context omitted.

Sure, but you could detect zip codes that are under a certain length and/or area, keep combining them until they are large enough. Zip codes are just a starting point, the concept would still apply. Group people into sufficiently large chunks, only reveal their chunk. It could be a grid instead if that makes more sense, but I imagine zip codes make use of borders along rivers and other forms of convenience.

There's usually always a catch. Your try to make it less easy to find someone also makes it less good for the intended use case. Suddenly the app can only tell you if someone is in the same town or not because we combined the heck out of zips. But the you realize that at the edges of whatever combination you chose you can find if someone is on one side or another of those areas. And these areas have borders on many s…

Yeah it seems that in this case, Bumble obviously went with exact locations and failed to fuzz it.

It's been a long time since I've done online dating, and back then long-form OKCupid profiles were the norm, but instead of a distance radius, I always wished could draw a shape of interest roughly correlated with my local subway map and places that were convenient to walk to.

Re: Vulnerability in Bumble dating app reveals any user's exact location

#42

This seems like a potential use-case for differential privacy. Normally DP is used for protecting individuals within aggregates, but the careful analysis of how much (and what kind) of noise to add could be brought to bear here.

I can't see a problem with adding a random, static offset to users' locations that is rotated daily.

Re: Vulnerability in Bumble dating app reveals any user's exact location

#45

My solution: Group people by zip code, give distance ranges based on the two users' zip codes. Within same zip code or two zip codes that border each other? "0 feet to (farthest distance between any two points within zip code(s))" Zip codes farther apart? "(closest distance between any two points within zip code) to (farthest distance between any two points within zip code)" No need to limit queries, no need to fuzz…

I think we went over this when the telegram version of this hit HN a while back. It just doesn't work. For zip codes for example: There are single street zip codes (aka postal codes) all over Canada. And I'm not talking a large boulevard that goes across town. Literally one street that I can see one end from the other on easily.

> There are single street zip codes (aka postal codes) all over Canada

Screw that, in UK zip codes can be less than single building.

My zip code corresponds to flats 90-180 in my building.

Re: Vulnerability in Bumble dating app reveals any user's exact location

#46
post #22
post #14

I, for one, enjoyed the writing style. It made it enjoyable to read, and it wasn't dry like other security vulnerability posts.

I find Rob's writing highly enjoyable too. It is witty without talking to the reader like he is 10. Not very HN-y, but I recommend his serie on being a parent : https://robertheaton.com/married-with-kids/

That's perfectly HN-y; good read, thank you.

Re: Vulnerability in Bumble dating app reveals any user's exact location

#47
post #30

I don't see why apps like that should give you an exact distance instead of some rough estimate. "X is a few miles away", "X is less than a,mile away", "X is several yards away" (which is, say, within 30-50 yards) — and more precision is not needed. If users want contact, they need to explicitly coordinate. This approach, of course, should not be centered on the exact user location, but use some rough and slightly ir…

It’s easy to measure statistics of a device noising among several grid cells to find with high probability the exact coordinate. Think of a person standing right where grid lines intersect, so with 25% probability each time the position will be reported to be one of four neighboring cells (due to errors in GPS measurement), which gives their exact location right on the intersection. If the probability weights’ distri…

I think the goal is to divide the earth into grids. Then report which grid you're in.

Re: Vulnerability in Bumble dating app reveals any user's exact location

#48
> After some trial and error, Kate realizes that Bumble doesn’t round its distances like most people were taught at school. When most people think of “rounding”, they think of a process where the cutoff is .5. 3.4999 rounds down to 3; 3.5000 rounds up to 4. However, Bumble floors distances, which means that everything is always rounded down. 3.0001, 3.4999, and 3.9999 all round down to 3; 4.0001 rounds down to 4.

How exactly would you figure that out? Of course once you have a full working solution it's easy, but how do you distinguish this when you're just tinkering with it?

Re: Vulnerability in Bumble dating app reveals any user's exact location

#49
Good morning! You know that there are many different situations in life, including difficult ones! I think after reading the article on https://www.cupid.com/dating-blog/why-do-people-lie-about-th... , you will understand why people don't show their feelings. Sometimes these feelings are forbidden by society and people are afraid to show them. That's the whole answer!

Re: Vulnerability in Bumble dating app reveals any user's exact location

#50
This is terrible, although which app is not spying on the user right now? I get too many points for pages or applications such as facebook or tinder, I think that in your case we should look for different options such as the https://coomeet.com/ page where you can connect without internet problems and especially with this page you can do many things like meet girls from different parts of the world.
Post reply on HN