Vulnerability in Bumble dating app reveals any user's exact location
1–10 of 50 posts
Re: Vulnerability in Bumble dating app reveals any user's exact location
#2An interesting attack, but the narrative style made it hard to follow the post. Too much fiction intertwined with the details of the exploit.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#3That was very hard to read, but cool attack nonetheless. Very trivial bug (user id one).
Re: Vulnerability in Bumble dating app reveals any user's exact location
#4tldr spoof nearby location 3 times and use distance to triangulate the location
Re: Vulnerability in Bumble dating app reveals any user's exact location
#5At one point I was working on a project with user locations/distance sharing.
My solution was just to Math.floor both of their lat/lng to be in increments of .25 miles. You could still use the triangulation trick to find that point, but .25 miles seemed like more than enough to obfuscate things.
Had I made the display in increments of miles only, that would have probably been even better.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#6So the exact same triangulation vulnerability exposed and subsequently fixed in every dating app? How is this not Step #2 after “Build a dating app that Match Group will eventually acquire”
Re: Vulnerability in Bumble dating app reveals any user's exact location
#7At one point I was working on a project with user locations/distance sharing. My solution was just to Math.floor both of their lat/lng to be in increments of .25 miles. You could still use the triangulation trick to find that point, but .25 miles seemed like more than enough to obfuscate things. Had I made the display in increments of miles only, that would have probably been even better.
Pretty sure tinder just makes the minimum miles away shown to be 2 miles. Simply one if statement.
Re: Vulnerability in Bumble dating app reveals any user's exact location
#8So the exact same triangulation vulnerability exposed and subsequently fixed in every dating app? How is this not Step #2 after “Build a dating app that Match Group will eventually acquire”
Interestingly, another researcher reported this exact same issue (being able to triangulate a user's location) last year: https://blog.securityevaluators.com/reverse-engineering-bumb...
Re: Vulnerability in Bumble dating app reveals any user's exact location
#9[deleted]
Re: Vulnerability in Bumble dating app reveals any user's exact location
#10At one point I was working on a project with user locations/distance sharing. My solution was just to Math.floor both of their lat/lng to be in increments of .25 miles. You could still use the triangulation trick to find that point, but .25 miles seemed like more than enough to obfuscate things. Had I made the display in increments of miles only, that would have probably been even better.
Pretty sure tinder just makes the minimum miles away shown to be 2 miles. Simply one if statement.
You need to dither that by a half-mile as well so that the baddies can't use the border between e.g. 2 and 3 miles to do the same test.