9 ms·
Vulnerabilities in the Feeld dating app
- elena567 2y ago[dead]
- deleted 2y ago[deleted]
- throwuxiytayq 2y agoCriminal negligence levels of failure, especially given the category of app.
- ghostpepper 2y agoWow you weren't kidding. These are vulns that would have been embarrassing a decade ago.
- Incipient 2y agoI think the timeline is the more damaging part too. Not only was their design woefully inadequate, they don't seem to care.
- 1_1xdev1 2y agoI used the app briefly a few months prior to their discovery. The app was riddled with bugs. Things like chats not loading (received the push notification, but in the app not visible until force quit/reload). I’m not surprised it took them so long to remediate. I would guess a shoestring contractor dev team.
- xenospn 2y agoThis is what happens when both founders are not technical. I use the app and it was obvious from day one it’s been designed and implemented by the lowest bidder.
- yosito 2y agoNot necessarily the lowest bidder. It's quite easy for a consulting company that is bad at development to make a convincing pitch to a nontechnical founder as long as they're better at sales than they are at development.
- RHSman2 2y agoReplace ‘founder’ with organization
- nailer 2y agoThe founder used attend node.js events in London. Not sure why you think he’s non technical.
- xenospn 2y agoBecause a technical person would immediately find all of the glaring flaws and issues with their app and fix it promptly. Unless they’re incompetent. Which might be worse than non-technical.
- _wbrb 2y agoAttending node.js events does not mean you are technical. A lot of people, I would say most people in my experience, go those events to connect with technical talent.
- itake 2y agoThe problem is they probably don’t have full time developers. They probably built the app once years ago via a dev shop and then never updated it again. The talent moved on and updating it is expensive now.
- benoau 2y agoCost minimizing aligns well with the criminal-negligence theory. In fact every egregious security issue I've come across, like plain text passwords, public S3 buckets, publicly-accessible internal tools... it all directly correlates to being cheap in my experience.
- forgotacc240419 2y agoThey had turnover of £39m last year and profits of £5.5m (double the previous year, quite good for a UK business of this scale). If they don't have full time devs it'll be shocking, certainly had the money to sort crap like this out
- tirpen 2y agoThey (or someone they hired) actually rewrote their whole app about a year ago, I remember seeing lots of people complaining about how much worse and buggier it got after the rewrite. I have no idea if the back end was also replaced then or if the vulnerabilities were present in the previous version as well.
- aitchnyu 2y agoI was that cheap contractor. My bosses were oblivious to anything but schedule and bugs surfacing to the client's reviewer. Guess threats of imprisonment in US and EU and data and insurance for data (if photos are not suitable for LinkedIn, you pay eye-watering prices) will be only deterrent. Of course, the incentives shouldn't promote coverups.
- a091 2y agointeresting read - anyone have pointers to other app pentesting walk throughs like this?
- mjg59 2y agoI wrote up finding some of these issues entirely independently: https://mjg59.dreamwidth.org/70061.html https://mjg59.dreamwidth.org/70061.html
- qingcharles 2y agoSo the question is -- how many others knew about this and were exploiting it without discussing it? :(
- mjg59 2y agoGreat question that would ideally be asked of the people who have logs
- forgotacc240419 2y agoI didn't exactly know of it but I had enough glitches on that terrible app when I was using it that it was obvious there was info being sent that it didn't mean to and some atrocious performance issues that made it feel like it was crudely thrown together Pretty sure I flagged something or another as a security issue but can't recall what it was
- bawolff 2y agoFor pentesting, often the company hires people to test under an NDA, and keep everything secret because they dont want to be embarassed. There are sone public pentests out there. For example https://www.opentech.fund/impact/security-safety-audits/ https://www.opentech.fund/impact/security-safety-audits/ If you want to read some really hard core security vuln hunting, see https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/
- ramimac 2y agohttps://github.com/juliocesarfort/public-pentesting-reports https://github.com/juliocesarfort/public-pentesting-reports is a substantial collection of public reports Off the top of my head, DoyenSec has some good reports in there targeting web apps
- Cu3PO42 2y agoIt seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere. While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit. Edit: the solution "check all permissions on the backend" reminds me of the solution to buffer overflows: "just add bounds checks everywhere". It's clear to the community at large what needs to be done, but getting everyone to apply this consistently is... not so easy.
- dangsux 2y ago[dead]
- dfedbeef 2y agoYou shouldn't be touching the server-side code if you find this hard to keep straight.
- Cu3PO42 2y agoUltimately, I don't disagree. However, I also try to make it a habit to not blame people for not knowing something. This presents as a structural problem in that company: they needed to hire people who do know how to secure server code and put them into a position to do so. Blame the company and those who decided to save every last penny in personnel cost.
- valenterry 2y agoYeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.
- hackernewds 2y agoright*
- 2y ago
- MaxDorkroom 2y ago[flagged]
- deleted 2y ago[deleted]
- egamirorrim 2y agoWow. Remarkably responsible, and compassionate, disclosure.
- hackernewds 2y agoActions don't match words.
- leg100 2y agoWhat? They did hold off. Their actions matched their words.
- arraypad 2y agoHave they included real profiles in the screenshots of the "Discover profiles" menu and the list of likes? If so that's pretty irresponsible even with the faces obscured.
- fire_lake 2y agoGod damn it. People deserve better than this. Almost inclined to take a pay cut to go and fix this mess.
- tdeck 2y agoHowever little you're willing to take they can hire a less competent person cheaper.
- fire_lake 2y agoYou would hope that a mission driven company like them would care. Or at least, a profit driven company would care about scaring away users.
- shiroiushi 2y agoAs decades of Windows blue screens proved, shitty software won't scare away users if the software can provide a service or capability that the users can't easily get elsewhere.
- greybox 2y agoThey don't need your charity, they need to be fined
- jrm4 2y agoAnd the fact that this, the literal only solution that has any chance of succeeding, is this far buried down in the comments, says so much about this industry.
- 0xbadcafebee 2y agoI am honestly amazed that these researchers held off for as long as they did on publishing. If crappy startups are given 6 months to close egregiously bad privacy holes like this, they will continue to abuse the privilege they have in collecting this information to begin with. I say give them 2 months and then release. Fuckers need to learn not to play dice with people's private information.
- qingcharles 2y agoThe question is -- did others know about it? e.g. https://news.ycombinator.com/item?id=41517747 https://news.ycombinator.com/item?id=41517747
- tgv 2y agoAnd that’s a very good reason never to fill in exact personal data, e.g. date of birth. Especially dating apps seem to need them, but don’t do it. Fill in something within a year or so from your real birthday. And while this dating app isn’t well known, it caters to people with different tastes (such as bdsm and group sex) and queer people. Needless to say that this is very sensitive in many parts of the world.
- marcus_holmes 2y agoHot take: this is a problem with GraphQL. GraphQL allows your front-end to query your data. Which is cool. But from the backend this is all really opaque (and usually implemented by a 3rd party library that has no idea about your access control). Unless you're going to implement your access control in the database itself (not the worst idea, certainly better than doing it in the front end), then it's very hard to unwrap the GraphQL query in backend code to work out exactly what records should be returned/restricted. Implementing decent access control in the backend means understanding the query and implementing a whole set of models/classes/functions/whatever that grok the database schema and can make decisions about "if the user_id is XXX then it can/cannot see this image in this context" [0]. They obviously implemented this in the front end because that's a lot easier with GraphQL. I'm not saying this is a good implementation of GraphQL and that therefore the problem lies with GraphQL exclusively. I'm saying that GraphQL makes this mistake easier to make because it explicitly tries to remove the need for the backend to understand the query and so makes this kind of complex security situation harder. [0] e.g. a specific image may be publicly accessible from the user's profile, or only available to matches, or only in a chat context (but not group chats), and inaccessible at any time from blocked users, etc. You can easily come up with a bunch of complex edge cases for just this one case.
- strken 2y agoIt's pretty easy. Treat each resolver that retrieves data like it's a REST endpoint and secure it, and add a query allowlist that you append items to during your CI builds. You don't need to touch the AST or understand the context of the rest of the query. Just answer the question "can user ABC see the photos of user XYZ?" in the resolver that fetches the photos. If this is inefficient then prefetch some data or use a dataloader. Now, if you're using some magic library that turns GraphQL into SQL, that's going to be different.
- dangsux 2y ago[dead]
- mewpmewp2 2y agoStill I think this type of thing is much more likely to happen with GraphQL including various N + 1 and even worse performance issues. Like if you imagine having junior engs they will be much more likely to make the mistake with GraphQL than otherwise and it is harder to review as well. The permissions checking becomes a real spaghetti and difficult to understand in practice compared to just one by one checks.
- intothemild 2y agoThey were in the press a lot this week, but for earning money. https://www.theguardian.com/technology/article/2024/sep/08/throuples-dating-app-feeld-nearly-doubles-turnover-to-395m https://www.theguardian.com/technology/article/2024/sep/08/t...
- advael 2y agoIt's been observed by many that making bad things seems to be a lot more profitable these days than making good things
- dotps1 2y agoIt's always been like that. The costs involved with maintaining garbage are infinitely more than maintaining something well built. This is why software is so lucrative.. because the true cost of the software isn't how much you pay for it .. it's "how much is it going to cost you to change to something else?"
- advael 2y agoA great argument against relying on any software you can't control if ever I heard one
- rkachowski 2y agothe costs of maintaining something well built that no-one uses are very low indeed. unfortunately trash is cheaper and faster, and it takes a certain kind of genius insanity to sell something well built that doesn't exist yet.
- gregoriol 2y agoIt's not making bad, it's making cheaper/faster. They probably hired less experimented developers or didn't give them proper time to implement the features they wanted.
- advael 2y ago
- zx8080 2y agoIt's hard to expect any improvement while the personal data insecurity is tolerated without any penalty or fines.
- Coolbeanstoo 2y agoI'm not terribly surprised. I use it but would describe it as incompetently put together as my bank app? maybe worse, it barley functions at all. I dont know how they managed it.
- forgotacc240419 2y agoIt was so bad when I used it, if it wasn't bizarre memory leak or privacy issues it was extremely poorly executed UX. Between it and Fetlife there's some huge issues with those communities just sticking with the first app that emerges regardless of quality
- fire_lake 2y agoGiven the overlap between those communities and OSS people I’m amazed no one has created a B Corp that does this stuff right.
- forgotacc240419 2y agoNo one migrates from the first big thing so it's a waste of time. Feeld should be killed by this and it'll barely make a dint
- deleted 2y ago[deleted]
- NoGravitas 2y agoWhen I used it, I enjoyed the community, but the app was never competently written. Then a while back they had a flag day where they rolled out a new app and a new server to everyone all at once, and most people were not able to log in; those that were lost their premium perks if they were paying customers, likes and chats got lost, etc. I was never actually able to log in, and just dropped the app at that point.
- wasma 2y agoWho do you trust? Would tinder and bumble have the same mindset?
- INTPenis 2y agoThe for-profit dating scene is a quagmire. Sure it can work, I've seen it work, but at what cost? We desperately need a new platform owned and operated by the people, for the people.
- rollcat 2y agoHey, sign me up. Outside the "necessary evil" trade-offs inherent to facilitating one-on-one meetups, I would really love a platform that treats people like people, not cattle to be milked for money.
- energy123 2y agoThe Tokyo government is trying that: https://www.cnbc.com/2024/06/07/japan-pushes-citizens-toward-dating-apps-to-boost-birth-rates.html https://www.cnbc.com/2024/06/07/japan-pushes-citizens-toward...
- rollcat 2y agoApplies to all dating apps, really: just treat any info you put in your profile as 100% public, for anyone, worldwide. Location is easily faked, other filtering options are about as effective as a lone "do not enter" sign with no fence - I can put any info I like into my profile to fit your criteria and have you show up in my feed. Chats? The only IM apps with functional E2EE are: Signal, iMessage, WhatsApp; and even those have trade-offs. Treat everything else as readable by some third party, and dating apps by design need to be able to look into people's chats to be able to handle harassment cases. That of course is no excuse for having gaping security/privacy holes, but you're trading off quite a bit of privacy by design; it's like meeting in a public space where you can feel a little bit safer with someone you don't know yet. I'd say if you're concerned with any of that, go meet new people IRL, but there are 100% legitimate cases where this is not the most effective strategy (e.g. Feeld's primary target audience).
- mikkelam 2y agoThis is pretty funny. I've been abusing this shitty API for a while to see who likes me in this dating app. I didn't realise the problems were this bad. They've had massive issues with their tech stack from a user POV. I've multiple times had my phone running incredibly hot while using it.
- throwaway-xdfef 2y agoIt gets worse. As of this moment it's impossible to delete your account data due to errors. (Ask me how I know)
- Throwaway123129 2y agoUseful context is that they completely redid the app from scratch in 2023 using a contractor instead of in house developers and the launch was not very smooth https://mashable.com/article/feeld-app-down https://mashable.com/article/feeld-app-down
- Ekaros 2y agoSaddest part is that this sort of stuff or at least not proper authorization checks is very common. I do not really know what is the solution at this point. Clearly not enough developers care. Or can stop it... Is it education problem? If so if there was training budget a day or two running against some simple capture the flag exercise might do a lot...
- Klonoar 2y agoAnybody who's ever used this app is probably not surprised to hear this. It's been a shitshow since day one, one of the buggiest apps I think I've ever used. Even with a full redesign/rebuild over the past year it still is nothing but glitchy software.
- elric 2y agoThe online dating space (I use the term liberally) is a huge fucking mess. There's only 2 or 3 companies with an offering that is anywhere near useful, and they're either evil, incompetent, or both. Maybe it's time for an open source federated dating service or something. Or at least something that doesn't sell your data, doesn't leak your nudes, or doesn't get you beaten up/raped/murdered. Probably easier said than done.
- ChiperSoft 2y agoI’ve been conceptualizing one for a few years, but just don’t have the free dopamine to build it alongside my day job. ActivityPub even has the mechanics to facilitate it through publishing Person records. There is MASSIVE space for innovation, especially if you prioritize on non-monogamy, non-heterosexual, non-gender-conforming needs. Dating apps are a REALLY hard space to get into, however. You need a cumulative mass of users in a given area before they’re useful, and monetizing it inevitably means making the app less useful. There’s a reason okcupid went to shit after it stopped being a non-profit. And then there’s the moderation problem…
- diggan 2y agoNow you've piqued my interest, especially if it could be done in a safe but distributed way, without a focus on profits. How you'd envision it to work, considering the open nature of ActivityPub but the need/want from the users to remain private when using dating applications/protocols?
- ChiperSoft 2y agoProfile data can be restricted based on authorized fetch, just like mastodon. For messaging, I hadn’t put a much thought into it, but one could establish end to end encryption based on mutual validation signatures. Theoretically. Encryption isn’t my strong suit, but as long as the encoded body is unicode, it’s just as easy to transmit as any other text. But, like, I also don’t know of any dating site that professes to be encrypting message contents.
- 2y ago
- greybox 2y agoThis is utterly horrifying, clearly absolutely zero thought was put into security at all. I'm a game developer and we put more effort into keeping our game fair than this company does in keeping it's users safe. They should be sued into oblivion.
- forgotacc240419 2y agoZero thought was put into anything. Before I realised the app was a buggy mess I was very surprised to see it had an interests section that provided no context for the interests. For example: virtually everyone had Domination or Submission as one of their interests but no context whatsoever of which role they wanted. To not realise how fundamentally wrong this is for that scene implies they're clueless across the board.
- tgv 2y agoDo note that profiles in a dating app are in principle accessible to everyone. You open the app, profiles appear. There's no ACL or anything like that. Messages and private pictures is another matter.
- stef25 2y ago> View other people’s matches "BRB going to slaughter everyone my wife has chatted to" Hard to believe the levels of incompetence here They have investor funding ... how come no due diligence was done ?
- elena567 2y ago[dead]
- throwaway-xdfef 2y ago(This is a throwaway account but I've been on HN for a decade) I just read this and attempted to delete mine and my partners profile data. The process is currently totally broken in-app. There is no way to proceed past a certain point. There's nothing self-identifying about us in the app but still.... I'm furious.
- spiffytech 2y agoWith an article like this, it wouldn't surprise me if there's still a way to delete your data if you intercept the network traffic!
- bogdan_t 2y agoEasy to understand explanation: https://www.instagram.com/p/C_-8CdRpo86/ https://www.instagram.com/p/C_-8CdRpo86/ The Guardian article: https://www.theguardian.com/business/2024/sep/17/dating-app-feeld-personal-data-cybersecurity https://www.theguardian.com/business/2024/sep/17/dating-app-...
- lewiswood 2y ago[dead]