this post was submitted on 31 Jul 2024
160 points (98.8% liked)

Privacy

31175 readers
594 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
 

In a new academic paper, researchers from the Belgian university KU Leuven detailed their findings when they analyzed 15 popular dating apps. Of those, Badoo, Bumble, Grindr, happn, Hinge and Hily all had the same vulnerability that could have helped a malicious user to identify the near-exact location of another user, according to the researchers.

While neither of those apps share exact locations when displaying the distance between users on their profiles, they did use exact locations for the “filters” feature of the apps. Generally speaking, by using filters, users can tailor their search for a partner based on criteria like age, height, what type of relationship they are looking for and, crucially, distance.

To pinpoint the exact location of a target user, the researchers used a novel technique they call “oracle trilateration.”

The good news is that all the apps that had these issues, and that the researchers reached out to, have now changed how distance filters work and are not vulnerable to the oracle trilateration technique.

Neither Badoo, which is owned by Bumble, nor Hinge responded to a request for comment.

top 9 comments
sorted by: hot top controversial new old
[–] [email protected] 32 points 1 month ago (1 children)

I feel like this is just part and parcel of location based apps and in cities, of course it's easier to triangulate someone's location. I still wouldn't change it as I don't want to date someone so far away that I don't see them regularly without incurring excessive expenses. But that's probably my male privilege speaking and I'll ultimately defer to the most vulnerable and let them lead the way on this.

Also, for the love of God, break up the Match Group!

[–] [email protected] 8 points 1 month ago

There are solutions to this, eg. differential privacy or city level aggregation

[–] [email protected] 9 points 1 month ago

This is a concern but also presumably you're putting your face, real name, real age, etc on there. They're not very private in the first place.

[–] [email protected] 8 points 1 month ago (1 children)

I understand trilateration, but what's "oracle trilateration"? How did these dating apps share the proximity distance of a user and to what precision? Like if it said the user is 5km away, that is still going to give a pretty big area if someone were to trilateral it because the line of the circle would have to include 4.5-5.5km away. Do that three times, and we'd get an area of about a square km. To get it down to 2m, the app would have to be precise to the meter, such as "user is 5,000m away".

[–] [email protected] 19 points 1 month ago (1 children)

Oracle trilateration refers to an attack on apps that have filters like "only show users closer than 5 km". In case of the vulnerable apps, this was very accurate, so the attacker could change their position from the victim (which does not require physical movement, the application has to trust your device on this, so the position can be spoofed) until the victim disappeared from the list, and end up a point that is almost exactly 5 km from the victim.

Like if it said the user is 5km away, that is still going to give a pretty big area if someone were to trilateral it because the line of the circle would have to include 4.5-5.5km away.

This does not help, since the attacker can find a point where it switches between 4 km and 5 km, and then this point (in the simplest case) is exactly 4.5 km from the victim. The paper refers to this as rounded distance trilateration.

[–] [email protected] 4 points 1 month ago

I see so so many timers that round down, so 1.4 seconds = 1 second, 0.4 = 0... so after reaching 0 you have to wait some more. Crazy how people get stuff like that wrong.

[–] [email protected] 4 points 1 month ago

How was a dating app supposed to guess that some of their userbase would be horny and sometimes feeling desperate (Sarcasm...)

[–] [email protected] 0 points 1 month ago (1 children)

Did you know that potential attackers can pinpoint your location if they are in the same public place as you?

This really seems like complaining that a location enabled app that explicitly shares your location with other users is sharing your location with other users. That is 100% the purpose of the app to begin with!

[–] [email protected] 13 points 1 month ago

Excuse me, but if they advertise that they don't give others your exact location (only a larger radius), I expect that to be true and that an extremist can't use a dating app to track down gay people to their home address.