27 ms·

Grindr Shares Personal Information With Third-Parties

840 points by tjwds 9y ago

billmalarky 9y ago
It's become clear over the last year there is a strong need for a data privacy regulatory agency in US government. I understand that regulation hampers growth, but the tech industry is mature and developed to the point that it's time to reel in "moving fast and breaking things" a bit.
- DoofusOfDeath 9y ago
  > It's become clear over the last year there is a strong need for a data privacy regulatory agency in US government. I wouldn't trust a governmental regulatory agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians. I suspect a more effective strategy is to enact legislation that makes companies liable under civil law, with private citizens empowered to sue.
  - JumpCrisscross 9y ago
    > a more effective strategy is to enact legislation that makes companies liable under civil law Agree. But there is still a role for a public prosecutor to (a) collect complaints and (b) launching suits on behalf of the public, for when violations occur and no private action ensues.
  - jumelles 9y ago
    > I wouldn't trust a governmental agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians. I think this sort of attitude is a big problem - instead of throwing our hands up and deciding that regulatory agencies have always been and thus will always be toothless, we need to give said agencies more power to enable them to actually enforce the rules. Right now, companies regularly weigh the costs of compliance against the costs of non-compliance because to a multinational corporation, the usual fines and punishments just don't hurt that much. Companies that break the law should regularly never, ever recover financially.
    - news_to_me 9y ago
      > Companies that break the law should regularly never, ever recover financially. Personally I would have this reworded to "Companies that regularly break the law should never, ever recover financially." As much as I believe things are tilted too far in favor of companies these days, it is true that over-harsh regulation on business can be very bad — particularly when it becomes harder to start new businesses. But I agree with your sentiment. To a large degree the government is as good as we make it.
      - Silhouette 9y ago
        This is an important point, I think. If our ultimate goal is to incentivise good practice, we have to deal with a range of problems from simple ignorance of good practice or what the law requires through to gross negligence or "wilful ignorance" situations. If you have a business that is acting in good faith but makes an error in judgement or isn't aware of some specific regulation, there is no sense taking a punitive stance. Obviously if their actions have caused damage to another party then compensation may be appropriate, but otherwise constructive engagement is likely to work best. On the other hand, if you have a business that is knowingly and deliberately acting in bad faith, there may be little point in being constructive, and the penalties need to be significant enough to force them to change (or their business to fail).
  - anigbrowl 9y ago
    You're screwed either way. If a government agency enforces it, opposition politicians attack it. If courts enforce it, courts are attacked instead and opposition politicians push for changes int eh law. the regulated industry will cheerfully spend shareholder money to drive public sentiment in a favorable direction. In US politics, money dominates everything else.
  - astrobe_ 9y ago
    I'm not knowledgeable about how the US administration works, but I think it's a universal principle that when you write laws and regulations, it generally has to come with means to inspect and check that the rules are not violated. It's especially difficult with anything digital. Do you really want to rely just on whistleblowers?
  - ISL 9y ago
    > I wouldn't trust a governmental agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians. It is good when a governmental agency is at the mercy of politicians. As the electorate, we are responsible for the politicians we elect.
  - wang_li 9y ago
    >I suspect a more effective strategy is to enact legislation that makes companies liable under civil law, with private citizens empowered to sue. There's no chance that will happen. It should, but it won't. By taking away the ability of individual citizens to sue, and vesting that power in a government agency, it protects the companies while empowering the regulators. The end result is fair toothless regulation and more donations/lobbying dollars flowing from the private sector to the public sector/politicians. A number of anti-spam laws ended up this way.
- pavlov 9y ago
  > regulation hampers growth Is there proof of this? Some countries like Germany and Sweden are both highly regulated and have fastest economic growth in the West.
  - deltron3030 9y ago
    Who's growing is the more important question. Regulation benefits the already big.
    - fnord123 9y ago
      Some regulation is bad, but there are plenty of good examples. Regulation on the standards like GSM and use of SIM cards helped new entrants into the European markets. Net Neutrality, standardized electrical systems, etc have benefited everyone large and small. And of course, anti-trust regulations in the EU has not benefited Microsoft or Google.
      - davidw 9y ago
        > standardized electrical systems Except for the damn plugs!
    - anigbrowl 9y ago
      That's truism that I don't think is accurate. You're assuming all regulation is complex and that this can directly drive administrative costs in linear fashion.
    - smt88 9y ago
      > Regulation benefits the already big "Regulation" isn't guaranteed to do anything. Some regulations benefit already-big, some harm them. Some have no effect at all. Lack of regulation is guaranteed to benefit already-big, though. Unchecked corporations become oligopolies or monopolies. Free markets (meaning free movement, not free of regulation) and consumer protection are impossible without regulations, though.
      - 9y ago
- bowlofpetunias 9y ago
  This shouldn't be in the hands of a regulatory agency. Serious privacy violations should be legislated and treated as outright crimes, not just regulation infringements. Violating basic civil rights should not just result in the off chance of having to pay a fine. People like Zuckerberg belong in jail way more than the average drug dealer.
  - dragonwriter 9y ago
    > This shouldn't be in the hands of a regulatory agency. Serious privacy violations should be legislated and treated as outright crimes, not just regulation infringements. IHIPAA is largely in the hands of HHS as a regulatory body, and yet violation of its privacy mandates (including those HHS is empowered to detail by regulation) are “outright crimes” as well as also potential civil offenses, not some distinct and lesser category of “regulatory violations”. Your argument seems deeply grounded in an incorrect assumption about what it means to involve a regulatory agency.
- agumonkey 9y ago
  I wonder how these things were before. Maybe there was a bit of data sharing but at such small scale and speed that it didn't really matter.
werber 9y ago
Does anyone have any information on how Scruff handles that information? Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status?
- dragonwriter 9y ago
  > Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status? No, HIPAA binds only covered entities, which are (basically) care providers, insurers, and certain other parties in certain business relationships with care providers and insurers. If you give out your health information to a dating service, it's not protected by HIPAA.
  - reureu 9y ago
    That's not to say there may not be other laws that govern how you protect a user's data though.
    - rhizome 9y ago
      Such as? I'm not under the impression that there are any legal prohibitions on this kind of thing in the US.
      - zoe1337 9y ago
        That's the problem.
        DataWorker 9y ago
        For now at least...
      - reureu 9y ago
        The first that comes to mind is the Federal Trade Commission Act, which allows the FTC to charge companies which fail to protect consumer personal data.
ordinaryradical 9y ago
We need a new business model for social media, one which actually serves the customer instead of trying to lure them into productizing themselves.
- thomasjudge 9y ago
  The problem obviously is competing with free...although, maybe we are beginning to realize that there are hidden costs to "free"...
- overcast 9y ago
  So you're going to pay to use it right? If this imaginary product managed to get 1% of Facebook to hand over their credit card. That would be the most wildly successful pay to use application in existence. Will never happen. Social Media sites rely on mass adoption, among those who refuse to pay for just about anything.
  - johnchristopher 9y ago
    Just as some people pay for fastmail I am pretty sure there'd be some people paying an entrance fee to a social network. Wasn't the social network of last week, vero, supposed to be like that ?
    - overcast 9y ago
      Email is a poor comparison, because you're connecting to millions of other people using gmail/yahoo/whatever, for free. The correct comparison would be if eMail was a universally paid for service. It would NOT be what it is today.
      - johnchristopher 9y ago
        I am not comparing the aims or the essence of the service. I am expression the opinion that social networks can be a paid-for service just like email, music or video can.
morley 9y ago
For what it's worth, the most private data here is shared to analytics companies for Grindr's only analytical use. My guess is that Grindr's agreement with Apptimize and Localytics asks for the strictest possible protection of that data. If anyone at Apptimize or Localytics has access to that data, I'd be incredibly surprised. This sort of deal isn't the same as sharing the HIV status to Google or Facebook so that advertisers can target or exclude that user information for the purposes of advertising. For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance? The open source, self-hosted pickings are slim. (I can only think of Piwik, which in my experience has a dated feature set and severe performance issues.) Not everyone can afford to perform their own product analysis. Using a third-party analytics saas is kind of the only way to go and seems like a reasonable tradeoff of security for product visibility.
- lawnchair_larry 9y ago
  As someone who has been working in security for a long time, and has seen how the sausage is made at even the biggest, most reputable companies who “take security very seriously”, the “strictest possible protection of that data” means approximately nothing. The only serious way to protect sensitive data is not to take it in the first place. Hell, not even the NSA can keep a lid on their sensitive data. ”For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance?” Remember, customers first, your “needs” come second. That goes double when they are placing their trust in you by allowing you to be a custodian of their data. Not long ago, desktop software phoning home would have been a scandal. Not long before that, it was offline and couldn’t phone home. Yet, we still had software. Unfortunately, developers have taken the slipperly slope all the way to outright abuse of their privileges in order to collect information that customers don’t know about or understand. This has led us to things like GDPR. It doesn’t matter if your intentions are good or your usage is benign. It isn’t yours to begin with, those aren’t your decisions to make, and developers need to learn to seriously respect that.
- hackcasual 9y ago
  They have the option of not sending HIV status to any third party.
frgtpsswrdlame 9y ago
So there's lots of talk about how we're going to regulate/manage data protection going forward but what are we going to do about the stuff that is already out there? I mean HIV status is a pretty toxic thing to just be floating around. It doesn't seem that we can even be sure who has this data and who doesn't.
jonbarker 9y ago
Also, many mobile users name their device their whole name, effectively deanonymizing all their app usage for the massive ecosystem of marketing companies out there. Having worked in the mobile marketing industry I was shocked at how many people were doing this and probably had no idea this was the case.
- Jonnax 9y ago
  Is that an iPhone thing? I know it's not possible to set the hostname of your phone on most android phones but it's unique. Of course with Android making build versions and etc. Available to devs and in the case of chrome to your user agent. You're pretty much identifible.
  - jschwartzi 9y ago
    Oh, but it is possible. It's buried in the networking settings but there's a phone name option which is used for just about everything. Although on my LG devices it defaults to the series name, for example G3 for an LG G3.
arcaster 9y ago
This is deeply troubling. Anyone who uses Tinder or any other dating site should try requesting their data and realize that these services could likely label you a sexual deviant, racist or otherwise based on your swipes alone.
- mtgx 9y ago
  I guess we'll soon find out: https://www.wired.com/story/tinder-lack-of-encryption-lets-strangers-spy-on-swipes/ https://www.wired.com/story/tinder-lack-of-encryption-lets-s... https://www.theguardian.com/technology/2017/sep/26/tinder-personal-data-dating-app-messages-hacked-sold https://www.theguardian.com/technology/2017/sep/26/tinder-pe...
- zoe1337 9y ago
  They probably don't even know. The AI which learned on the data doesn't necessarily has labels, it just connects the dots.
- odiroot 9y ago
  OkCupid may be even more dangerous in that regard. As far as I know they allow you to set ethnicity preferences.
  - CamperBob2 9y ago
    Most dating services do. Why shouldn't they?
    - rurounijones 9y ago
      I think the reasoning is innocent, the problem is that if it gets leaked you have people (probably incorrectly) interpreting things using the data which is half the problem. "Your ethnicity preference is white? You goddamn racist". This gets worse when those interpreters are in a position of power.
JumpCrisscross 9y ago
Even within its confines, Grindr's data are rich for blackmail. (Consider: images and messages sent and received within 100 feet of Capitol Hill.) It was recently acquired by an offshore billionaire [1]. [1] https://www.bloomberg.com/news/articles/2016-01-12/china-tech-billionaire-buys-control-of-us-gay-dating-app-grindr https://www.bloomberg.com/news/articles/2016-01-12/china-tec...
- loceng 9y ago
  Makes me think that data should be treated differently in the case of a potential new owner, allowing users to opt-out from their data from being transferred; you may trust the leadership and governance, and may not trust whomever takes over or who will newly has access to the data.
  - kayfox 9y ago
    You can delete the data from your profile.
    - jacquesm 9y ago
      Correction: you can mark it as deleted.
    - bognition 9y ago
      lol, that means nothing. It most likely means that data is marked as deleted but the original values are retained.
      - kayfox 9y ago
        Well, you could also just not fill it out in the first place. To be clear, this is public profile information displayed to any user of the Grindr app.
        hluska 9y ago
        Except that if a user fills in a Grindr profile, they believe they are only sharing information with Grindr/its users. The truth is that they share all of the information (in less than secure ways) with a variety of third parties and fail to disclose that fact. That's illegal in many countries (including mine) and it demonstrates an unbelievable lack of regard for user privacy or safety.
amq 9y ago
A bit unrelated, but imagine how much data has Tinder collected, if Cambridge Analytica could do that much with just a comparatively unpopular quiz app.
- arrythur 9y ago
  Correct me if I'm wrong, but wasn't the quiz app just a way to gain access to a user's data? So it wasn't so much the content of the quiz that was revealing, just the access to data it provided.
  - makomk 9y ago
    I'm pretty sure their "psychometrics" play required the data users gave them as part of the quiz. The whole point of the exercise was to supposedly figure out people's personality traits from their social media profiles and let marketers target them based on that, and I think the personality quiz was probably the only way they could get ground truth information to train their model on.
- cavanasm 9y ago
  The quiz app wasn't the real data source though was it? People who want to take the quiz have to press "yes" on a menu that vaguely mentions "We need your friends list" and things like that, and those permissions were used to harvest the data as far as I understood, not the quiz itself.
  - Asparagirl 9y ago
    Yes, the quiz was the bait to get to the real prize, your friends list and their info, likes, etc. However, your answers to a different Facebook quiz in 2014 were scrutinized by Cambridge Analytica, who were looking for the “dark triad” of personality traits, scouting for sociopaths: https://mobile.twitter.com/carolecadwalla/status/975905472069988352?lang=en https://mobile.twitter.com/carolecadwalla/status/97590547206...
- pavlov 9y ago
  Yet Tinder is just one of the 150 online brands owned by IAC, a company created by legendary TV executive Barry Diller. He probably knows the value of the data they have.
deleted 9y ago
[deleted]
buro9 9y ago
If you are using Grindr on Android, install and use NetGuard. https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_GB https://play.google.com/store/apps/details?id=eu.faircode.ne... https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard NetGuard is an open source local VPN that allows you to block DNS lookups to prevent calls to 3rd parties, and it does not require root access. Calls to all of the 3rd parties mentioned are blockable. Grindr does not need many domains to be operational to work, just their own domains (.grindr.com on 443, grindr.mobi on 443) and a couple of Google static domains like csi.gstatic.com on 443 . Of course this does not prevent Grindr from rolling up the data and sharing that with 3rd parties, but the linked analysis suggests that this is all via the app making calls rather than the company selling it in bulk.
- andrepd 9y ago
  AFWall is a pretty user-friendly and configurable firewall. Let's you easily block apps from accessing the web. https://github.com/ukanth/afwall https://github.com/ukanth/afwall
  - ktta 9y ago
    AFWall requires root, while NetGuard doesn't. Important distinction now that rooting affects ability to use features like Google Pay, Netflix (offline download), etc.
    - pmlnr 9y ago
      Rooted phone, no google services, and netflix downloads are just fine.
      - ktta 9y ago
        SafetyNet is a cat and mouse game. A lot of people don't have the patience for it.
        pmlnr 9y ago
dawhizkid 9y ago
It's also 100% owned now by a Chinese software company, so might as well assume everything you share there is visible to the Chinese gov't while you're at it.
jessaustin 9y ago
ISTM that "poz" "tribe" is largely equivalent to a positive HIV status? If they're this sloppy when the client device is on one end of the connection, how sloppy are they once the data is on their end and we can't see what they're doing?
olivierduval 9y ago
Grindr has health-related datas and share it... And I guess that they have some european customers, right? Might be a really nice case for GDPR in 2 months !!! :-)
ransom1538 9y ago
Why wouldn't HIV status be protected by HIPAA?
- Asparagirl 9y ago
  HIPAA only covers health care providers who bill for services, such as a doctor’s office or insurance. But there might be other laws that apply.
- notyourday 9y ago
  It depends on entity that's sharing being a "covered" entity.
- chimeracoder 9y ago
  > Why wouldn't HIV status be protected by HIPAA? Because Grindr is not a healthcare provider (doctor, nurse, hospital, etc.) or a health insurer. HIPAA doesn't apply to social networks, or otherwise (e.g.) Twitter would be liable if you wrote a post announcing your own HIV status on their service.
dumbfounder 9y ago
"Grindr's users may not be aware that they are sharing such data with them" I believe that to be an understatement!
dschuetz 9y ago
It's scary that it doesn't surprise me anymore. Especially social networks are considered most lucrative in terms of targeted marketing and data mining, and it's obvious why. Social networking remains a big deal, it's almost mandatory to have some social networking footprint online, or else you miss out on social life. Why is it still OK to trade data distilled from social media accounts? It's not! One of the many reasons and implications are in that article. Is independent social media possible? How to fund basic service infrastructure if not by running online ads, or trading user data? Is decentralized social media feasible, and who maintains a decentralized service if it is? EDIT: If an app developer wants to analyze how the app performs, why share most intimate user data with third parties, Facebook being one of them?
- inetknght 9y ago
  > How to fund basic service infrastructure if not by running online ads, or trading user data? Subscriptions, combined with community awareness advertisements showing where users' money is going to (and where it is not going to) and why it benefits them.
  - dschuetz 9y ago
    Yes, that's usually how it works with Netflix, Spotify and similar single-purpose services. But social media? If you take social network as a single-purpose service then there is no need for several or dozens of different similar services, because it wouldn't make sense as a social network, if you cannot interconnect them. Suppose you pay a subscription for one social network, you'll need to pay also for the other one, to get connected to people on that other social network! It needs to be one big single social network and everyone pays for one subscription. Anything else doesn't make sense, but a single social platform as a network is unthinkable. So, basically, subscription doesn't make sense for social networking.
    - iamatworknow 9y ago
      I don't understand your point here. Just like people pay separate subscription fees for Netflix and Hulu, which essentially provide the same service with different content, why wouldn't people pay separate subscription fees for Twitter and Facebook, if it were an option to avoid ads?
deleted 9y ago
[deleted]
product50 9y ago
These are 3rd party analytics firms and not any random companies. Both these firms have strong data protection processes and are very secure. From Grindr's perspective, they are probably looking for analytics for different segments of their users and send all data to Localytics who help them with this (vs. trying to build these internally). Here is a thought. Do we think that the data is more secure with Grindr itself or with Localytics? I feel the answer might be the latter given data security means a lot to Localytics (as they provide analytics as a service to thousands of apps) vs. Grindr itself who may not go to the extent of Localytics to safefuard user info.
- EmilStenstrom 9y ago
  The data is already in Grindr’s systems, this means it is ALSO at Localytics (and others). This is not as safe as if it was only in Grindr’s own systems.
  - product50 9y ago
    Fair point. My point is that Grindr's system are likely more vulnerable than Localytics and thus that is where the soft point exists if you are a hacker and are trying to get the data.
  - busterarm 9y ago
    And any of these companies could be purchased by some other entity and change their data privacy policy.
    - product50 9y ago
      This is not really true. These companies entire model is handling data and they charge their partners for it. It is not a free product. As such, going off and selling the data is not really going to happen.
      - busterarm 9y ago
        Huh? That has nothing to do with what I said. I said if any of these companies get acquired, the acquiring party can do whatever the hell they want with that data, previous privacy policy be-damned. This has already happened. A lot.
dang 9y ago
Please don't use allcaps for emphasis in HN comments. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
- madeofpalk 9y ago
  fixed.
  - dang 9y ago
    Great, thanks. I've detached this subthread from https://news.ycombinator.com/item?id=16736341 https://news.ycombinator.com/item?id=16736341 and marked it off-topic.
olliej 9y ago
So vending HIV status is a straight up HIPAA violation, I'm fairly sure that's been found to be the case over and over again -- it doesn't matter what your business is, health information is covered by HIPAA. That's 250k per violation fine, and leaking status positive or negative is a violation. And every person, and every time they pass that information to every "partner" is a distinct violation.
- lotharbot 9y ago
  via https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-re... "The Security Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”) and to their business associates." via https://www.hhs.gov/hipaa/for-professionals/privacy/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/index.ht... "The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically." in what circumstances has HIPAA been found to apply to businesses other than those?
  - your-nanny 9y ago
    It applies to researchers.
- jayd16 9y ago
  This is like saying Twitter is liable if you tweet your own status.
  - frenchie14 9y ago
    That's not even close to the same thing. You're comparing involuntary and unknown sharing of personal data with explicit and self-actioned sharing of that data.
napolux 9y ago
I think we all agree on how stupid is to track all the little details (including positions, hiv status, etc...) for the only purpose of making money, but I would like to underline that there are only two reasons to not use https today. You’re stupid or you’re lazy. Can’t tell the worst, but I can tell that users should completely delete their Grindr account, now.
jdelsman 9y ago
None of that data seems to be "private" according to Grindr's privacy policy: https://www.grindr.com/privacy-policy https://www.grindr.com/privacy-policy
- deleted 9y ago
  [deleted]
joshstrange 9y ago
I'd be interested to see how Scruff/Jack'd/etc stacks up. My guess is Scruff does better (it has always been a better designed/developed app) but I understand why they focused only on Grindr as it does have the largest market share (admittedly a guess). Grindr has never been exactly a bastion of good programming... Their app has always been subpar at best with infrequent updates, months/year long bugs, terrible UI/Navigation, lack of features that could be coded up in a weeks time that would GREATLY improve the experience (Message archival/hiding), and I could go on. It would be one thing if they features were relegated to the paid version (Grindr Xtra) but the only really big feature for Xtra is push notifications for when you get a new message. All of this is to say the fact they are using HTTP to talk to these analytics/ad companies doesn't shock me at all. My bet is they haven't updated the libraries for these services in forever (which wouldn't be too hard to investigate). As for HIV status getting sent it really depends on the service. They are not subject to HIPAA (even if you wish they were) so they can do this and I'm sure for targeting ads it makes sense. No need to waste ad dollars on "Get tested for HIV" for people who already know they are positive. As someone in this community and knows the orgs that pay for some of these ads are severely underfunded I have hard time saying this isn't important to make sure your ad dollars go as far as they can. Lastly for people saying "just don't enter your status" you clearly don't understand this community, I'm sorry. But people who are positive face a HUGE stigma. Chatting on Grindr/Scruff is already an emotionally draining experience in a lot of cases, I don't you all want the details but let's just say failed conversations (for most people at least) don't exactly fill you with confidence/self-worth (yes there is a whole other discussion to be had there I'm sure). So waiting until you start a conversation to tell someone you are positive (instead of it being in your profile) is going to lead to even more failed conversations. If I were positive I think I'd trade my status away to analytics/ad companies in exchange for not having to talk to people who aren't interested in the first place. I'm saying that as a white male living in the US so depending on your situation you may disagree.
- lotharbot 9y ago
  the CEO of Scruff replied elsewhere in this thread: https://news.ycombinator.com/item?id=16738283 https://news.ycombinator.com/item?id=16738283
- 9y ago
onewhonknocks 9y ago
Image of the data structure. https://i.imgur.com/hstbZio.png https://i.imgur.com/hstbZio.png
wackspurt 9y ago
I remember this paper on ad intelligence I read a few weeks ago: "Exploring ADINT: Using Ad Targeting for Surveillance on a Budget — or — How Alice Can Buy Ads to Track Bob". https://adint.cs.washington.edu/ADINT.pdf https://adint.cs.washington.edu/ADINT.pdf
Redoubts 9y ago
They also scrape your clipboard aggressively...
- udli3 9y ago
  Source?
  - Redoubts 9y ago
    At least on iOS, proof by demonstration. Install the app, turn on clipboard sharing, copy something on your mac, then open the iOS app. You'll see the "Pasting from your Mac" dialog pop up pretty frequently.
asow92 9y ago
Does anyone actually find this surprising? It's fairly normal to send user data to third party analytics providers. If you want to know which, check your terms of service.
josecastillo 9y ago
It might be worth making another post to highlight an additional concern: this repository itself appears to leak profile images of many Grindr users. The raw-data folder includes nearly 14,000 files, including many ads and scripts, but also thumbnails of many user profiles. This file[1] for example, once you strip out the HTTP headers, is a JPEG that shows the legs and gym socks of one user. This one [2] shows a user's bare torso. I would link to others, but most of the ones that I've found include clear views of users' faces, sometimes clothed and sometimes shirtless. In some cases it looks like the photos were taken in their homes. It's ironic that in exposing Grindr's mishandling of users' personal data, this party appears to have mishandled personal data themselves. [1]: https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/master/raw-data/raw/2992_s.txt https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/mas... [2]: https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/master/raw-data/raw/3006_s.txt https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/mas...
- rpmcmurphy 9y ago
  Somebody needs to write a Peter Thiel / Not Peter Thiel script, and cross reference the photos with his Friendster profile pic where he was shirtless on a boat advertising for twinks (pro tip for people who think he was outed by Gawker, he was one of the most obvious closet cases in San Francisco).
- tallanvor 9y ago
  Since SINTEF is based in Norway, it's certainly possible that my profile picture is somewhere in there, and that really pisses me off. I'm out and have no problem with people knowing that I'm gay, but I shouldn't have to deal with "researchers" pulling this type of crap.
  - zeth___ 9y ago
    Are you happier with teens in Slovakia pulling this type of crap? If it isn't locked down someone has already scraped it and saved it forever. That you don't see most of the data being stored about you means nothing. Just another data-point explaining why in 10 years you got pulled off that Emirates plane in a layover in Dubai and were never seen from again.
adamzk 9y ago
1) it's all in the terms of service. Idk why anybody is surprised. They own everything you enter into the app anywhere full stop. 2) it's not going anywhere. Its the gay Facebook. It has monopolized the market of an already vulnerable demographic so they can do whatever they want and still charge an extraordinary amount (almost $20 per month??) and provide no customer service. The app doesn't even function as advertised (at least on Android). Push notifications and read receipts have been broken for years. Btw if you restrict the permissions of the app they permanently change your status to offline.
Guyneedham 9y ago
I used to be a data engineer at an ad tech company, Blis. A huge proportion of the GPS data we relied upon for retargeting and enrichment of the bids came from Grindr, but even so we almost never bid on traffic from them, the brands we worked with were opposed to being associated with that app. So we benefited a lot from Grindr data without giving much back.
gsich 9y ago
"shares" sounds too friendly.
ponderatul 9y ago
I see they have some instructions there for how they did it. Any chance anyone could make a small instructive tutorial, so we can start replicating this process for other apps as well? Then we can put everything in a giant repo and make it publicly accessible information.
Sideloader 9y ago
I am shocked, truly shocked at this development. An app that collects user data and passes it on to third parties without users’ consent? Unprecedented!
GeneralTspoon 9y ago
Looks like the repo got deleted. Can't find an arhive.org version either. According to a friend, an article he saw earlier also got pulled. Are Grindr attempting to do some damage control?

840 points by tjwds 9y ago

It's become clear over the last year there is a strong need for a data privacy regulatory agency in US government. I understand that regulation hampers growth, but the tech industry is mature and developed to the point that it's time to reel in "moving fast and breaking things" a bit.

DoofusOfDeath 9y ago
> It's become clear over the last year there is a strong need for a data privacy regulatory agency in US government. I wouldn't trust a governmental regulatory agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians. I suspect a more effective strategy is to enact legislation that makes companies liable under civil law, with private citizens empowered to sue.
- JumpCrisscross 9y ago
  > a more effective strategy is to enact legislation that makes companies liable under civil law Agree. But there is still a role for a public prosecutor to (a) collect complaints and (b) launching suits on behalf of the public, for when violations occur and no private action ensues.
- jumelles 9y ago
  > I wouldn't trust a governmental agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians. I think this sort of attitude is a big problem - instead of throwing our hands up and deciding that regulatory agencies have always been and thus will always be toothless, we need to give said agencies more power to enable them to actually enforce the rules. Right now, companies regularly weigh the costs of compliance against the costs of non-compliance because to a multinational corporation, the usual fines and punishments just don't hurt that much. Companies that break the law should regularly never, ever recover financially.
  - news_to_me 9y ago
    > Companies that break the law should regularly never, ever recover financially. Personally I would have this reworded to "Companies that regularly break the law should never, ever recover financially." As much as I believe things are tilted too far in favor of companies these days, it is true that over-harsh regulation on business can be very bad — particularly when it becomes harder to start new businesses. But I agree with your sentiment. To a large degree the government is as good as we make it.
    - Silhouette 9y ago
      This is an important point, I think. If our ultimate goal is to incentivise good practice, we have to deal with a range of problems from simple ignorance of good practice or what the law requires through to gross negligence or "wilful ignorance" situations. If you have a business that is acting in good faith but makes an error in judgement or isn't aware of some specific regulation, there is no sense taking a punitive stance. Obviously if their actions have caused damage to another party then compensation may be appropriate, but otherwise constructive engagement is likely to work best. On the other hand, if you have a business that is knowingly and deliberately acting in bad faith, there may be little point in being constructive, and the penalties need to be significant enough to force them to change (or their business to fail).
- anigbrowl 9y ago
  You're screwed either way. If a government agency enforces it, opposition politicians attack it. If courts enforce it, courts are attacked instead and opposition politicians push for changes int eh law. the regulated industry will cheerfully spend shareholder money to drive public sentiment in a favorable direction. In US politics, money dominates everything else.
- astrobe_ 9y ago
  I'm not knowledgeable about how the US administration works, but I think it's a universal principle that when you write laws and regulations, it generally has to come with means to inspect and check that the rules are not violated. It's especially difficult with anything digital. Do you really want to rely just on whistleblowers?
- ISL 9y ago
  > I wouldn't trust a governmental agency to aggressively fulfill it's mission. My impression is that in general they're too much at the mercy of politicians. It is good when a governmental agency is at the mercy of politicians. As the electorate, we are responsible for the politicians we elect.
- wang_li 9y ago
  >I suspect a more effective strategy is to enact legislation that makes companies liable under civil law, with private citizens empowered to sue. There's no chance that will happen. It should, but it won't. By taking away the ability of individual citizens to sue, and vesting that power in a government agency, it protects the companies while empowering the regulators. The end result is fair toothless regulation and more donations/lobbying dollars flowing from the private sector to the public sector/politicians. A number of anti-spam laws ended up this way.
pavlov 9y ago
> regulation hampers growth Is there proof of this? Some countries like Germany and Sweden are both highly regulated and have fastest economic growth in the West.
- deltron3030 9y ago
  Who's growing is the more important question. Regulation benefits the already big.
  - fnord123 9y ago
    Some regulation is bad, but there are plenty of good examples. Regulation on the standards like GSM and use of SIM cards helped new entrants into the European markets. Net Neutrality, standardized electrical systems, etc have benefited everyone large and small. And of course, anti-trust regulations in the EU has not benefited Microsoft or Google.
    - davidw 9y ago
      > standardized electrical systems Except for the damn plugs!
  - anigbrowl 9y ago
    That's truism that I don't think is accurate. You're assuming all regulation is complex and that this can directly drive administrative costs in linear fashion.
  - smt88 9y ago
    > Regulation benefits the already big "Regulation" isn't guaranteed to do anything. Some regulations benefit already-big, some harm them. Some have no effect at all. Lack of regulation is guaranteed to benefit already-big, though. Unchecked corporations become oligopolies or monopolies. Free markets (meaning free movement, not free of regulation) and consumer protection are impossible without regulations, though.
    - 9y ago
bowlofpetunias 9y ago
This shouldn't be in the hands of a regulatory agency. Serious privacy violations should be legislated and treated as outright crimes, not just regulation infringements. Violating basic civil rights should not just result in the off chance of having to pay a fine. People like Zuckerberg belong in jail way more than the average drug dealer.
- dragonwriter 9y ago
  > This shouldn't be in the hands of a regulatory agency. Serious privacy violations should be legislated and treated as outright crimes, not just regulation infringements. IHIPAA is largely in the hands of HHS as a regulatory body, and yet violation of its privacy mandates (including those HHS is empowered to detail by regulation) are “outright crimes” as well as also potential civil offenses, not some distinct and lesser category of “regulatory violations”. Your argument seems deeply grounded in an incorrect assumption about what it means to involve a regulatory agency.
agumonkey 9y ago
I wonder how these things were before. Maybe there was a bit of data sharing but at such small scale and speed that it didn't really matter.

werber 9y ago

Does anyone have any information on how Scruff handles that information? Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status?

dragonwriter 9y ago
> Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status? No, HIPAA binds only covered entities, which are (basically) care providers, insurers, and certain other parties in certain business relationships with care providers and insurers. If you give out your health information to a dating service, it's not protected by HIPAA.
- reureu 9y ago
  That's not to say there may not be other laws that govern how you protect a user's data though.
  - rhizome 9y ago
    Such as? I'm not under the impression that there are any legal prohibitions on this kind of thing in the US.
    - zoe1337 9y ago
      That's the problem.
      - DataWorker 9y ago
        For now at least...
    - reureu 9y ago
      The first that comes to mind is the Federal Trade Commission Act, which allows the FTC to charge companies which fail to protect consumer personal data.

ordinaryradical 9y ago

We need a new business model for social media, one which actually serves the customer instead of trying to lure them into productizing themselves.

thomasjudge 9y ago
The problem obviously is competing with free...although, maybe we are beginning to realize that there are hidden costs to "free"...
overcast 9y ago
So you're going to pay to use it right? If this imaginary product managed to get 1% of Facebook to hand over their credit card. That would be the most wildly successful pay to use application in existence. Will never happen. Social Media sites rely on mass adoption, among those who refuse to pay for just about anything.
- johnchristopher 9y ago
  Just as some people pay for fastmail I am pretty sure there'd be some people paying an entrance fee to a social network. Wasn't the social network of last week, vero, supposed to be like that ?
  - overcast 9y ago
    Email is a poor comparison, because you're connecting to millions of other people using gmail/yahoo/whatever, for free. The correct comparison would be if eMail was a universally paid for service. It would NOT be what it is today.
    - johnchristopher 9y ago
      I am not comparing the aims or the essence of the service. I am expression the opinion that social networks can be a paid-for service just like email, music or video can.

morley 9y ago

For what it's worth, the most private data here is shared to analytics companies for Grindr's only analytical use. My guess is that Grindr's agreement with Apptimize and Localytics asks for the strictest possible protection of that data. If anyone at Apptimize or Localytics has access to that data, I'd be incredibly surprised. This sort of deal isn't the same as sharing the HIV status to Google or Facebook so that advertisers can target or exclude that user information for the purposes of advertising. For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance? The open source, self-hosted pickings are slim. (I can only think of Piwik, which in my experience has a dated feature set and severe performance issues.) Not everyone can afford to perform their own product analysis. Using a third-party analytics saas is kind of the only way to go and seems like a reasonable tradeoff of security for product visibility.

lawnchair_larry 9y ago
As someone who has been working in security for a long time, and has seen how the sausage is made at even the biggest, most reputable companies who “take security very seriously”, the “strictest possible protection of that data” means approximately nothing. The only serious way to protect sensitive data is not to take it in the first place. Hell, not even the NSA can keep a lid on their sensitive data. ”For people who think this is still wrong, I'm curious what their pragmatic alternative is. How else are app developers supposed to analyze their app performance?” Remember, customers first, your “needs” come second. That goes double when they are placing their trust in you by allowing you to be a custodian of their data. Not long ago, desktop software phoning home would have been a scandal. Not long before that, it was offline and couldn’t phone home. Yet, we still had software. Unfortunately, developers have taken the slipperly slope all the way to outright abuse of their privileges in order to collect information that customers don’t know about or understand. This has led us to things like GDPR. It doesn’t matter if your intentions are good or your usage is benign. It isn’t yours to begin with, those aren’t your decisions to make, and developers need to learn to seriously respect that.
hackcasual 9y ago
They have the option of not sending HIV status to any third party.

frgtpsswrdlame 9y ago

So there's lots of talk about how we're going to regulate/manage data protection going forward but what are we going to do about the stuff that is already out there? I mean HIV status is a pretty toxic thing to just be floating around. It doesn't seem that we can even be sure who has this data and who doesn't.

jonbarker 9y ago

Also, many mobile users name their device their whole name, effectively deanonymizing all their app usage for the massive ecosystem of marketing companies out there. Having worked in the mobile marketing industry I was shocked at how many people were doing this and probably had no idea this was the case.

Jonnax 9y ago
Is that an iPhone thing? I know it's not possible to set the hostname of your phone on most android phones but it's unique. Of course with Android making build versions and etc. Available to devs and in the case of chrome to your user agent. You're pretty much identifible.
- jschwartzi 9y ago
  Oh, but it is possible. It's buried in the networking settings but there's a phone name option which is used for just about everything. Although on my LG devices it defaults to the series name, for example G3 for an LG G3.

arcaster 9y ago

This is deeply troubling. Anyone who uses Tinder or any other dating site should try requesting their data and realize that these services could likely label you a sexual deviant, racist or otherwise based on your swipes alone.

mtgx 9y ago
I guess we'll soon find out: https://www.wired.com/story/tinder-lack-of-encryption-lets-strangers-spy-on-swipes/ https://www.wired.com/story/tinder-lack-of-encryption-lets-s... https://www.theguardian.com/technology/2017/sep/26/tinder-personal-data-dating-app-messages-hacked-sold https://www.theguardian.com/technology/2017/sep/26/tinder-pe...
zoe1337 9y ago
They probably don't even know. The AI which learned on the data doesn't necessarily has labels, it just connects the dots.
odiroot 9y ago
OkCupid may be even more dangerous in that regard. As far as I know they allow you to set ethnicity preferences.
- CamperBob2 9y ago
  Most dating services do. Why shouldn't they?
  - rurounijones 9y ago
    I think the reasoning is innocent, the problem is that if it gets leaked you have people (probably incorrectly) interpreting things using the data which is half the problem. "Your ethnicity preference is white? You goddamn racist". This gets worse when those interpreters are in a position of power.

JumpCrisscross 9y ago

Even within its confines, Grindr's data are rich for blackmail. (Consider: images and messages sent and received within 100 feet of Capitol Hill.) It was recently acquired by an offshore billionaire [1]. [1] https://www.bloomberg.com/news/articles/2016-01-12/china-tech-billionaire-buys-control-of-us-gay-dating-app-grindr https://www.bloomberg.com/news/articles/2016-01-12/china-tec...

loceng 9y ago
Makes me think that data should be treated differently in the case of a potential new owner, allowing users to opt-out from their data from being transferred; you may trust the leadership and governance, and may not trust whomever takes over or who will newly has access to the data.
- kayfox 9y ago
  You can delete the data from your profile.
  - jacquesm 9y ago
    Correction: you can mark it as deleted.
  - bognition 9y ago
    lol, that means nothing. It most likely means that data is marked as deleted but the original values are retained.
    - kayfox 9y ago
      Well, you could also just not fill it out in the first place. To be clear, this is public profile information displayed to any user of the Grindr app.
      - hluska 9y ago
        Except that if a user fills in a Grindr profile, they believe they are only sharing information with Grindr/its users. The truth is that they share all of the information (in less than secure ways) with a variety of third parties and fail to disclose that fact. That's illegal in many countries (including mine) and it demonstrates an unbelievable lack of regard for user privacy or safety.

amq 9y ago

A bit unrelated, but imagine how much data has Tinder collected, if Cambridge Analytica could do that much with just a comparatively unpopular quiz app.

arrythur 9y ago
Correct me if I'm wrong, but wasn't the quiz app just a way to gain access to a user's data? So it wasn't so much the content of the quiz that was revealing, just the access to data it provided.
- makomk 9y ago
  I'm pretty sure their "psychometrics" play required the data users gave them as part of the quiz. The whole point of the exercise was to supposedly figure out people's personality traits from their social media profiles and let marketers target them based on that, and I think the personality quiz was probably the only way they could get ground truth information to train their model on.
cavanasm 9y ago
The quiz app wasn't the real data source though was it? People who want to take the quiz have to press "yes" on a menu that vaguely mentions "We need your friends list" and things like that, and those permissions were used to harvest the data as far as I understood, not the quiz itself.
- Asparagirl 9y ago
  Yes, the quiz was the bait to get to the real prize, your friends list and their info, likes, etc. However, your answers to a different Facebook quiz in 2014 were scrutinized by Cambridge Analytica, who were looking for the “dark triad” of personality traits, scouting for sociopaths: https://mobile.twitter.com/carolecadwalla/status/975905472069988352?lang=en https://mobile.twitter.com/carolecadwalla/status/97590547206...
pavlov 9y ago
Yet Tinder is just one of the 150 online brands owned by IAC, a company created by legendary TV executive Barry Diller. He probably knows the value of the data they have.

deleted 9y ago

[deleted]

buro9 9y ago

If you are using Grindr on Android, install and use NetGuard. https://play.google.com/store/apps/details?id=eu.faircode.netguard&hl=en_GB https://play.google.com/store/apps/details?id=eu.faircode.ne... https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard NetGuard is an open source local VPN that allows you to block DNS lookups to prevent calls to 3rd parties, and it does not require root access. Calls to all of the 3rd parties mentioned are blockable. Grindr does not need many domains to be operational to work, just their own domains (.grindr.com on 443, grindr.mobi on 443) and a couple of Google static domains like csi.gstatic.com on 443 . Of course this does not prevent Grindr from rolling up the data and sharing that with 3rd parties, but the linked analysis suggests that this is all via the app making calls rather than the company selling it in bulk.

andrepd 9y ago
AFWall is a pretty user-friendly and configurable firewall. Let's you easily block apps from accessing the web. https://github.com/ukanth/afwall https://github.com/ukanth/afwall
- ktta 9y ago
  AFWall requires root, while NetGuard doesn't. Important distinction now that rooting affects ability to use features like Google Pay, Netflix (offline download), etc.
  - pmlnr 9y ago
    Rooted phone, no google services, and netflix downloads are just fine.
    - ktta 9y ago
      SafetyNet is a cat and mouse game. A lot of people don't have the patience for it.
      - pmlnr 9y ago

dawhizkid 9y ago

It's also 100% owned now by a Chinese software company, so might as well assume everything you share there is visible to the Chinese gov't while you're at it.

jessaustin 9y ago

ISTM that "poz" "tribe" is largely equivalent to a positive HIV status? If they're this sloppy when the client device is on one end of the connection, how sloppy are they once the data is on their end and we can't see what they're doing?

olivierduval 9y ago

Grindr has health-related datas and share it... And I guess that they have some european customers, right? Might be a really nice case for GDPR in 2 months !!! :-)

ransom1538 9y ago

Why wouldn't HIV status be protected by HIPAA?

Asparagirl 9y ago
HIPAA only covers health care providers who bill for services, such as a doctor’s office or insurance. But there might be other laws that apply.
notyourday 9y ago
It depends on entity that's sharing being a "covered" entity.
chimeracoder 9y ago
> Why wouldn't HIV status be protected by HIPAA? Because Grindr is not a healthcare provider (doctor, nurse, hospital, etc.) or a health insurer. HIPAA doesn't apply to social networks, or otherwise (e.g.) Twitter would be liable if you wrote a post announcing your own HIV status on their service.

dumbfounder 9y ago

"Grindr's users may not be aware that they are sharing such data with them" I believe that to be an understatement!

dschuetz 9y ago

It's scary that it doesn't surprise me anymore. Especially social networks are considered most lucrative in terms of targeted marketing and data mining, and it's obvious why. Social networking remains a big deal, it's almost mandatory to have some social networking footprint online, or else you miss out on social life. Why is it still OK to trade data distilled from social media accounts? It's not! One of the many reasons and implications are in that article. Is independent social media possible? How to fund basic service infrastructure if not by running online ads, or trading user data? Is decentralized social media feasible, and who maintains a decentralized service if it is? EDIT: If an app developer wants to analyze how the app performs, why share most intimate user data with third parties, Facebook being one of them?

inetknght 9y ago
> How to fund basic service infrastructure if not by running online ads, or trading user data? Subscriptions, combined with community awareness advertisements showing where users' money is going to (and where it is not going to) and why it benefits them.
- dschuetz 9y ago
  Yes, that's usually how it works with Netflix, Spotify and similar single-purpose services. But social media? If you take social network as a single-purpose service then there is no need for several or dozens of different similar services, because it wouldn't make sense as a social network, if you cannot interconnect them. Suppose you pay a subscription for one social network, you'll need to pay also for the other one, to get connected to people on that other social network! It needs to be one big single social network and everyone pays for one subscription. Anything else doesn't make sense, but a single social platform as a network is unthinkable. So, basically, subscription doesn't make sense for social networking.
  - iamatworknow 9y ago
    I don't understand your point here. Just like people pay separate subscription fees for Netflix and Hulu, which essentially provide the same service with different content, why wouldn't people pay separate subscription fees for Twitter and Facebook, if it were an option to avoid ads?

deleted 9y ago

[deleted]

product50 9y ago

These are 3rd party analytics firms and not any random companies. Both these firms have strong data protection processes and are very secure. From Grindr's perspective, they are probably looking for analytics for different segments of their users and send all data to Localytics who help them with this (vs. trying to build these internally). Here is a thought. Do we think that the data is more secure with Grindr itself or with Localytics? I feel the answer might be the latter given data security means a lot to Localytics (as they provide analytics as a service to thousands of apps) vs. Grindr itself who may not go to the extent of Localytics to safefuard user info.

EmilStenstrom 9y ago
The data is already in Grindr’s systems, this means it is ALSO at Localytics (and others). This is not as safe as if it was only in Grindr’s own systems.
- product50 9y ago
  Fair point. My point is that Grindr's system are likely more vulnerable than Localytics and thus that is where the soft point exists if you are a hacker and are trying to get the data.
- busterarm 9y ago
  And any of these companies could be purchased by some other entity and change their data privacy policy.
  - product50 9y ago
    This is not really true. These companies entire model is handling data and they charge their partners for it. It is not a free product. As such, going off and selling the data is not really going to happen.
    - busterarm 9y ago
      Huh? That has nothing to do with what I said. I said if any of these companies get acquired, the acquiring party can do whatever the hell they want with that data, previous privacy policy be-damned. This has already happened. A lot.

dang 9y ago

Please don't use allcaps for emphasis in HN comments. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.

madeofpalk 9y ago
fixed.
- dang 9y ago
  Great, thanks. I've detached this subthread from https://news.ycombinator.com/item?id=16736341 https://news.ycombinator.com/item?id=16736341 and marked it off-topic.

olliej 9y ago

So vending HIV status is a straight up HIPAA violation, I'm fairly sure that's been found to be the case over and over again -- it doesn't matter what your business is, health information is covered by HIPAA. That's 250k per violation fine, and leaking status positive or negative is a violation. And every person, and every time they pass that information to every "partner" is a distinct violation.

lotharbot 9y ago
via https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-re... "The Security Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”) and to their business associates." via https://www.hhs.gov/hipaa/for-professionals/privacy/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/index.ht... "The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically." in what circumstances has HIPAA been found to apply to businesses other than those?
- your-nanny 9y ago
  It applies to researchers.
jayd16 9y ago
This is like saying Twitter is liable if you tweet your own status.
- frenchie14 9y ago
  That's not even close to the same thing. You're comparing involuntary and unknown sharing of personal data with explicit and self-actioned sharing of that data.

napolux 9y ago

I think we all agree on how stupid is to track all the little details (including positions, hiv status, etc...) for the only purpose of making money, but I would like to underline that there are only two reasons to not use https today. You’re stupid or you’re lazy. Can’t tell the worst, but I can tell that users should completely delete their Grindr account, now.

jdelsman 9y ago

None of that data seems to be "private" according to Grindr's privacy policy: https://www.grindr.com/privacy-policy https://www.grindr.com/privacy-policy

deleted 9y ago
[deleted]

joshstrange 9y ago

I'd be interested to see how Scruff/Jack'd/etc stacks up. My guess is Scruff does better (it has always been a better designed/developed app) but I understand why they focused only on Grindr as it does have the largest market share (admittedly a guess). Grindr has never been exactly a bastion of good programming... Their app has always been subpar at best with infrequent updates, months/year long bugs, terrible UI/Navigation, lack of features that could be coded up in a weeks time that would GREATLY improve the experience (Message archival/hiding), and I could go on. It would be one thing if they features were relegated to the paid version (Grindr Xtra) but the only really big feature for Xtra is push notifications for when you get a new message. All of this is to say the fact they are using HTTP to talk to these analytics/ad companies doesn't shock me at all. My bet is they haven't updated the libraries for these services in forever (which wouldn't be too hard to investigate). As for HIV status getting sent it really depends on the service. They are not subject to HIPAA (even if you wish they were) so they can do this and I'm sure for targeting ads it makes sense. No need to waste ad dollars on "Get tested for HIV" for people who already know they are positive. As someone in this community and knows the orgs that pay for some of these ads are severely underfunded I have hard time saying this isn't important to make sure your ad dollars go as far as they can. Lastly for people saying "just don't enter your status" you clearly don't understand this community, I'm sorry. But people who are positive face a HUGE stigma. Chatting on Grindr/Scruff is already an emotionally draining experience in a lot of cases, I don't you all want the details but let's just say failed conversations (for most people at least) don't exactly fill you with confidence/self-worth (yes there is a whole other discussion to be had there I'm sure). So waiting until you start a conversation to tell someone you are positive (instead of it being in your profile) is going to lead to even more failed conversations. If I were positive I think I'd trade my status away to analytics/ad companies in exchange for not having to talk to people who aren't interested in the first place. I'm saying that as a white male living in the US so depending on your situation you may disagree.

lotharbot 9y ago
the CEO of Scruff replied elsewhere in this thread: https://news.ycombinator.com/item?id=16738283 https://news.ycombinator.com/item?id=16738283
9y ago

onewhonknocks 9y ago

Image of the data structure. https://i.imgur.com/hstbZio.png https://i.imgur.com/hstbZio.png

wackspurt 9y ago

I remember this paper on ad intelligence I read a few weeks ago: "Exploring ADINT: Using Ad Targeting for Surveillance on a Budget — or — How Alice Can Buy Ads to Track Bob". https://adint.cs.washington.edu/ADINT.pdf https://adint.cs.washington.edu/ADINT.pdf

Redoubts 9y ago

They also scrape your clipboard aggressively...

udli3 9y ago
Source?
- Redoubts 9y ago
  At least on iOS, proof by demonstration. Install the app, turn on clipboard sharing, copy something on your mac, then open the iOS app. You'll see the "Pasting from your Mac" dialog pop up pretty frequently.

asow92 9y ago

Does anyone actually find this surprising? It's fairly normal to send user data to third party analytics providers. If you want to know which, check your terms of service.

josecastillo 9y ago

It might be worth making another post to highlight an additional concern: this repository itself appears to leak profile images of many Grindr users. The raw-data folder includes nearly 14,000 files, including many ads and scripts, but also thumbnails of many user profiles. This file[1] for example, once you strip out the HTTP headers, is a JPEG that shows the legs and gym socks of one user. This one [2] shows a user's bare torso. I would link to others, but most of the ones that I've found include clear views of users' faces, sometimes clothed and sometimes shirtless. In some cases it looks like the photos were taken in their homes. It's ironic that in exposing Grindr's mishandling of users' personal data, this party appears to have mishandled personal data themselves. [1]: https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/master/raw-data/raw/2992_s.txt https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/mas... [2]: https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/master/raw-data/raw/3006_s.txt https://github.com/SINTEF-9012/grindr-privacy-leaks/blob/mas...

rpmcmurphy 9y ago
Somebody needs to write a Peter Thiel / Not Peter Thiel script, and cross reference the photos with his Friendster profile pic where he was shirtless on a boat advertising for twinks (pro tip for people who think he was outed by Gawker, he was one of the most obvious closet cases in San Francisco).
tallanvor 9y ago
Since SINTEF is based in Norway, it's certainly possible that my profile picture is somewhere in there, and that really pisses me off. I'm out and have no problem with people knowing that I'm gay, but I shouldn't have to deal with "researchers" pulling this type of crap.
- zeth___ 9y ago
  Are you happier with teens in Slovakia pulling this type of crap? If it isn't locked down someone has already scraped it and saved it forever. That you don't see most of the data being stored about you means nothing. Just another data-point explaining why in 10 years you got pulled off that Emirates plane in a layover in Dubai and were never seen from again.

adamzk 9y ago

1) it's all in the terms of service. Idk why anybody is surprised. They own everything you enter into the app anywhere full stop. 2) it's not going anywhere. Its the gay Facebook. It has monopolized the market of an already vulnerable demographic so they can do whatever they want and still charge an extraordinary amount (almost $20 per month??) and provide no customer service. The app doesn't even function as advertised (at least on Android). Push notifications and read receipts have been broken for years. Btw if you restrict the permissions of the app they permanently change your status to offline.

Guyneedham 9y ago

I used to be a data engineer at an ad tech company, Blis. A huge proportion of the GPS data we relied upon for retargeting and enrichment of the bids came from Grindr, but even so we almost never bid on traffic from them, the brands we worked with were opposed to being associated with that app. So we benefited a lot from Grindr data without giving much back.

gsich 9y ago

"shares" sounds too friendly.

ponderatul 9y ago

I see they have some instructions there for how they did it. Any chance anyone could make a small instructive tutorial, so we can start replicating this process for other apps as well? Then we can put everything in a giant repo and make it publicly accessible information.

Sideloader 9y ago

I am shocked, truly shocked at this development. An app that collects user data and passes it on to third parties without users’ consent? Unprecedented!

GeneralTspoon 9y ago

Looks like the repo got deleted. Can't find an arhive.org version either. According to a friend, an article he saw earlier also got pulled. Are Grindr attempting to do some damage control?