Tinder dating app was sharing more of users' location data than they realised

http://www.theguardian.com/technology/2014/feb/20/tinder-app-dating-data-location-sharing

Version 0 of 1.

Mobile dating app Tinder has millions of users swiping on one another’s profiles to find matches, but it seems that for part of last year, they were sharing more information than they realised.

Part of the app’s appeal is that it shows people other users nearby, providing a rough distance indication, but doesn’t share their actual location for safety purposes.

White-hat hacking firm Include Security has revealed that it identified a flaw in Tinder last year that enabled hackers to identify the location of individual Tinder users to within 100 feet. It notified Tinder about the security hole in October, but claims it was not fixed until some time in December.

It was related to a fix for a previous privacy issue in Tinder, when the app was found to be transmitting latitude and longitude coordinates of matched profiles, meaning developers could access this data by querying Tinder’s API.

“We have not done research to find out how long this flaw has existed, we believe it is possible this flaw has existed since the fix was made for the previous privacy flaw in July 2013,” wrote Include Security’s Max Veytsman in a blog post which suggests Tinder is far from the only location-based app to include such a loophole.

“Flaws in location information handling have been common place in the mobile app space and continue to remain common if developers don’t handle location information more sensitively,” he wrote, while also publishing a YouTube video showing how the flaw could have been exploited:

By definition, white-hat hackers identify these kinds of security flaws not to harm people, but to ensure they are patched up. In his blog post, Veytsman lays out a timeline of his firm’s interactions with Tinder, suggesting that the company – a subsidiary of media giant IAC – was less than forthcoming in its responses.

Its chief executive, Sean Rad, has provided a comment to Businessweek. “Shortly after being contacted, Tinder implemented specific measures to enhance location security and further obscure location data,” he said.

“We did not respond to further inquiries about the specific security remedies and enhancements taken as we typically do not share the specifics of Tinder’s security measures. We are not aware of anyone else attempting to use this technique. Our users’ privacy and security continue to be our highest priority.”

• Would you really trust a ‘secret’ app to protect your secrecy?