4 ms·

There’s so much throwaway data in there I’d be hard pressed to believe there’s much of value. They don’t even validate the users email beyond “contains @“.

wbl 7y ago
Luckily (or not) database join with the OPM hack is trivial.
zeta0134 7y ago
I wouldn't be so sure. Grindr tracks users locations pretty precisely, and although many users hide their faces in profile pictures, many more demand a face be sent through direct messages, etc. If you have location and a face, and your target is even remotely popular, some internet sleuthing can put the rest together pretty easily. How much of this can be validated and proven to not be a masquerade (fake pictures / profiles are ridiculously common, as are bot accounts on the platform) is anyone's guess, but for blackmail purposes, that doesn't really matter. Given how the app is marketed, and how pervasive it is throughout gay culture in the US (pretty much everyone in that community at least knows about it, whether they use it or not) just being shown to have an account on the service carries a pretty strong implication that the user is seeking a hookup of some kind. Now imagine if the target is married, or they're a closeted politician... it's pretty easy to see how dangerous the dataset can be from there.
- cptskippy 7y ago
  There's also the matter of device finger printing. If a malicious actor can get you to install a less illicit app that can personally identify you, they can finger print the device and then do the same in Grindr and compare prints to find targets.
malux85 7y ago
Yeah if you're doing dumb string matching. But they have access to all of the photos as well. So index all of the faces and then query it on the face matches, then pull the rest of the chats and dk pics. Yes I know that not everybody sends face pics, but the majority do, and this is good enough to harvest for data.

wbl 7y ago

Luckily (or not) database join with the OPM hack is trivial.

zeta0134 7y ago

I wouldn't be so sure. Grindr tracks users locations pretty precisely, and although many users hide their faces in profile pictures, many more demand a face be sent through direct messages, etc. If you have location and a face, and your target is even remotely popular, some internet sleuthing can put the rest together pretty easily. How much of this can be validated and proven to not be a masquerade (fake pictures / profiles are ridiculously common, as are bot accounts on the platform) is anyone's guess, but for blackmail purposes, that doesn't really matter. Given how the app is marketed, and how pervasive it is throughout gay culture in the US (pretty much everyone in that community at least knows about it, whether they use it or not) just being shown to have an account on the service carries a pretty strong implication that the user is seeking a hookup of some kind. Now imagine if the target is married, or they're a closeted politician... it's pretty easy to see how dangerous the dataset can be from there.

cptskippy 7y ago
There's also the matter of device finger printing. If a malicious actor can get you to install a less illicit app that can personally identify you, they can finger print the device and then do the same in Grindr and compare prints to find targets.

malux85 7y ago

Yeah if you're doing dumb string matching. But they have access to all of the photos as well. So index all of the faces and then query it on the face matches, then pull the rest of the chats and dk pics. Yes I know that not everybody sends face pics, but the majority do, and this is good enough to harvest for data.