<story><title>Stalking your Facebook friends on Tinder</title><url>https://defaultnamehere.tumblr.com/post/147747146865/stalking-your-facebook-friends-on-tinder#147747146865</url></story><parent_chain></parent_chain><comment><author>SwellJoe</author><text>I love security posts like this. His previous one about facebook messenger status was also really nicely done.&lt;p&gt;He doesn&amp;#x27;t succumb to the temptation to be abusive (to either the people who made the thing he&amp;#x27;s testing, the people reading, or anyone who might be impacted by it), which is something a lot of security researchers seem to find impossible to avoid; there&amp;#x27;s a lot of calling people various forms of stupid in many incident reports. Even when given ample opportunity by the Tinder folks to call them names, he didn&amp;#x27;t do so (and, didn&amp;#x27;t blow it out of proportion, either...it&amp;#x27;s problematic, but if you&amp;#x27;re using Facebook and Tinder, you probably are already aware you&amp;#x27;re giving up a lot of privacy; this is a big deal, but not &lt;i&gt;vastly&lt;/i&gt; bigger than using facebook all by itself).&lt;p&gt;He explains clearly what he did, and what tools he used to do it, which is another thing that often gets left out. Many security folks follow the magician&amp;#x27;s code (&amp;quot;never show&amp;#x27;em how it&amp;#x27;s done&amp;quot;), and are dismissive that mere mortals could ever understand what they do.&lt;p&gt;And, he tells a good story in the process. All around, top notch technical writing about a usually boring subject.</text></comment>
<story><title>Stalking your Facebook friends on Tinder</title><url>https://defaultnamehere.tumblr.com/post/147747146865/stalking-your-facebook-friends-on-tinder#147747146865</url></story><parent_chain></parent_chain><comment><author>Smerity</author><text>It&amp;#x27;s a surprise that Tinder launched Tinder Social just now in the US given that&amp;#x27;s the main source of the leaked data. Tinder Social was (and remains) opt-out in Australia while he was writing the article. Even if Tinder Social is now opt-in in the US, the fact they were dismissive of the vulnerability disclosure is concerning.&lt;p&gt;Any social network with deteriorating privacy is bad. One where the content can potentially be sensitive is even worse. If you started on a service and it kept becoming more private by default, that&amp;#x27;s fine - potentially annoying, but fine. If you start on a service and it kept becoming more public by default, then we have a problem.&lt;p&gt;The fact that Tinder don&amp;#x27;t realize Tinder profiles may contain sensitive information for a significant portion of their user base is hugely disturbing. As stated in the article, there are so many circumstances beyond cheating that this is still an issue.&lt;p&gt;Assume for a fictional argument that I was born into a religious family, &amp;quot;no sex before marriage&amp;quot; type of thing, but enjoyed one night stands. One might use Tinder to do so quietly. Tinder didn&amp;#x27;t allow your friends to see that information before - I assumed I was safe from judgement by my family and their friends. Then Tinder rips that privacy you thought you had away!&lt;p&gt;Saying that users should have known better is not an excuse. As developers we must operate under the assumption that best practices are likely going to be missed or misunderstood. Tinder violated that in an extreme way in an attempted land grab for a large social market beyond hook-ups and dating.&lt;p&gt;Disclosure: I&amp;#x27;m friends with the author and commented on drafts.</text></comment>