Sophos Cloud Optix
On this Valentine’s Day, we find that it is increasingly difficult to be both lovelorn and discreet.
Case in point: As Naked Security’s Graham Cluley reported a few weeks ago, the gay dating site Grindr was hacked in late January, potentially resulting in the exposure of hundreds of thousands of users’ intimate personal chats, explicit photos and private information.
Grindr is a smartphone app that supplements one’s innate gaydar by pinging users when there’s a hot boy in proximate meatspace.
No, I didn’t make up that word: credit goes to Queerty and its enviably titled article on the gay dating app, “Grindr’s Big Plans to Get Into Everyone’s Pockets.”
(By the way, Grindr’s brother-in-gay-apps-arms for the hirsute, Scruff, was also rumored to have been hacked recently. In reality, it appears that the actual hacking victim was Tuff Scruff, a Tumblr site run by “girls who have a healthy appreciation/love/obsession with facial hair.” The Tuff Scruff girls were mortified to find that hackers had swapped pictures of nude women for their standard fare of visualized stubble lust.)
On Friday, Grindr came out with a mandatory upgrade with “crucial security enhancements” for all its supported platforms: iOS, Android, and BlackBerry.
Well, maybe that’s all well and good. Then again, maybe it’s not – who can tell? Grindr’s pretty tight with details on the security snafu.
In its report on the initial exposure of some 100,000 Grindr-ers, The Sydney Morning Herald noted that the Grindr hacker exploited the application’s use of a personalized string of numbers – i.e., a hash – instead of a user name and password to log in.
According to the report, the hacker apparently found it was a piece of cake to replace a user’s hash and then:
- Log in as them
- See their favorites
- Change their profile information and profile picture
- Talk to others as the user
- Access pictures sent to them
- Impersonate their “favorite” and talk to them as a friend
The Sydney Morning Herald quoted an anonymous security expert who said that both Grindr and Blendr (the company’s app for breeders – excuse me, I meant to type “heterosexuals”) “had no real security”. His estimation of the apps’ basic system security, from his quotes in the Herald:
[Both apps are] very poorly designed ... [with] poor session security and authentication. It wouldn't be too hard to secure this.
Grindr’s mandatory security update gives no details about what one would hope was the gutting of its hash authentication.
If e-dating users are worried about the security of their pictures, drunken sexting exchanges or salient profile details, they might want to wipe their profiles.
Grindr and Blendr both have instructions on the steps to take: Here’s Grindr’s, and here’s Blendr’s.
Of course, one mustn’t put much hope in companies actually deleting that information once they’ve got their sweaty little paws on it.
Like I wrote about last week, Facebook, for one, is retaining deleted photos two and a half years after Ars Technica first brought the issue up, admitting that it’s still figuring out how to remove photos from legacy servers in a timely manner.
Rainey Reitman of the Electronic Frontier Foundation recently told Help Net Security it’s in dating sites’ best interest to keep your information active even if you choose to delete it. As Mr. Reitman put it, the dating sites’ thinking runs along the lines of, “Well, what if things don’t work out? What if you want to reactivate your profile?”
What with dating sites’ data-separation anxiety, as Mr. Reitman points out, there’s a danger of your information being glued to the dating company’s servers indefinitely, and thereby being subject to future legal requests.
After all, the courts have no problem separating individuals from their supposed privacy and confidentiality, regardless of what Twitter, Facebook et al. might state in their terms of service.
That was evident when a divorcing couple was court-ordered to swap Facebook and dating site passwords in September 2011.
Beyond that, Mr. Reitman notes that your photos are highly likely to be permanently hosted on an outside company’s servers, such as those of Content Delivery Networks, often used by many big sites.
Privacy policies won’t protect you. They change like a lover’s face developing wrinkles, except faster.
Mr. Reitman’s advice for making it harder for the sites to figure out who you are:
* Get a throw-away email address
* Don't use your real name
* Avoid paid sites that want your credit card number and billing information
* Consider obfuscating your IP address, such as by using a VPN
Help Net Security had more good tips on keeping safe in the world of online dating. Excerpts from their article:
* Check carefully the privacy settings of your dating profile and set them so that your profile is not made searchable by search engines - as, for example, an OkCupid profile is by default.
* Every photo you post online can be easily linked to you if it's accompanied by correct information, so consider using a pseudonym and filling out some inaccurate information on your dating profile.
* A photo posted on a dating site can easily be associated with your real identity if you've used it on other online accounts, such as Facebook or LinkedIn. Try searching for the image using TinEye and Google Image Search before uploading it.
Help Net Security also notes that many popular dating sites have trouble with implementing HTTPS, so your login information – and consequently your profile information – can be exposed to attackers.
This is true especially since the development of Firesheep, an extension for Firefox that uses a packet sniffer to intercept unencrypted cookies from certain sites (such as Facebook) as the cookies are transmitted over networks, exploiting session hijacking vulnerabilities.
In that case, use HTTPS Everywhere, a Firefox extension created by the EFF and the Tor Project that forces HTTPS on any URL.
Isn’t love grand? And amazingly public? And subject to hacking and court order?
It’s love, internet style. Happy Valentine’s Day!
Keyboard and broken heart images, courtesy of Shutterstock
"Don't use your real name"
Which will get you kicked off most sites for violating their terms of use.
It'll also make for an interesting conversation on your first date!
Way before such thing as phone apps, and such, I did an online dating thing and the best money I spent was having a PI do a background check on Mr. Perfect. OMG!!!! What a terrifying thing THAT was. What I learned about him was mind boggling.
“meatspace” was used (and possibly coined) in response to “cyberspace” which was coined by William Gibson in the early 80s.
he said, pedantically.
how cyberpunkish of you! 🙂
This is one more case that highlights the potential problems with any kind of social media platform. Imagine if something similar ever happened to Facebook? Granted it would be harder for someone to do this with their platform, but there is no such thing as an absolutely secure website.
What it all comes down to in the end is that you should never put anything online unless you realize that there is always some risk that the data could be stolen.