10 ms·
Stalking your Facebook friends on Tinder
- spdustin 10y agoAmusing HN shout-out in the code [0] > """Yeah it's really important to write extremely enterprise well-documented hacky API code. Hacker News will love it I swear.""" [0]: https://github.com/defaultnamehere/tinder-detective/blob/13bf88d88c0b0f8ba5a28c11fc53a9feb5f641ec/api.py#L10 https://github.com/defaultnamehere/tinder-detective/blob/13b...
- trombone 10y agoWouldn't this require you to have specifically opted-in to "Tinder Social"?
- defaultnamehere 10y agoNope, you have to opt-out of Tinder Social to make it NOT happen to you.
- trombone 10y agoLooks opt-in to me.
- defaultnamehere 10y agoAh, I was talking about in Australia. Turns out Tinder Social launched in the US today. What a coincidence!
- defaultnamehere 10y ago'gender’: 1, // 1 is female, 0 is male. C’mon Tinder that’s not how gender works C'mon Tinder.
- trombone 10y agoIt's a float value.
- Asparagirl 10y agoNah, it's a string.
- taneq 10y agoOnly one axis? How discriminatory. :P
- striking 10y agoThe funny part is that you're getting downvoted when it's actually defined as a float. Like, you weren't kidding. They honestly made it a float. What.
- deleted 10y ago[deleted]
- sp527 10y ago"Gender fluid"
- 10y ago
- minimaxir 10y agoCan confirm the new Tinder Social feature is opt in, with reasonable warning: https://imgur.com/ie8IgSZ https://imgur.com/ie8IgSZ Feature can be disabled at any time.
- defaultnamehere 10y agoI hope so, that would be a step in the right direction! Has anyone in America tried out https://github.com/defaultnamehere/tinder-detective https://github.com/defaultnamehere/tinder-detective to see if the API still works in the US without having to opt in?
- vetrom 10y agoThe feature will also opt-in (on android at least) via a notification, with no confirmation upon opening the notification. Thanks, anti-privacy patterns!
- k-mcgrady 10y agoOn iOS I opened via the push notification and got taken to the opt-in screen so possibly a bug with their Android app rather than something malicious.
- Joof 10y agoBut not opt-in for the friends of those who have already opted in.
- PudgePacket 10y agoOpt-in in America, Opt-out in Australia.
- dingledog 10y agoReading this gave me cancer.
- mdadm 10y agoThat's kind of scary that you can get that information just by (if I read this right) having the user ID of someone you "matched" with. This feels like it could lead to all sorts of weird stalking or something if a first-date went badly. On an unrelated note, I liked the way that the post was written. It made reading the details more interesting (but then again, I'm one of those young whippersnappers, so maybe I'm just more prone to liking that sort of thing).
- jocro 10y ago> having the user ID of someone you "matched" with Most of the information was already available to someone you matched with (that's the whole point of matching), barring the 'last logged in' value. The real concern is that you can get the user id of any of your facebook friends, exposing information that was previously hidden unless you did match. Matching relies on two-party consent, this violates that for a subset of users.
- deleted 10y ago[deleted]
- rhubarbquid 10y ago> That's kind of scary that you can get that information just by (if I read this right) having the user ID of someone you "matched" with. Not quite... the API returns the Tinder user ID of all your Facebook friends that use Tinder. You can see who uses it, when they last used it, what picture they use there, etc. You can also "swipe right" or "swipe left" using the API on anyone you have the Tinder user ID of, even if Tinder never matched them with you. So it's scary in a "creep on your friends" way not in a "creep on strangers" way.
- derefr 10y ago> You can also "swipe right" or "swipe left" using the API on anyone you have the Tinder user ID of, even if Tinder never matched them with you. So you're saying I can brute-force iterate through the entire Tinder userbase and swipe right on everyone automatically? Finally! The feature we've all been waiting for! (More than a little sarcasm here.)
- haack 10y agoFor some reason I read through the commits in the Github repo. Wasn't disappointed.
- markwaldron 10y agoWhat format do the id and keys in secrets.json need to be in?
- cfreeman 10y agoSee here: https://gist.github.com/rtt/10403467#authenticating https://gist.github.com/rtt/10403467#authenticating
- Smerity 10y agoIt's a surprise that Tinder launched Tinder Social just now in the US given that's the main source of the leaked data. Tinder Social was (and remains) opt-out in Australia while he was writing the article. Even if Tinder Social is now opt-in in the US, the fact they were dismissive of the vulnerability disclosure is concerning. Any social network with deteriorating privacy is bad. One where the content can potentially be sensitive is even worse. If you started on a service and it kept becoming more private by default, that's fine - potentially annoying, but fine. If you start on a service and it kept becoming more public by default, then we have a problem. The fact that Tinder don't realize Tinder profiles may contain sensitive information for a significant portion of their user base is hugely disturbing. As stated in the article, there are so many circumstances beyond cheating that this is still an issue. Assume for a fictional argument that I was born into a religious family, "no sex before marriage" type of thing, but enjoyed one night stands. One might use Tinder to do so quietly. Tinder didn't allow your friends to see that information before - I assumed I was safe from judgement by my family and their friends. Then Tinder rips that privacy you thought you had away! Saying that users should have known better is not an excuse. As developers we must operate under the assumption that best practices are likely going to be missed or misunderstood. Tinder violated that in an extreme way in an attempted land grab for a large social market beyond hook-ups and dating. Disclosure: I'm friends with the author and commented on drafts.
- Crito 10y ago> If you start on a service and it kept becoming more public by default, then we have a problem. If this isn't criminal, it should be. People belong in jail for this sort of thing.
- Smerity 10y agoHave you seen the (now quite ancient) animated evolution of default Facebook privacy settings[1]? It's insane. It's for this reason that, by default, I assume essentially everything I do online is public. My username is my name, almost everything on Facebook is defaulted to public, etc. If you live under the assumption that you're never private, you'll never make the mistake of thinking you are. [1]: http://mattmckeon.com/facebook-privacy/ http://mattmckeon.com/facebook-privacy/
- colecut 10y agoConnection count is just how many friends they have, not how many swipes. There's nothing new to discover with this 'hack', seeing your friends' tinder profiles is what tinder social does.
- redwood 10y agoHow can I tell if I've even been opted in? Bastards. I'm a paying customer and they pull this crap.
- deleted 10y ago[deleted]
- k-mcgrady 10y ago>> "How can I tell if I've even been opted in?" It's OPT-IN - you can tell because you would have said 'opt me in to Tinder Social'. Also, if you can remember, swipe to your profile screen. If you have opted in it has it in huge writing.
- redwood 10y agoHow can I tell if I've even been opted in? Bastards. I'm a paying customer and they pull this crap.
- cloudjacker 10y agohow do you build this in OSX? Apple's python situation is out of control
- spiznnx 10y agovirtualenv venv --python=python3.5 source venv/bin/activate pip install -r requirements.txt
- deleted 10y ago[deleted]
- cloudjacker 10y agofirst line isn't working for me virtualenv venv --python=python3.5 Running virtualenv with interpreter /usr/local/bin/python3.5 Using base prefix '/Library/Frameworks/Python.framework/Versions/3.5' New python executable in venv/bin/python3.5 Also creating executable in venv/bin/python Failed to import the site module Traceback (most recent call last): File "/Users/ericlw/Development/tinder-detective/venv/bin/../lib/python3.5/site.py", line 67, in <module> import os File "/Users/ericlw/Development/tinder-detective/venv/bin/../lib/python3.5/os.py", line 708, in <module> from _collections_abc import MutableMapping ImportError: No module named '_collections_abc' ERROR: The executable venv/bin/python3.5 is not functioning ERROR: It thinks sys.prefix is '/Users/ericlw/Development/tinder-detective' (should be '/Users/ericlw/Development/tinder-detective/venv') ERROR: virtualenv is not compatible with this system or executable ugh none of this python 3 stuff works right
- marodox 10y agobrew install python3.5
- agravier 10y agoUse pyenv (https://github.com/yyuu/pyenv https://github.com/yyuu/pyenv). If you want it easier, there is an installer at https://github.com/yyuu/pyenv-installer https://github.com/yyuu/pyenv-installer.
- 10y ago
- SwellJoe 10y agoI love security posts like this. His previous one about facebook messenger status was also really nicely done. He doesn't succumb to the temptation to be abusive (to either the people who made the thing he's testing, the people reading, or anyone who might be impacted by it), which is something a lot of security researchers seem to find impossible to avoid; there's a lot of calling people various forms of stupid in many incident reports. Even when given ample opportunity by the Tinder folks to call them names, he didn't do so (and, didn't blow it out of proportion, either...it's problematic, but if you're using Facebook and Tinder, you probably are already aware you're giving up a lot of privacy; this is a big deal, but not vastly bigger than using facebook all by itself). He explains clearly what he did, and what tools he used to do it, which is another thing that often gets left out. Many security folks follow the magician's code ("never show'em how it's done"), and are dismissive that mere mortals could ever understand what they do. And, he tells a good story in the process. All around, top notch technical writing about a usually boring subject.
- Freak_NL 10y agoThe overall technical outline of the issue and what he did to figure it out are clear — and certainly interesting — but I am having a hard time reading the blog post. This writing style is exhausting to me. Instead of reading normally I find myself skipping more and more text to get to the bits that aren't silly jokes and internet slang. A shame, because it hides the technical insights he has. At least he's not inserting meme-pictures every other paragraph, which seems to be thing now even in otherwise well-written material.
- SwellJoe 10y agoI guess it could be more concise, but I rather enjoyed the humor. It's not an area I'm passionate about, even though it is important, so having it interlaced with jokes (silly though they may be) was a net win for me.
- wingerlang 10y agoAgreed, I find the actual content interesting but I probably skipped 90% of the written text.
- Xeronate 10y agoAnyone getting unicode errors even after removing all of the emojis from the source?
- markwaldron 10y agoI spent about 30-45 minutes trying to get this to work out of the box. Not sure if It's because my Python is rusty or maybe my installs are screwy. Either way, In order to get this to work, I ended up curling the tinder API to get my token. curl -v -X POST 'https://api.gotinder.com/auth' -H 'Content-Type: application/json' --data '{"facebook_token": "facebook_token_string", "facebook_id": "facebook_id_string"}' With that I modified the python code to no longer POST to get the X-Auth-Token and just pasted it in there: self.headers["X-Auth-Token"] = 'auth_token_string' print("Authenticated to Tinder ") self.authed = True print self.authed After that, everything worked fine!
- robin_hood_jr 10y agoWhat is the format for the SECRETS.json file since it needs to include both the auth token and the facebook id? f = open(SECRETS.json) self.fb_auth = json.load(f) So does it matter what I name the auth parameters or just that I set the values correctly? i.e: { "auth_token" : "TOKENVAL", "fb_id" : "IDVAL" }
- ersii 10y agoAs cfreeman commented to markwaldron in another comment - See here: https://gist.github.com/rtt/10403467#authenticating https://gist.github.com/rtt/10403467#authenticating
- foota 10y agoHoly direct object reference vulnerability batman!
- wodenokoto 10y agoIn you tinder profile you can see which friends tinder will show as common friends. This is a subset of your Facebook friends and I've always assumed these you Facebook friends who are on tinder.
- blubb-fish 10y agoCan't get it to work ... where do I get my facebook user id and token from? Do I have to create an App featuring access to my friend list for that?
- pc86 10y agoAs stated in both the repository and the blog post (a couple times, actually), you need to intercept the Tinder traffic after you've created a profile.
- squeaky-clean 10y agoYou can also check the Issues section, where other users have posted instructions on how to easily find the id and key with just your web browser.
- wiradikusuma 10y agoJust FYI, doesn't work in Asia, maybe because there's no Tinder Social yet.
- 0xADEADBEE 10y agoIn Philippines currently. Can confirm Tinder Social prompt has appeared for me.
- youngDogChick 10y agoI'm getting a 401 error when I do curl https://api.gotinder.com/user/52b....000f9b https://api.gotinder.com/user/52b....000f9b And I grabbed the user_id from the groups json "user_id" var I also made the request from the browser on my phone.. same thing. Do I need to add some tinder oauth credential to the curl request?
- seanopedia 10y agoever figure it out?
- gnahckire 10y agoThis blogpost is so hilariously written. Props to the author.