4 ms·

Grindr Will Now Have to Sue Fuckr to Keep Controversial Tool Down

10 points by ccnafr 8y ago

auslander 8y ago
Cyberpunk at its best
ekimekim 8y ago
> In addition, Fuckr offers access to a trove of information about Grindr users not freely available > "Fuckr does not bypass any technical access control mechanism and does not access any work copyrighted by Grindr LLC" From a surface reading, I'm guessing that Grindr's "security" model is "trust the client", and so Fuckr can access all kinds of information just by using an undocumented API. Grindr's lawyers are claiming this circumvents access controls, and tomlandia is claiming this doesn't count as circumventing "any technical access control mechanism" (emphasis mine). This is all, of course, wild speculation on my part (I'm not aware of the history of Fuckr or how it works). But if I'm right it's a very interesting precedent. Is accessing an undocumented API in ways the developers do not wish you to "circumventing access controls"? It has a lot of parallels to the "change the id in the url by 1 and access things you aren't supposed to" scenario. I'm not sure if that ever got a definitive ruling either.
- BigJono 8y ago
  Any ruling other than "tough titties" would be fucking insane here. Unsecured API endpoints are public. I was going to say it's like leaving a folder of sensitive info on the train and complaining when someone accesses it, but it's not. You can't program an endpoint by accident. Someone has to specifically go and code it to spit out the data without authentication. It's more like leaving a folder of sensitive information out on the street infront of your office then suing the first person to pick it up. EDIT: Come to think of it. There has to be more to this story. If Grindr was broadcasting exact locations across an unsecure API that'd be extraordinarily unsafe. It would lead to all sorts of black mail and hate crimes. Surely we'd have heard about it if that was the case?
- hannasanarion 8y ago
  The Computer Fraud and Abuse Act is infamous got how broadly it defines "unauthorized use": basically anything other than what the designer or owner intended. So their case would be pretty solid.
  - jsjohnst 8y ago
    But the CFAA is a criminal act, not civil. Using the DMCA for a CFAA violation seems wrong to me. You shouldn’t have grounds to sue for a copyright violation when it was a possible CFAA violation, imho.
- MarkMc 8y ago
  "Trust the client" is terrible security. Isn't Grindr risking significant lawsuits, especially under GDPR?
yosefzeev 8y ago
This all sounds like some horrible joke instead of serious business dilemmas.

10 points by ccnafr 8y ago

Cyberpunk at its best

> In addition, Fuckr offers access to a trove of information about Grindr users not freely available > "Fuckr does not bypass any technical access control mechanism and does not access any work copyrighted by Grindr LLC" From a surface reading, I'm guessing that Grindr's "security" model is "trust the client", and so Fuckr can access all kinds of information just by using an undocumented API. Grindr's lawyers are claiming this circumvents access controls, and tomlandia is claiming this doesn't count as circumventing "any technical access control mechanism" (emphasis mine). This is all, of course, wild speculation on my part (I'm not aware of the history of Fuckr or how it works). But if I'm right it's a very interesting precedent. Is accessing an undocumented API in ways the developers do not wish you to "circumventing access controls"? It has a lot of parallels to the "change the id in the url by 1 and access things you aren't supposed to" scenario. I'm not sure if that ever got a definitive ruling either.

BigJono 8y ago
Any ruling other than "tough titties" would be fucking insane here. Unsecured API endpoints are public. I was going to say it's like leaving a folder of sensitive info on the train and complaining when someone accesses it, but it's not. You can't program an endpoint by accident. Someone has to specifically go and code it to spit out the data without authentication. It's more like leaving a folder of sensitive information out on the street infront of your office then suing the first person to pick it up. EDIT: Come to think of it. There has to be more to this story. If Grindr was broadcasting exact locations across an unsecure API that'd be extraordinarily unsafe. It would lead to all sorts of black mail and hate crimes. Surely we'd have heard about it if that was the case?
hannasanarion 8y ago
The Computer Fraud and Abuse Act is infamous got how broadly it defines "unauthorized use": basically anything other than what the designer or owner intended. So their case would be pretty solid.
- jsjohnst 8y ago
  But the CFAA is a criminal act, not civil. Using the DMCA for a CFAA violation seems wrong to me. You shouldn’t have grounds to sue for a copyright violation when it was a possible CFAA violation, imho.
MarkMc 8y ago
"Trust the client" is terrible security. Isn't Grindr risking significant lawsuits, especially under GDPR?

yosefzeev 8y ago

This all sounds like some horrible joke instead of serious business dilemmas.