Tinder flaw could expose your swipes to snoops

There's a basic security measure missing from Tinder's mobile dating app.And it could let prying eyes see your...

Posted: Jan 24, 2018 8:21 AM
Updated: Jan 24, 2018 8:21 AM

There's a basic security measure missing from Tinder's mobile dating app.

And it could let prying eyes see your potential matches, along with whether you swiped left or right, a security firm has found.

The issue was discovered by researchers at the security firm Checkmarx. The company says it stems from Tinder's decision to not use HTTPS, a security protocol, to encrypt photos on its iOS and Android apps.

Sites that use HTTPS, compared to HTTP, encrypt communications between the user's browser or app and web server, so information is protected against hackers or eavesdroppers.

Because photos are not encrypted, it's possible for eavesdroppers on the same Wi-Fi network to monitor a user's behavior on the dating app and see photos of a user and potential matches. It also allows someone to inject images or malicious content into the app feed.

The lack of encryption could let a snoop spy on your Tinder activity in places like coffee shops or at work. Though no passwords or other sensitive data is leaking, researchers said this tactic could potentially be used to blackmail someone.

Tinder says it knows about the missing encryption. A Tinder spokesperson told CNNTech in an email Tuesday that photos on the Tinder app are publicly available to anyone using Tinder. The company said its desktop and mobile web platforms already encrypt images, and it is working toward encrypting them in the app.

Erez Yalon, manager of application security research at Checkmarx, said the application should be fixed to prevent potential spying. He added that he reported the issue to Tinder in mid-November.

Related: This $18 key can protect you from hackers

"There's absolutely no reason not to use HTTPS for everything," Yalon told CNNTech. "Letting sensitive data be transferred unencrypted is wrong."

Tinder encrypts other information within the app, but it was possible for researchers to figure out patterns that correlate to swiping left, right, and matching with someone. For example, swiping left is represented by 278 bytes each time.

By pairing swiping data with visible images, researchers showed it's possible for a hacker to see on whom someone swiped left or right. The firm created an app called Tinder Drift to demonstrate a potential spying scenario.

Terre Haute
Clear
60° wxIcon
Hi: 76° Lo: 54°
Feels Like: 60°
Robinson
Clear
56° wxIcon
Hi: 75° Lo: 52°
Feels Like: 56°
Indianapolis
Clear
61° wxIcon
Hi: 73° Lo: 53°
Feels Like: 61°
Rockville
Partly Cloudy
57° wxIcon
Hi: 76° Lo: 52°
Feels Like: 57°
Casey
Clear
63° wxIcon
Hi: 74° Lo: 52°
Feels Like: 63°
Brazil
Clear
60° wxIcon
Hi: 76° Lo: 53°
Feels Like: 60°
Marshall
Partly Cloudy
60° wxIcon
Hi: 74° Lo: 51°
Feels Like: 60°
Another Nice Night
WTHI Planner
WTHI Temps
WTHI Radar

WTHI Events

 

In Case You Missed It

${article.thumbnail.title}

Trace Adkins: The Way I Wanna Go Tour

${article.thumbnail.title}

SCAM ALERT: Avoid phony Amazon calls

${article.thumbnail.title}

SCAM ALERT: Beware of knock-off car seats

${article.thumbnail.title}

SCAM ALERT: Fake change-of-address websites

${article.thumbnail.title}

SCAM ALERT: Social media influencer ruse

Image

Police make arrests in deadly shooting case

${article.thumbnail.title}

SCAM ALERT: Fraudsters claim Apple iCloud breach to steal your info

${article.thumbnail.title}

SCAM ALERT: Schemes target military families

${article.thumbnail.title}

SCAM ALERT: Avoid Zoom phishing

Image

SCAM ALERT: Rental car shortage leads to phony deals

Illinois Coronavirus Cases

(Widget updates once daily at 7 p.m. CT)

Cases: 1389443

Reported Deaths: 25592
CountyCasesDeaths
Cook55642910467
DuPage924131318
Will769631033
Lake683861018
Kane59457808
Winnebago34140507
Madison30959526
McHenry29200295
St. Clair28348519
Peoria23455343
Champaign21112155
Sangamon19103240
McLean18560188
Tazewell17232305
Rock Island15247329
Kankakee14562217
Kendall1328599
LaSalle12789250
Macon10998211
DeKalb10123121
Vermilion10035143
Adams8694127
Williamson7609134
Whiteside7199174
Boone683878
Ogle621183
Grundy598778
Clinton578991
Coles5774100
Knox5647154
Jackson510165
Henry507970
Livingston489991
Woodford484482
Stephenson482785
Macoupin478388
Effingham476972
Franklin454278
Marion4515117
Jefferson4424122
Monroe438694
Lee419354
Randolph416587
Fulton405359
Logan398364
Morgan393482
Christian383975
Montgomery379374
Bureau378484
Fayette322955
Perry320360
Iroquois314167
McDonough291051
Jersey271752
Douglas260736
Saline260457
Lawrence241127
Shelby232838
Union228241
Crawford214525
Bond208724
Cass203527
Ford189048
Warren184349
Clark183933
Jo Daviess182724
Pike182153
Wayne181253
Hancock180931
Carroll178537
Edgar177040
Richland176940
White170626
Washington164825
Moultrie163128
De Witt157229
Mason154245
Piatt152414
Clay149743
Mercer149334
Johnson148116
Greene145234
Massac135940
Wabash135612
Cumberland130219
Menard125012
Jasper116718
Marshall108119
Hamilton84116
Schuyler7817
Brown7326
Pulaski7007
Stark64824
Edwards57712
Calhoun5302
Henderson52814
Scott4891
Putnam4863
Alexander47411
Gallatin4704
Hardin39112
Pope3284
Unassigned512433
Out of IL350

Indiana Coronavirus Cases

(Widget updates once daily at 8 p.m. ET)

Cases: 751526

Reported Deaths: 13799
CountyCasesDeaths
Marion1033281788
Lake557151010
Allen41710692
St. Joseph36998565
Hamilton36604417
Elkhart29413461
Tippecanoe22914227
Vanderburgh22559400
Porter19359326
Johnson18477389
Hendricks17689317
Clark13228195
Madison13158344
Vigo12625253
LaPorte12420221
Monroe12211176
Delaware10968198
Howard10337225
Kosciusko9630121
Hancock8577147
Bartholomew8172157
Warrick7860156
Floyd7812180
Grant7242179
Wayne7162201
Boone6972103
Morgan6765141
Dubois6221118
Marshall6211116
Cass6017110
Henry5902110
Dearborn589878
Noble581688
Jackson509176
Shelby501796
Lawrence4745122
Gibson445094
Clinton442755
Harrison441775
DeKalb439885
Montgomery438490
Whitley406643
Huntington403181
Steuben400259
Miami395269
Jasper388654
Knox376391
Putnam373260
Wabash362383
Ripley347270
Adams345555
Jefferson336186
White332253
Daviess3033100
Wells295381
Decatur289892
Greene286885
Fayette284864
Posey273835
LaGrange273172
Scott270156
Clay267148
Washington246136
Randolph244783
Jennings235349
Spencer234631
Starke228058
Fountain221048
Sullivan214643
Owen212158
Fulton203042
Jay200932
Carroll193720
Orange188255
Perry187237
Rush175926
Vermillion174844
Franklin170335
Tipton166446
Parke149616
Pike138134
Blackford136232
Pulaski120747
Newton114336
Brown104243
Crawford102516
Benton101914
Martin91715
Warren84015
Switzerland8148
Union72810
Ohio57911
Unassigned0420