13 ms·

I hacked a dating app (and how not to treat a security researcher)

570 points by bearsyankees 1y ago

swyx 1y ago
> Since then, I have reached out multiple times (on March 5 and March 13) seeking updates on remediation and user notification plans. Unfortunately, as of today’s publication date (April 21, 2025), I have been met with radio silence. To my knowledge, Cerca has not publicly acknowledged this incident or informed users about this vulnerability, despite their earlier assurances to me. They also never followed up with me following our call and ignored all my follow up emails. there can always be another side to this story but also wtf. this kind of shit makes me want to charles-proxy every new app i run because who knows what security any random startup has
- deleted 1y ago
  [deleted]
- genewitch 1y ago
  I'd not heard of Charles Proxy nor gobuster. Years ago there was a firmware for mango travel routers that let you MITM anything connected to it, and i bought two of them, and then the information about how to set it up disappeared (i can't find it). the GL.iNet mango travel routers, is what i mean. I have one wireguarded with the switch set to shut off access or wireguard only; the other one is for IOT devices and is connected via 10mbit, so even if someone managed to hack one of the two IOT things here they couldn't exfil very much, and i'd notice the blinking.
  - andrewmcwatters 1y ago
    Charles Proxy has been in the industry for many years now. It's a common tool for basic reverse engineering.
    - nerdsniper 1y ago
      Somewhat downplaying it. Charles is easily the most popular tool for reverse engineering client-server communications in mobile apps. Certificate pinning frustrates Charles by hampering MITM attempts. It can be difficult to extract/replace pinned certificates from the latest versions of Android/iOS apps. Often you can extract them from older versions using specialized tools, if old-enough versions exist and those certificates are still valid for API endpoints of interest.
      - andrewmcwatters 1y ago
        Yeah, I definitely did. lol It's like saying IDA Pro is just an interesting piece of software for looking at binaries, but the grandparent comment is surely from someone who doesn't look at these utilities, so I guess that's why I didn't press it.
xutopia 1y ago
That's crazy to not have responded to his repeated requests!
- benzible 1y ago
  As someone managing a relatively low-profile SaaS app, I get constant reports from "security researchers" who just ran automated vulnerability scanners and are seeking bounties on minor issues. That said, it's inexcusable - they absolutely need to take these reports seriously and distinguish between scanner spam and legitimate security research like this. Update: obviously I just skimmed this, per responses below.
  - bee_rider 1y ago
    It sounds like they actually met with him, patched the issues, and then didn’t respond afterwards. IMO that is quite rude of them toward him, but they do seem to have taken the issue itself somewhat seriously.
    - benzible 1y ago
      Ah, sorry, I need to actually read things before I react :)
  - sshine 1y ago
    They already met with him and acknowledged the problem. So their lack of follow-up is an attempt to push things under the rug. Users deserve to know that their data was compromised. In some places of the world it is a crime to not report a data leak.
  - nick238 1y ago
    Pardon sir, I see you have: * Port 443 exposed to the internets. This can allow attackers to gain access to information you have. $10k fee for discovery * Your port 443 responds with "Server: AmazonS3" header. This can allow attackers to identify your hosting company. $10k fee for discovery. Please remit payment and we will offer instructions for remediation.
soco 1y ago
It doesn't even look that they tried to secure anything initially. Security by design? Ha.
sherdil2022 1y ago
They might not have a playbook on how to handle such reports. Doesn’t mean they shouldn’t respond. They are also probably sh*t scared about legal ramifications - but not responding only makes them look even worse. None-the-less it is amazing how many of these products and services don’t put security and user privacy first. Open for discussion - What would make them pay attention?
- camcil 1y ago
  Affecting their bottom-line via litigation, less usage, whatever...
- bravoetch 1y ago
  I think most companies have a weak playbook for this kind of interaction. I once bought a product (and I'm going to be deliberately vague) from a company whose customers are mostly very famous people around the globe. The URL for my order included the order number, and that page showed everything about my order and my PII. Naturally I tried changing the order number, and wowzers I was able to see emails, phones, addresses, contacts for the PA/agent and sometimes direct contact info for the ordering party. When I contacted the company about this, they didn't thank me or really acknowledge the problem. They fixed it about a month later by requiring login to view order URLs. I feel like they should have let their customers know all their PII data was exposed - I know they didn't, I never got such a notification.
- squigz 1y ago
  Fines that are enough to actually hurt, and regulations that force companies to actually secure PII. If they're scared of such things, then maybe they shouldn't be making and marketing a dating app. It's not 2003 anymore, and this isn't some innocent app - they're collecting information on passports and sexual preferences for thousands of people. They should be aware of the responsibility that ought to come with that.
tuwtuwtuwtuw 1y ago
I m not sure I understand properly. Did he try to hack a random service he encountered? Is that even legal? Where I live (Sweden) it's definitely not legal.
- janalsncm 1y ago
  If only all hackers lived in jurisdictions which enforce anti-hacking laws. If I am making an app, I’m not going to rely on the police to enforce cybersecurity.
- bink 1y ago
  It's become a bit of a grey area thanks to most large companies having bug bounty programs now. I think some researchers just assume that all companies are OK with testing against their production services. IMHO it's almost certainly illegal, but simply won't be enforced unless the hacker/researcher does something malicious.
- charcircuit 1y ago
  It's not legal in America either. And he is posting with what may be his real name which adds extra risk.
  - bee_rider 1y ago
    I’m not in security (thank goodness, it sounds like a legal minefield). It sounds like this system was so wildly insecure that… I actually kinda wonder what laws specifically he broke. If you just text out passwords to anybody who asks, are they really doing unauthorized access? Lol. I’m sure it was illegal somehow, though.
    - carefulfungi 1y ago
      It is very likely illegal but also discouraged to be prosecuted. From the federal government's guidelines on prosecuting unauthorized computer access (https://www.justice.gov/jm/jm-9-48000-computer-fraud https://www.justice.gov/jm/jm-9-48000-computer-fraud): > "The attorney for the government should decline prosecution if available evidence shows the defendant’s conduct consisted of, and the defendant intended, good-faith security research."
deleted 1y ago
[deleted]
camcil 1y ago
In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure. They may have "patched" the ability to exploit it in this way, but the plaintext data is still there in that same fragile architecture and still being handled by the same org that made all of these same fundamental mistakes in the first place. Yikes.
- hiatus 1y ago
  > In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure. As you are probably well aware, we do not live in that world. Companies like Equifax can suffer breaches exposing the personal information of millions and stock still goes up.
  - baxtr 1y ago
    PII data breaches, especially PHI data can lead to high financial losses, mostly in the US through litigation. Fines in the EU are low in comparison. Companies don’t like to talk about this, and they bury these costs deep down in their financial statements. But trust me, they’re quite substantial.
    - senderista 1y ago
      If that's true, then stock prices should reflect that. But that's not what we see after major PII breaches at publicly traded companies.
      - baxtr 1y ago
        So you have seen the failure of Apple’s car project in their stock price?
  - CobrastanJorji 1y ago
    Sorry about that. Please fill out this class action postcard, and, if approved, you will receive up to two years of identity protection services provided by Equifax (to be served concurrently with any other court-ordered two years of identity protection services), or, if you have financial damages you can conclusively prove are directly linked to this specific identity disclosure, you may mail your evidence to the provided address for up to $1000 in restitution, pending arbitration.
9283409232 1y ago
There's no penalty for failing at privacy and security so companies would rather play the odds that they will be fine than invest in proper practices. Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it. In a more just world, this would trigger so many regulatory and compliance audits.
- mooreds 1y ago
  > There's no penalty for failing at privacy and security I wouldn't say there's no penalty (they might have to pay for a year of identity theft protection or a fine). I agree that the consequences are not in line with the damage to the public or customer base.
- MaKey 1y ago
  The GDPR allows for huge fines, so for companies operating in Europe there is an incentive to take privacy and security seriously.
  - brazzy 1y ago
    Namely, up to 20 million EUR or 4% of the previous year's revenue, whichever is larger.
- thesuitonym 1y ago
  > Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it. Trasmitting information via HTTPS is usually enough to say your app uses "encryption and other industry-standard measures to protect your data."
edm0nd 1y ago
> I have been met with radio silence. Thats when its time to inform them you are dumping the vuln to the public in 90 days due to their silence.
- 9283409232 1y ago
  Good way to get yourself sued and have possible criminal charges brought up to you.
  - b8 1y ago
    Which has never happened before and if it does then the EFF would back you presumably.
    - 9283409232 1y ago
      This is a completely uninformed comment. Security researchers get sued or threatened all the time. Bunnie was threatened by Microsoft for publishing his research on Xbox vulnerabilities, the city of Columbus sued David Ross for his reporting on data exposed during a ransomware attack, Google has threatened action against a few security researchers if memory serves and that is just what I can remember off the top of my head.
      - secalex 1y ago
        Agreed. I've been doing this for 25+ years and personally know a dozen people who have been threatened and several who have been sued or faced potential prosecution for legitimate security research. I've experienced both situations! That doesn't make it right, and the treatment of the researcher here was completely inappropriate, but telling young researchers to just go full disclosure without being careful about documentation, legal advice and staying within the various legal lines is itself irresponsible.
      - tptacek 1y ago
        I've spent my entire career doing this, have been personally "threatened" several times, and until relatively recently kept track of researchers dealing with legal threats. The concern is overblown. In cases that go beyond a nastygram from a lawyer, it is almost always the fact pattern that some aggravating factor is present: a consulting agreement that initiated the testing and forecloses disclosure, or the preservation and/or publication of the PII itself, or attempts to pivot and persist access after finding a vulnerability. It's an especially superficial argument on this story, where the underlying vulnerability has essentially already been disclosed.
blantonl 1y ago
Returning the OTP in the request API response is wild. Like why?
- mooreds 1y ago
  I too am bewildered. Maybe to make it easier to build the form accepting the OTP? Oversight? I can't think of any other reasons.
  - Vuska 1y ago
    Oversight. Frameworks tend to make it easy to make an API endpoint by casting your model to JSON or something, but it's easy to forget you need to make specific fields hidden.
  - ksala_ 1y ago
    My best guess would be some form of testing before they added sending the "sending a message" part to the API. Build the OTP logic, the scaffolding... and add a way to make sure it returns what you expect. But yes absolutely wild.
  - Alex-Programs 1y ago
    I assume that whoever wrote it just has absolutely no mental model of security, has never been on the attacking side or realised that clients can't be trusted, and only implemented the OTP authentication because they were "going through the motions" that they'd seen other people implement.
    - ceejayoz 1y ago
      https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult
    - pixl97 1y ago
      Everyone that programs should take blackhat classes of some kind. I talk to so many programmers that really don't understand what hackers/attackers can actually do.
bearsyankees 1y ago
https://yaledailynews.com/blog/2025/04/24/yale-student-exposes-data-leak-in-college-dating-app/ https://yaledailynews.com/blog/2025/04/24/yale-student-expos... ^another article on this
- ahaferburg 1y ago
  > Developers should use best practices, but they may not be sufficient, he added. “Keeping data secure is an unsolved problem,” he said. Oh, ok. Too bad, I guess.
michaelteter 1y ago
Not excusing this is any way, but this app is apparently a fairly junior effort by university students. While it should make every effort to follow good security (and communication) practices, I'd not be too hard on them considering how some big VC funded "adult" companies behave when presented with similar challenges. https://georgetownvoice.com/2025/04/06/georgetown-students-create-cerca-a-new-dating-app-that-swipes-right-on-safety/ https://georgetownvoice.com/2025/04/06/georgetown-students-c...
- peterldowns 1y ago
  I hear you but if you're processing passports and sexual preferences you have to at least respond to the security researcher telling you how you're leaking them to absolutely anyone. This is a total clusterfuck and there are zero excuses for the lack of security here.
- genewitch 1y ago
  i have an idea, if you don't know anything about app security, don't make an app. "Whataboutism" not-withstanding, this actually made me feel a little ill, and your comment didn't help. I have younger friends that use dating sites and having their information exposed to whoever wants it is gross, and the people who made it should feel bad. They should feel bad about not communicating with the "researcher" after the fact, too. If i had been blown off by a "company" after telling them everything was wide open to the world for the taking, the resulting "blog post" would not be so polite. STOP. MAKING. APPS.
  - dylan604 1y ago
    Stop pushing POCs into PROD. There's nothing wrong with making your POC/MVP with all of the cool logic that shows what the app will do. That's usually done to gain funding of some sort, but before releasing. Part of the releasing stage should be a revamped/weaponized version of the POC, and not the damn POC itself. The weaponized version should have security stuff added. That's much better than telling people stop making apps.
    - 1y ago
koakuma-chan 1y ago
I thought Apple was checking apps? How did this go through? In any sane jurisdiction exposing PII like that is illegal.
- hackan 1y ago
  nobody does a free security checkup xD not even apple
  - tough 1y ago
    free? I thought they still had their 30% racket and wait while we review 3 months pipeline going for their walled gardens
    - hackan 1y ago
      yeah, no. security evaluations cost a ton, and they take time. apple is doing nothing at all, just charging for being in a premium market.
      - nixpulvis 1y ago
        "Premium" Apps on the app store are hardly much better than anywhere else.
        tough 1y ago
        The "premium" presumably is the market apple's commands and nobody else's does iOS users still spend more dollars per average in apps than android ones even if android has more users i think ?
        nixpulvis 1y ago
        Also true. But it's just sad to see the average quality of an app has gone way down over the years.
      - 1y ago
nixpulvis 1y ago
People need to be forced to think twice before taking in such sensitive information as a passport or even just addresses. This sort of thing cannot be allowed to be brushed off as just a bunch of kids making an app.
- koakuma-chan 1y ago
  Were they not using some kind of third party identity verification service? That's what I usually see apps do. Don't tell me those third party services still share your ID with the app (like the actual images)?
  - nixpulvis 1y ago
    Read the article. They clearly have their own OTP setup. But if they are asking for your passport, then they have access to it. It's not a third party asking and providing them with some checkmark or other reduced risk data.
    - koakuma-chan 1y ago
      I have read the article and OTP has nothing to do with identity verification. I'm asking because every single time I went through identity verification the app used a third party service that is supposed to be trustworthy.
      - nixpulvis 1y ago
        I see what you mean. But they literally had passport front/back URLs, so they aren't using a third party for that either.
- jonny_eh 1y ago
  There should to be some kind of government operated identity confirmation service that is secure/private. Or by someone "government-like" such as Apple or Google.
12_throw_away 1y ago
Hot take: just like real engineers, there should be a Software Engineer licensing exam that's legally required before you can handle PII ... because this is the alternative. Before I was allowed to hand out juice cups at my kids' preschool, I had to do a 2 hour food safety course and was subject to periodic inspections. That is infinity% more oversight than I received when storing highly sensitive information for ~10^5 users.
- aDyslecticCrow 1y ago
  A few European countries' "masters of computer science" is just a normal "engineering" degree with a focus on software for any speciality credits. I can call myself an "engineer", even though my software profession does not value the distinction. Though I'm sceptical it would help. API design is generally not taught in university courses, and perhaps shouldn't (too specific). I instead feel that GDPR has already done a lot of heavy lifting. By raising the price of "find out", people got a bit more careful about the "fuck around" part. It seems to push companies to take it seriously. The step two is forcing companies to take security breaches and security disclosures seriously, which CRA (Cyber Resilience Act) may help.... at the cost of swamps of byrocratic overhead that is also included ofcourse.
  - pixl97 1y ago
    Bureaucracy is the cost of human laziness... I mean, do you trust that the chemical industry will self regulate and keep dangerous chemicals out of your drinking water? Then why do we trust software companies to keep you and your data safe? We will get more regulations over time no matter how much we complain about it because people are rather lazy at the end of the day and more money for less work is a powerful motivator.
    - aDyslecticCrow 1y ago
      Ye. It's unfortunate that companies cannot responsibly do the proper thing on their own. Though I wanna raise that, CRA may be an unfathomably high bureaucratic load on software companies. If it were just about security disclosure, it would be quite manageable. As it is formulated in its current form, CRA sets the general software development industry... to the current industrial automation and automotive standards; which is absurd.
mtlynch 1y ago
This is a pretty confusing writeup. >First things first, let’s log in. They only use OTP-based sign in (just text a code to your phone number), so I went to check the response from triggering the one-time password. BOOM – the OTP is directly in the response, meaning anyone’s account can be accessed with just their phone number. They don't explain it, but I'm assuming that the API is something like api.cercadating.com/otp/<phone-number>, so you can guess phone numbers and get OTP codes even if you don't control the phone numbers. >The script basically just counted how many valid users it saw; if after 1,000 consecutive IDs it found none, then it stopped. So there could be more out there (Cerca themselves claimed 10k users in the first week), but I was able to find 6,117 users, 207 who had put their ID information in, and 19 who claimed to be Yale students. I don't know if the author realizes how risky this is, but this is basically what weev did to breach AT&T, and he went to prison for it.[0] Granted, that was a much bigger company and a larger breach, but I still wouldn't boast publicly about exploiting a security hole and accessing the data of thousands of users without authorization. I'm not judging the morality, as I think there should be room for security researchers to raise alarms, but I don't know if the author realizes that the law is very much biased against security researchers. [0] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_email_address_leak https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...
- tptacek 1y ago
  Read the original complaint in the Auernheimer case. Prosecutors had (extensive) intent evidence that is unlikely to exist here. The defendants in that case were also accused of disclosing the underlying PII, which is not something that appears to have happened here.
  - mtlynch 1y ago
    Yeah, I agree Auernheimer was a much more attractive target for prosecution, but do you think this student is legally safe in what they're doing here?
    - tptacek 1y ago
      I would personally not scrape the endpoint to collect statistics and inform the severity estimation, but I'm a lot more risk averse than most. But prosecution of good-faith security research is disfavored, so as long as you don't do anything to breach the assumption of good faith (as defendants in the trial you mentioned repeatedly did) I think you're probably fine. The bigger thing is just that there's no actual win in scraping here. It doesn't make the vulnerability report any more interesting; it just reads like they're trying to make the whole thing newsier. Some (very small) risk, zero reward.
some_furry 1y ago
https://archive.ph/rOQVe https://archive.ph/rOQVe
phyzix5761 1y ago
Imagine every time you entered a specific physical location you would increase your exposure to a detrimental disease. After only entering a couple of times you've contracted this disease and each subsequent visit to this place makes the illness worse. A few people try to warn you but you choose not to listen and, in fact, you recruit the government to make it easier to enter such places with safeguards that don't actually protect you from the disease and encourage you to enter more frequently. You're then surprised why you're ill to the brink of death and blame the location as the sole cause for your ails. Yes, the location is to blame but so are you for continuing to enter even after getting sick. Why do you do this? Because you want something. Convenience, pleasure, a distraction, etc. But you refuse to acknowledge that its killing you. This is how we should view optional services that require us to give our PII data in exchange for hours of attention-grabbing content. They're designed to sell your eyeballs and data to advertisers. You know this already but you can't say no. You're sick and refuse to acknowledge it.
- bongodongobob 1y ago
  But a dating app specifically needs all kinds of personal info. That's like, what it's for.
  - phyzix5761 1y ago
    But its your choice to use it right?
    - kube-system 1y ago
      Yes, it is your choice to contract with another party who agrees to keep your information secure. However, it is also their fault when they do not uphold their agreement.
- RussianCow 1y ago
  > This is how we should view optional services that require us to give our PII data in exchange for hours of attention-grabbing content. This is a nice fantasy, but realistically it means you shouldn't use probably 90% of services out there, which isn't reasonable for most people. Plus, there are plenty of companies with treasure troves full of data on you that have equally questionable data security/privacy practices that you've never even directly interacted with. We need regulation. There is no other alternative. And we need to stop blaming victims of data breaches for companies not putting basic security measures in place. I don't think it's unreasonable to expect every company you interact with to securely store your sensitive data. If a place was physically making people ill like in your thought experiment, they wouldn't be around for very long; I think we should demand the same for our data.
voytec 1y ago
I'm flagging this submission. Look at the author[0], at the "Georgetown students..." (won't backlink again) post linked below stating that Cerca was 2 months old in April, and OP's post from April stating that they hacked this thing two months earlier. It's some self-promo or whatever scheme/scam bullshit. [0] https://news.ycombinator.com/from?site=alexschapiro.com https://news.ycombinator.com/from?site=alexschapiro.com
- bearsyankees 1y ago
  Hi author here! Not exactly sure what you are talking about — I think I found this vulnerability pretty close to when the app first went public but not sure why that makes it a scam And I posted this blog because I think people will find it interesting! Happy to answer any other questions when I get back to my computer :)
  - bearsyankees 1y ago
    (Also more info here: https://yaledailynews.com/blog/2025/04/24/yale-student-exposes-data-leak-in-college-dating-app/ https://yaledailynews.com/blog/2025/04/24/yale-student-expos...)
- nik_0_0 1y ago
  Posting the same link 4 times in 18 days, by the author, certainly seems like self-promo, but somehow allowed? I don't see any URL manipulation, and it certainly took off today. (I found it interesting!) A&B testing of post names seems to lead some useful information ;) I don't see your reference to "Georgetown students..." in either the website link or the user's submissions? Was it modified?
  - bearsyankees 1y ago
    Glad you found it interesting, yeah I was experimenting with different names and obviously this one was the best. Not trying to self-promo as I am not like selling any product but just thought people would enjoy the article! Sorry if I violated any of the unwritten HN norms... but glad people are reading it now and having interesting discussions
andrelaszlo 1y ago
Oops! Nice find! To limit his legal exposure as a researcher, I think it would have been enough to create a second account (or ask a friend to create a profile and get their consent to access it). You don't have to actually scrape the data to prove that there's an enumeration issue. Say your id is 12345, and your friend signs up and gets id 12357 - that should be enough to prove that you can find the id and access the profile of any user. As others have said, accessing that much PII of other users is not necessary for verifying and disclosing the vulnerability.
- ofjcihen 1y ago
  This is the standard and obvious way to go about things that most security researchers ignore. While you can definitely want PII protected and scrape data to prove a point it’s unnecessary and hypocritical.
  - strunz 1y ago
    Eh, part of assessing the vulnerability is how deep it goes. Showing that there were no gates or roadblocks to accessing all the data is a valid thing to research, otherwise they can later say "oh we hade rate limiting in place" or "we had network vulnerability scanners which would've prevented a wholesale leak".
    - ofjcihen 1y ago
      That’s not how web app vulnerabilities work and it would be easy to counter that handwaving with “hackers know what FireProx is”.
      - SeaScythes 1y ago
        Hey there--pentester, security researcher, and bug bounty hunter here. "Demonstrating impact" is common practice. The presence (or non-presence) of rate limiting controls, such as those alluded to by the commenter above, can play into the risk assigned to a vulnerability, and may be difficult to ascertain without actually attempting an otherwise theoretical attack. This also has the effect of indicating whether the target has adequate detection capabilities, which is important information. Demonstrating impact is also just sometimes necessary to convey urgency to leadership; hand waving is common. Alternatively, some organizations may silently patch without performing a responsible disclosure, such as was the case with this article. Having hard proof that the attack was 1) viable and 2) not detected is critical information in the event that you must disclose to the public. As an aside, from your history: > My one gripe with HN is that people say incorrect things with complete confidence pretty regularly and you can only Detect it if you know the subject matter. Welcome to being part of the problem. Remember the feeling.
SpaceL10n 1y ago
I worry about my own liability sometimes as an engineer at a small company. So many businesses operate outside of regulated industries where PCI or HIPAA don't apply. For smaller organizations, security is just an engineering concern - not an organizational mandate. The product team is focused on the features, the PM is focused on the timeline, QA is focused on finding bugs, and it goes on and on, but rarely is there a voice of reason speaking about security. Engineers are expected to deliver tasks on the board and litte else. If the engineers can make the product secure without hurting the timeline, then great. If not, the engineers end up catching heat from the PM or whomever. They'll say things like... "Well, how long will that take?" or, "What's really the risk of that happening?" or, "We can secure it later, let's just get the MVP out to the customer now" So, as an employee, I do what my employer asks of me. But, if somebody sues my employer because of some hack or data breach, am I going to be personally liable because I'm the only one who "should have known better"?
- hiatus 1y ago
  Are you an officer of the company? If not I would not think you could be personally liable.
- sailfast 1y ago
  I would personally want to know the law enough to protect myself, push back on anything illegal in writing, and then get written approval to disregard to be totally covered - but I understand that even this can be hard if you’re one or two devs deep at a startup or whatever. Personally, if I didn’t think they were pursuing legal work I’d leave.
- kelnos 1y ago
  As much as I despise the "I was just following orders" defense, do make sure you get anything like that in writing: an email trail where you raise your concerns about the lack of security, with a response from a boss saying not to bother with it. Not sure where you are located, but I don't know of any case where an individual rank-and-file employee has been held legally responsible for a data breach. (Hell, usually no one suffers any consequences for data breaches. At most the company suffers a token fine and they move on without caring.
ungreased0675 1y ago
I would like to see laws that make storing PII as dangerous as storing nuclear waste. Leaks should result in near-certain bankruptcy for the company and legal jeopardy for the people responsible. That’s the best way I can think of to align incentives correctly. Right now there’s very little downside to storing as much user information as possible. Data breach? Just tweet an apology and keep going.
- hiatus 1y ago
  > I would like to see laws that make storing PII as dangerous as storing nuclear waste. This is a little extreme IMO. PII encompasses a lot of data, including benign things like email address stored only for authentication and contact purposes.
  - pixl97 1y ago
    I mean, we could consider email like light waste, can't dump it in the environment like plastic trash, but if you handle it correctly with cheap disposal methods it will be ok. Things like photos of IDs/passports should be considered yellowcake.
- gwbas1c 1y ago
  White collar jail? That might be the only way to give the issue the attention it deserves.
Abubaker771 1y ago
[dead]
AlienRobot 1y ago
>the OTP is directly in the response I forgot my password. Type your username: Your password is hunter2. Vibes.
- orphea 1y ago
  Many-many moons ago I saw a forum website that would tell "Sorry, you can't use password qwerty123. This password is already used by user SweetLemon13115"
gxs 1y ago
FYI the Hinge app works the same way I requested my data and all the image URLs are publicly accessible - and the URLs provided are both your own images and the images of anyone who’d ever viewed your profile
- reliablereason 1y ago
  The security is in the fact that you cant just list every single user and all their info. You would need to scrape the info. A URL with a cryptic file name is theoretically just as secure as a a random password.
shayanbahal 1y ago
I had a similar experience with another dating app, although they never got back to me. When I tried to get the founders attention by changing his bio to contact me text, they restored a backup lol years later I saw their instagram ad and tried to see if the issue still exists, and yes it did. Basically anyone with the knowledge of their API endpoints (which is easy to find using the app-proxy-server) you have full on admin capabilities and access to all messages, matching, etc. I wonder if I should go back and try again... :-?
- cobalt60 1y ago
  Why not disclose it as a responsible dev with contacts and move on.
  - pixl97 1y ago
    If a company is not responsible enough to follow up on security reports you should not follow up, but instead disclose it to the world.
    - shayanbahal 1y ago
      I think it took so long that I moved on, but you are right and I should have done that. Probably I'll take a look again to see if I can do it now :)
      - evantbyrne 1y ago
        Been there. Nagged the city of Seattle for nearly two years about fixing their insecure digital wallets, and in return they just acted weird to me and never really fixed the problem. Wouldn't tell me anything not even the vendor so I could communicate to them that this issue could exist elsewhere. The goal of these tactics is to delay long enough that you give up on publishing. So publish. Just be ethical and stay within the bounds of the law on what you access and release.
        1y ago
yieldcrv 1y ago
this is useful! I am considering building a dating app with its own twist and seeing the api endpoints this team went with is useful under the hood they're all the same, just with different theming and market segmentation
andoando 1y ago
If they're sending the OTP to the user, its because the OTP is being checked client side, so you might have been able to just call the authentication endpoint directly.
- joshstrange 1y ago
  More likely it's misconfiguration of some kind. Perhaps a hold over from testing (where you don't always want to send the SMS). Maybe just the habit/pattern of returning the item you just created in the DB and not remembering to mark the field as private. There are a whole slew easy foot-guns. I'm not defending it but I doubt it's to do client-side validation, that would be insanity. It's easy enough to not notice a body on a response that you don't care about client side, "200? Cool, keep moving". It's still crazy they were returning the OTP and I sure hope it wasn't on purpose.
deleted 1y ago
[deleted]
sillywabbit 1y ago
There's probably some benefit to having people who will tell you about security issues rather than exploit them. You can't really blame businesses / app devs for wanting to be left alone though.
- throwaway314155 1y ago
  what?
  - deleted 1y ago
    [deleted]
gwbas1c 1y ago
FYI: This is more common than you think. I briefly worked with a company where I had to painfully explain to the lead engineer that you can't trust anything that comes from the browser; because a hacker can curl whatever they want. Our relationship deteriorated from there. Needless to say, I don't list the experience on my resume.
j45 1y ago
A real issue is how much data and functionality to access said data is exposed for the front end that could conveniently be held server side.
hamish-b 1y ago
I'm not sure how I hadn't heard about Charle's Proxy for iPhone before! I've done some light pentesting before and had to manually result to grepping for strings throughout the app binary. Glad to have found out about this, especially for when apps are only on iOS.
- bearsyankees 1y ago
  Awesome glad to help!! It is a pretty good tool (unless apps use SSL pinning)
hoseja 1y ago
It used to be you matched yourself with babes if you had power over a dating app.
Adambuilds 1y ago
[dead]

570 points by bearsyankees 1y ago

swyx 1y ago

> Since then, I have reached out multiple times (on March 5 and March 13) seeking updates on remediation and user notification plans. Unfortunately, as of today’s publication date (April 21, 2025), I have been met with radio silence. To my knowledge, Cerca has not publicly acknowledged this incident or informed users about this vulnerability, despite their earlier assurances to me. They also never followed up with me following our call and ignored all my follow up emails. there can always be another side to this story but also wtf. this kind of shit makes me want to charles-proxy every new app i run because who knows what security any random startup has

deleted 1y ago
[deleted]
genewitch 1y ago
I'd not heard of Charles Proxy nor gobuster. Years ago there was a firmware for mango travel routers that let you MITM anything connected to it, and i bought two of them, and then the information about how to set it up disappeared (i can't find it). the GL.iNet mango travel routers, is what i mean. I have one wireguarded with the switch set to shut off access or wireguard only; the other one is for IOT devices and is connected via 10mbit, so even if someone managed to hack one of the two IOT things here they couldn't exfil very much, and i'd notice the blinking.
- andrewmcwatters 1y ago
  Charles Proxy has been in the industry for many years now. It's a common tool for basic reverse engineering.
  - nerdsniper 1y ago
    Somewhat downplaying it. Charles is easily the most popular tool for reverse engineering client-server communications in mobile apps. Certificate pinning frustrates Charles by hampering MITM attempts. It can be difficult to extract/replace pinned certificates from the latest versions of Android/iOS apps. Often you can extract them from older versions using specialized tools, if old-enough versions exist and those certificates are still valid for API endpoints of interest.
    - andrewmcwatters 1y ago
      Yeah, I definitely did. lol It's like saying IDA Pro is just an interesting piece of software for looking at binaries, but the grandparent comment is surely from someone who doesn't look at these utilities, so I guess that's why I didn't press it.

xutopia 1y ago

That's crazy to not have responded to his repeated requests!

benzible 1y ago
As someone managing a relatively low-profile SaaS app, I get constant reports from "security researchers" who just ran automated vulnerability scanners and are seeking bounties on minor issues. That said, it's inexcusable - they absolutely need to take these reports seriously and distinguish between scanner spam and legitimate security research like this. Update: obviously I just skimmed this, per responses below.
- bee_rider 1y ago
  It sounds like they actually met with him, patched the issues, and then didn’t respond afterwards. IMO that is quite rude of them toward him, but they do seem to have taken the issue itself somewhat seriously.
  - benzible 1y ago
    Ah, sorry, I need to actually read things before I react :)
- sshine 1y ago
  They already met with him and acknowledged the problem. So their lack of follow-up is an attempt to push things under the rug. Users deserve to know that their data was compromised. In some places of the world it is a crime to not report a data leak.
- nick238 1y ago
  Pardon sir, I see you have: * Port 443 exposed to the internets. This can allow attackers to gain access to information you have. $10k fee for discovery * Your port 443 responds with "Server: AmazonS3" header. This can allow attackers to identify your hosting company. $10k fee for discovery. Please remit payment and we will offer instructions for remediation.

soco 1y ago

It doesn't even look that they tried to secure anything initially. Security by design? Ha.

sherdil2022 1y ago

They might not have a playbook on how to handle such reports. Doesn’t mean they shouldn’t respond. They are also probably sh*t scared about legal ramifications - but not responding only makes them look even worse. None-the-less it is amazing how many of these products and services don’t put security and user privacy first. Open for discussion - What would make them pay attention?

camcil 1y ago
Affecting their bottom-line via litigation, less usage, whatever...
bravoetch 1y ago
I think most companies have a weak playbook for this kind of interaction. I once bought a product (and I'm going to be deliberately vague) from a company whose customers are mostly very famous people around the globe. The URL for my order included the order number, and that page showed everything about my order and my PII. Naturally I tried changing the order number, and wowzers I was able to see emails, phones, addresses, contacts for the PA/agent and sometimes direct contact info for the ordering party. When I contacted the company about this, they didn't thank me or really acknowledge the problem. They fixed it about a month later by requiring login to view order URLs. I feel like they should have let their customers know all their PII data was exposed - I know they didn't, I never got such a notification.
squigz 1y ago
Fines that are enough to actually hurt, and regulations that force companies to actually secure PII. If they're scared of such things, then maybe they shouldn't be making and marketing a dating app. It's not 2003 anymore, and this isn't some innocent app - they're collecting information on passports and sexual preferences for thousands of people. They should be aware of the responsibility that ought to come with that.

tuwtuwtuwtuw 1y ago

I m not sure I understand properly. Did he try to hack a random service he encountered? Is that even legal? Where I live (Sweden) it's definitely not legal.

janalsncm 1y ago
If only all hackers lived in jurisdictions which enforce anti-hacking laws. If I am making an app, I’m not going to rely on the police to enforce cybersecurity.
bink 1y ago
It's become a bit of a grey area thanks to most large companies having bug bounty programs now. I think some researchers just assume that all companies are OK with testing against their production services. IMHO it's almost certainly illegal, but simply won't be enforced unless the hacker/researcher does something malicious.
charcircuit 1y ago
It's not legal in America either. And he is posting with what may be his real name which adds extra risk.
- bee_rider 1y ago
  I’m not in security (thank goodness, it sounds like a legal minefield). It sounds like this system was so wildly insecure that… I actually kinda wonder what laws specifically he broke. If you just text out passwords to anybody who asks, are they really doing unauthorized access? Lol. I’m sure it was illegal somehow, though.
  - carefulfungi 1y ago
    It is very likely illegal but also discouraged to be prosecuted. From the federal government's guidelines on prosecuting unauthorized computer access (https://www.justice.gov/jm/jm-9-48000-computer-fraud https://www.justice.gov/jm/jm-9-48000-computer-fraud): > "The attorney for the government should decline prosecution if available evidence shows the defendant’s conduct consisted of, and the defendant intended, good-faith security research."

deleted 1y ago

[deleted]

camcil 1y ago

In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure. They may have "patched" the ability to exploit it in this way, but the plaintext data is still there in that same fragile architecture and still being handled by the same org that made all of these same fundamental mistakes in the first place. Yikes.

hiatus 1y ago
> In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure. As you are probably well aware, we do not live in that world. Companies like Equifax can suffer breaches exposing the personal information of millions and stock still goes up.
- baxtr 1y ago
  PII data breaches, especially PHI data can lead to high financial losses, mostly in the US through litigation. Fines in the EU are low in comparison. Companies don’t like to talk about this, and they bury these costs deep down in their financial statements. But trust me, they’re quite substantial.
  - senderista 1y ago
    If that's true, then stock prices should reflect that. But that's not what we see after major PII breaches at publicly traded companies.
    - baxtr 1y ago
      So you have seen the failure of Apple’s car project in their stock price?
- CobrastanJorji 1y ago
  Sorry about that. Please fill out this class action postcard, and, if approved, you will receive up to two years of identity protection services provided by Equifax (to be served concurrently with any other court-ordered two years of identity protection services), or, if you have financial damages you can conclusively prove are directly linked to this specific identity disclosure, you may mail your evidence to the provided address for up to $1000 in restitution, pending arbitration.

9283409232 1y ago

There's no penalty for failing at privacy and security so companies would rather play the odds that they will be fine than invest in proper practices. Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it. In a more just world, this would trigger so many regulatory and compliance audits.

mooreds 1y ago
> There's no penalty for failing at privacy and security I wouldn't say there's no penalty (they might have to pay for a year of identity theft protection or a fine). I agree that the consequences are not in line with the damage to the public or customer base.
MaKey 1y ago
The GDPR allows for huge fines, so for companies operating in Europe there is an incentive to take privacy and security seriously.
- brazzy 1y ago
  Namely, up to 20 million EUR or 4% of the previous year's revenue, whichever is larger.
thesuitonym 1y ago
> Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it. Trasmitting information via HTTPS is usually enough to say your app uses "encryption and other industry-standard measures to protect your data."

edm0nd 1y ago

> I have been met with radio silence. Thats when its time to inform them you are dumping the vuln to the public in 90 days due to their silence.

9283409232 1y ago
Good way to get yourself sued and have possible criminal charges brought up to you.
- b8 1y ago
  Which has never happened before and if it does then the EFF would back you presumably.
  - 9283409232 1y ago
    This is a completely uninformed comment. Security researchers get sued or threatened all the time. Bunnie was threatened by Microsoft for publishing his research on Xbox vulnerabilities, the city of Columbus sued David Ross for his reporting on data exposed during a ransomware attack, Google has threatened action against a few security researchers if memory serves and that is just what I can remember off the top of my head.
    - secalex 1y ago
      Agreed. I've been doing this for 25+ years and personally know a dozen people who have been threatened and several who have been sued or faced potential prosecution for legitimate security research. I've experienced both situations! That doesn't make it right, and the treatment of the researcher here was completely inappropriate, but telling young researchers to just go full disclosure without being careful about documentation, legal advice and staying within the various legal lines is itself irresponsible.
    - tptacek 1y ago
      I've spent my entire career doing this, have been personally "threatened" several times, and until relatively recently kept track of researchers dealing with legal threats. The concern is overblown. In cases that go beyond a nastygram from a lawyer, it is almost always the fact pattern that some aggravating factor is present: a consulting agreement that initiated the testing and forecloses disclosure, or the preservation and/or publication of the PII itself, or attempts to pivot and persist access after finding a vulnerability. It's an especially superficial argument on this story, where the underlying vulnerability has essentially already been disclosed.

blantonl 1y ago

Returning the OTP in the request API response is wild. Like why?

mooreds 1y ago
I too am bewildered. Maybe to make it easier to build the form accepting the OTP? Oversight? I can't think of any other reasons.
- Vuska 1y ago
  Oversight. Frameworks tend to make it easy to make an API endpoint by casting your model to JSON or something, but it's easy to forget you need to make specific fields hidden.
- ksala_ 1y ago
  My best guess would be some form of testing before they added sending the "sending a message" part to the API. Build the OTP logic, the scaffolding... and add a way to make sure it returns what you expect. But yes absolutely wild.
- Alex-Programs 1y ago
  I assume that whoever wrote it just has absolutely no mental model of security, has never been on the attacking side or realised that clients can't be trusted, and only implemented the OTP authentication because they were "going through the motions" that they'd seen other people implement.
  - ceejayoz 1y ago
    https://en.wikipedia.org/wiki/Cargo_cult https://en.wikipedia.org/wiki/Cargo_cult
  - pixl97 1y ago
    Everyone that programs should take blackhat classes of some kind. I talk to so many programmers that really don't understand what hackers/attackers can actually do.

bearsyankees 1y ago

https://yaledailynews.com/blog/2025/04/24/yale-student-exposes-data-leak-in-college-dating-app/ https://yaledailynews.com/blog/2025/04/24/yale-student-expos... ^another article on this

ahaferburg 1y ago
> Developers should use best practices, but they may not be sufficient, he added. “Keeping data secure is an unsolved problem,” he said. Oh, ok. Too bad, I guess.

michaelteter 1y ago

Not excusing this is any way, but this app is apparently a fairly junior effort by university students. While it should make every effort to follow good security (and communication) practices, I'd not be too hard on them considering how some big VC funded "adult" companies behave when presented with similar challenges. https://georgetownvoice.com/2025/04/06/georgetown-students-create-cerca-a-new-dating-app-that-swipes-right-on-safety/ https://georgetownvoice.com/2025/04/06/georgetown-students-c...

peterldowns 1y ago
I hear you but if you're processing passports and sexual preferences you have to at least respond to the security researcher telling you how you're leaking them to absolutely anyone. This is a total clusterfuck and there are zero excuses for the lack of security here.
genewitch 1y ago
i have an idea, if you don't know anything about app security, don't make an app. "Whataboutism" not-withstanding, this actually made me feel a little ill, and your comment didn't help. I have younger friends that use dating sites and having their information exposed to whoever wants it is gross, and the people who made it should feel bad. They should feel bad about not communicating with the "researcher" after the fact, too. If i had been blown off by a "company" after telling them everything was wide open to the world for the taking, the resulting "blog post" would not be so polite. STOP. MAKING. APPS.
- dylan604 1y ago
  Stop pushing POCs into PROD. There's nothing wrong with making your POC/MVP with all of the cool logic that shows what the app will do. That's usually done to gain funding of some sort, but before releasing. Part of the releasing stage should be a revamped/weaponized version of the POC, and not the damn POC itself. The weaponized version should have security stuff added. That's much better than telling people stop making apps.
  - 1y ago

koakuma-chan 1y ago

I thought Apple was checking apps? How did this go through? In any sane jurisdiction exposing PII like that is illegal.

hackan 1y ago
nobody does a free security checkup xD not even apple
- tough 1y ago
  free? I thought they still had their 30% racket and wait while we review 3 months pipeline going for their walled gardens
  - hackan 1y ago
    yeah, no. security evaluations cost a ton, and they take time. apple is doing nothing at all, just charging for being in a premium market.
    - nixpulvis 1y ago
      "Premium" Apps on the app store are hardly much better than anywhere else.
      - tough 1y ago
        The "premium" presumably is the market apple's commands and nobody else's does iOS users still spend more dollars per average in apps than android ones even if android has more users i think ?
        nixpulvis 1y ago
        Also true. But it's just sad to see the average quality of an app has gone way down over the years.
    - 1y ago

nixpulvis 1y ago

People need to be forced to think twice before taking in such sensitive information as a passport or even just addresses. This sort of thing cannot be allowed to be brushed off as just a bunch of kids making an app.

koakuma-chan 1y ago
Were they not using some kind of third party identity verification service? That's what I usually see apps do. Don't tell me those third party services still share your ID with the app (like the actual images)?
- nixpulvis 1y ago
  Read the article. They clearly have their own OTP setup. But if they are asking for your passport, then they have access to it. It's not a third party asking and providing them with some checkmark or other reduced risk data.
  - koakuma-chan 1y ago
    I have read the article and OTP has nothing to do with identity verification. I'm asking because every single time I went through identity verification the app used a third party service that is supposed to be trustworthy.
    - nixpulvis 1y ago
      I see what you mean. But they literally had passport front/back URLs, so they aren't using a third party for that either.
jonny_eh 1y ago
There should to be some kind of government operated identity confirmation service that is secure/private. Or by someone "government-like" such as Apple or Google.

12_throw_away 1y ago

Hot take: just like real engineers, there should be a Software Engineer licensing exam that's legally required before you can handle PII ... because this is the alternative. Before I was allowed to hand out juice cups at my kids' preschool, I had to do a 2 hour food safety course and was subject to periodic inspections. That is infinity% more oversight than I received when storing highly sensitive information for ~10^5 users.

aDyslecticCrow 1y ago
A few European countries' "masters of computer science" is just a normal "engineering" degree with a focus on software for any speciality credits. I can call myself an "engineer", even though my software profession does not value the distinction. Though I'm sceptical it would help. API design is generally not taught in university courses, and perhaps shouldn't (too specific). I instead feel that GDPR has already done a lot of heavy lifting. By raising the price of "find out", people got a bit more careful about the "fuck around" part. It seems to push companies to take it seriously. The step two is forcing companies to take security breaches and security disclosures seriously, which CRA (Cyber Resilience Act) may help.... at the cost of swamps of byrocratic overhead that is also included ofcourse.
- pixl97 1y ago
  Bureaucracy is the cost of human laziness... I mean, do you trust that the chemical industry will self regulate and keep dangerous chemicals out of your drinking water? Then why do we trust software companies to keep you and your data safe? We will get more regulations over time no matter how much we complain about it because people are rather lazy at the end of the day and more money for less work is a powerful motivator.
  - aDyslecticCrow 1y ago
    Ye. It's unfortunate that companies cannot responsibly do the proper thing on their own. Though I wanna raise that, CRA may be an unfathomably high bureaucratic load on software companies. If it were just about security disclosure, it would be quite manageable. As it is formulated in its current form, CRA sets the general software development industry... to the current industrial automation and automotive standards; which is absurd.

mtlynch 1y ago

This is a pretty confusing writeup. >First things first, let’s log in. They only use OTP-based sign in (just text a code to your phone number), so I went to check the response from triggering the one-time password. BOOM – the OTP is directly in the response, meaning anyone’s account can be accessed with just their phone number. They don't explain it, but I'm assuming that the API is something like api.cercadating.com/otp/<phone-number>, so you can guess phone numbers and get OTP codes even if you don't control the phone numbers. >The script basically just counted how many valid users it saw; if after 1,000 consecutive IDs it found none, then it stopped. So there could be more out there (Cerca themselves claimed 10k users in the first week), but I was able to find 6,117 users, 207 who had put their ID information in, and 19 who claimed to be Yale students. I don't know if the author realizes how risky this is, but this is basically what weev did to breach AT&T, and he went to prison for it.[0] Granted, that was a much bigger company and a larger breach, but I still wouldn't boast publicly about exploiting a security hole and accessing the data of thousands of users without authorization. I'm not judging the morality, as I think there should be room for security researchers to raise alarms, but I don't know if the author realizes that the law is very much biased against security researchers. [0] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_email_address_leak https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...

tptacek 1y ago
Read the original complaint in the Auernheimer case. Prosecutors had (extensive) intent evidence that is unlikely to exist here. The defendants in that case were also accused of disclosing the underlying PII, which is not something that appears to have happened here.
- mtlynch 1y ago
  Yeah, I agree Auernheimer was a much more attractive target for prosecution, but do you think this student is legally safe in what they're doing here?
  - tptacek 1y ago
    I would personally not scrape the endpoint to collect statistics and inform the severity estimation, but I'm a lot more risk averse than most. But prosecution of good-faith security research is disfavored, so as long as you don't do anything to breach the assumption of good faith (as defendants in the trial you mentioned repeatedly did) I think you're probably fine. The bigger thing is just that there's no actual win in scraping here. It doesn't make the vulnerability report any more interesting; it just reads like they're trying to make the whole thing newsier. Some (very small) risk, zero reward.

some_furry 1y ago

https://archive.ph/rOQVe https://archive.ph/rOQVe

phyzix5761 1y ago

Imagine every time you entered a specific physical location you would increase your exposure to a detrimental disease. After only entering a couple of times you've contracted this disease and each subsequent visit to this place makes the illness worse. A few people try to warn you but you choose not to listen and, in fact, you recruit the government to make it easier to enter such places with safeguards that don't actually protect you from the disease and encourage you to enter more frequently. You're then surprised why you're ill to the brink of death and blame the location as the sole cause for your ails. Yes, the location is to blame but so are you for continuing to enter even after getting sick. Why do you do this? Because you want something. Convenience, pleasure, a distraction, etc. But you refuse to acknowledge that its killing you. This is how we should view optional services that require us to give our PII data in exchange for hours of attention-grabbing content. They're designed to sell your eyeballs and data to advertisers. You know this already but you can't say no. You're sick and refuse to acknowledge it.

bongodongobob 1y ago
But a dating app specifically needs all kinds of personal info. That's like, what it's for.
- phyzix5761 1y ago
  But its your choice to use it right?
  - kube-system 1y ago
    Yes, it is your choice to contract with another party who agrees to keep your information secure. However, it is also their fault when they do not uphold their agreement.
RussianCow 1y ago
> This is how we should view optional services that require us to give our PII data in exchange for hours of attention-grabbing content. This is a nice fantasy, but realistically it means you shouldn't use probably 90% of services out there, which isn't reasonable for most people. Plus, there are plenty of companies with treasure troves full of data on you that have equally questionable data security/privacy practices that you've never even directly interacted with. We need regulation. There is no other alternative. And we need to stop blaming victims of data breaches for companies not putting basic security measures in place. I don't think it's unreasonable to expect every company you interact with to securely store your sensitive data. If a place was physically making people ill like in your thought experiment, they wouldn't be around for very long; I think we should demand the same for our data.

voytec 1y ago

I'm flagging this submission. Look at the author[0], at the "Georgetown students..." (won't backlink again) post linked below stating that Cerca was 2 months old in April, and OP's post from April stating that they hacked this thing two months earlier. It's some self-promo or whatever scheme/scam bullshit. [0] https://news.ycombinator.com/from?site=alexschapiro.com https://news.ycombinator.com/from?site=alexschapiro.com

bearsyankees 1y ago
Hi author here! Not exactly sure what you are talking about — I think I found this vulnerability pretty close to when the app first went public but not sure why that makes it a scam And I posted this blog because I think people will find it interesting! Happy to answer any other questions when I get back to my computer :)
- bearsyankees 1y ago
  (Also more info here: https://yaledailynews.com/blog/2025/04/24/yale-student-exposes-data-leak-in-college-dating-app/ https://yaledailynews.com/blog/2025/04/24/yale-student-expos...)
nik_0_0 1y ago
Posting the same link 4 times in 18 days, by the author, certainly seems like self-promo, but somehow allowed? I don't see any URL manipulation, and it certainly took off today. (I found it interesting!) A&B testing of post names seems to lead some useful information ;) I don't see your reference to "Georgetown students..." in either the website link or the user's submissions? Was it modified?
- bearsyankees 1y ago
  Glad you found it interesting, yeah I was experimenting with different names and obviously this one was the best. Not trying to self-promo as I am not like selling any product but just thought people would enjoy the article! Sorry if I violated any of the unwritten HN norms... but glad people are reading it now and having interesting discussions

andrelaszlo 1y ago

Oops! Nice find! To limit his legal exposure as a researcher, I think it would have been enough to create a second account (or ask a friend to create a profile and get their consent to access it). You don't have to actually scrape the data to prove that there's an enumeration issue. Say your id is 12345, and your friend signs up and gets id 12357 - that should be enough to prove that you can find the id and access the profile of any user. As others have said, accessing that much PII of other users is not necessary for verifying and disclosing the vulnerability.

ofjcihen 1y ago
This is the standard and obvious way to go about things that most security researchers ignore. While you can definitely want PII protected and scrape data to prove a point it’s unnecessary and hypocritical.
- strunz 1y ago
  Eh, part of assessing the vulnerability is how deep it goes. Showing that there were no gates or roadblocks to accessing all the data is a valid thing to research, otherwise they can later say "oh we hade rate limiting in place" or "we had network vulnerability scanners which would've prevented a wholesale leak".
  - ofjcihen 1y ago
    That’s not how web app vulnerabilities work and it would be easy to counter that handwaving with “hackers know what FireProx is”.
    - SeaScythes 1y ago
      Hey there--pentester, security researcher, and bug bounty hunter here. "Demonstrating impact" is common practice. The presence (or non-presence) of rate limiting controls, such as those alluded to by the commenter above, can play into the risk assigned to a vulnerability, and may be difficult to ascertain without actually attempting an otherwise theoretical attack. This also has the effect of indicating whether the target has adequate detection capabilities, which is important information. Demonstrating impact is also just sometimes necessary to convey urgency to leadership; hand waving is common. Alternatively, some organizations may silently patch without performing a responsible disclosure, such as was the case with this article. Having hard proof that the attack was 1) viable and 2) not detected is critical information in the event that you must disclose to the public. As an aside, from your history: > My one gripe with HN is that people say incorrect things with complete confidence pretty regularly and you can only Detect it if you know the subject matter. Welcome to being part of the problem. Remember the feeling.

SpaceL10n 1y ago

I worry about my own liability sometimes as an engineer at a small company. So many businesses operate outside of regulated industries where PCI or HIPAA don't apply. For smaller organizations, security is just an engineering concern - not an organizational mandate. The product team is focused on the features, the PM is focused on the timeline, QA is focused on finding bugs, and it goes on and on, but rarely is there a voice of reason speaking about security. Engineers are expected to deliver tasks on the board and litte else. If the engineers can make the product secure without hurting the timeline, then great. If not, the engineers end up catching heat from the PM or whomever. They'll say things like... "Well, how long will that take?" or, "What's really the risk of that happening?" or, "We can secure it later, let's just get the MVP out to the customer now" So, as an employee, I do what my employer asks of me. But, if somebody sues my employer because of some hack or data breach, am I going to be personally liable because I'm the only one who "should have known better"?

hiatus 1y ago
Are you an officer of the company? If not I would not think you could be personally liable.
sailfast 1y ago
I would personally want to know the law enough to protect myself, push back on anything illegal in writing, and then get written approval to disregard to be totally covered - but I understand that even this can be hard if you’re one or two devs deep at a startup or whatever. Personally, if I didn’t think they were pursuing legal work I’d leave.
kelnos 1y ago
As much as I despise the "I was just following orders" defense, do make sure you get anything like that in writing: an email trail where you raise your concerns about the lack of security, with a response from a boss saying not to bother with it. Not sure where you are located, but I don't know of any case where an individual rank-and-file employee has been held legally responsible for a data breach. (Hell, usually no one suffers any consequences for data breaches. At most the company suffers a token fine and they move on without caring.

ungreased0675 1y ago

I would like to see laws that make storing PII as dangerous as storing nuclear waste. Leaks should result in near-certain bankruptcy for the company and legal jeopardy for the people responsible. That’s the best way I can think of to align incentives correctly. Right now there’s very little downside to storing as much user information as possible. Data breach? Just tweet an apology and keep going.

hiatus 1y ago
> I would like to see laws that make storing PII as dangerous as storing nuclear waste. This is a little extreme IMO. PII encompasses a lot of data, including benign things like email address stored only for authentication and contact purposes.
- pixl97 1y ago
  I mean, we could consider email like light waste, can't dump it in the environment like plastic trash, but if you handle it correctly with cheap disposal methods it will be ok. Things like photos of IDs/passports should be considered yellowcake.
gwbas1c 1y ago
White collar jail? That might be the only way to give the issue the attention it deserves.

Abubaker771 1y ago

[dead]

AlienRobot 1y ago

>the OTP is directly in the response I forgot my password. Type your username: Your password is hunter2. Vibes.

orphea 1y ago
Many-many moons ago I saw a forum website that would tell "Sorry, you can't use password qwerty123. This password is already used by user SweetLemon13115"

gxs 1y ago

FYI the Hinge app works the same way I requested my data and all the image URLs are publicly accessible - and the URLs provided are both your own images and the images of anyone who’d ever viewed your profile

reliablereason 1y ago
The security is in the fact that you cant just list every single user and all their info. You would need to scrape the info. A URL with a cryptic file name is theoretically just as secure as a a random password.

shayanbahal 1y ago

I had a similar experience with another dating app, although they never got back to me. When I tried to get the founders attention by changing his bio to contact me text, they restored a backup lol years later I saw their instagram ad and tried to see if the issue still exists, and yes it did. Basically anyone with the knowledge of their API endpoints (which is easy to find using the app-proxy-server) you have full on admin capabilities and access to all messages, matching, etc. I wonder if I should go back and try again... :-?

cobalt60 1y ago
Why not disclose it as a responsible dev with contacts and move on.
- pixl97 1y ago
  If a company is not responsible enough to follow up on security reports you should not follow up, but instead disclose it to the world.
  - shayanbahal 1y ago
    I think it took so long that I moved on, but you are right and I should have done that. Probably I'll take a look again to see if I can do it now :)
    - evantbyrne 1y ago
      Been there. Nagged the city of Seattle for nearly two years about fixing their insecure digital wallets, and in return they just acted weird to me and never really fixed the problem. Wouldn't tell me anything not even the vendor so I could communicate to them that this issue could exist elsewhere. The goal of these tactics is to delay long enough that you give up on publishing. So publish. Just be ethical and stay within the bounds of the law on what you access and release.
      - 1y ago

yieldcrv 1y ago

this is useful! I am considering building a dating app with its own twist and seeing the api endpoints this team went with is useful under the hood they're all the same, just with different theming and market segmentation

andoando 1y ago

If they're sending the OTP to the user, its because the OTP is being checked client side, so you might have been able to just call the authentication endpoint directly.

joshstrange 1y ago
More likely it's misconfiguration of some kind. Perhaps a hold over from testing (where you don't always want to send the SMS). Maybe just the habit/pattern of returning the item you just created in the DB and not remembering to mark the field as private. There are a whole slew easy foot-guns. I'm not defending it but I doubt it's to do client-side validation, that would be insanity. It's easy enough to not notice a body on a response that you don't care about client side, "200? Cool, keep moving". It's still crazy they were returning the OTP and I sure hope it wasn't on purpose.

deleted 1y ago

[deleted]

sillywabbit 1y ago

There's probably some benefit to having people who will tell you about security issues rather than exploit them. You can't really blame businesses / app devs for wanting to be left alone though.

throwaway314155 1y ago
what?
- deleted 1y ago
  [deleted]

gwbas1c 1y ago

FYI: This is more common than you think. I briefly worked with a company where I had to painfully explain to the lead engineer that you can't trust anything that comes from the browser; because a hacker can curl whatever they want. Our relationship deteriorated from there. Needless to say, I don't list the experience on my resume.

j45 1y ago

A real issue is how much data and functionality to access said data is exposed for the front end that could conveniently be held server side.

hamish-b 1y ago

I'm not sure how I hadn't heard about Charle's Proxy for iPhone before! I've done some light pentesting before and had to manually result to grepping for strings throughout the app binary. Glad to have found out about this, especially for when apps are only on iOS.

bearsyankees 1y ago
Awesome glad to help!! It is a pretty good tool (unless apps use SSL pinning)

hoseja 1y ago

It used to be you matched yourself with babes if you had power over a dating app.

Adambuilds 1y ago

[dead]