Tinder flaw could expose your swipes to snoops

There's a basic security measure missing from Tinder's mobile dating app.And it could let prying eyes see your...

Posted: Jan 24, 2018 7:21 AM
Updated: Jan 24, 2018 7:21 AM

There's a basic security measure missing from Tinder's mobile dating app.

And it could let prying eyes see your potential matches, along with whether you swiped left or right, a security firm has found.

The issue was discovered by researchers at the security firm Checkmarx. The company says it stems from Tinder's decision to not use HTTPS, a security protocol, to encrypt photos on its iOS and Android apps.

Sites that use HTTPS, compared to HTTP, encrypt communications between the user's browser or app and web server, so information is protected against hackers or eavesdroppers.

Because photos are not encrypted, it's possible for eavesdroppers on the same Wi-Fi network to monitor a user's behavior on the dating app and see photos of a user and potential matches. It also allows someone to inject images or malicious content into the app feed.

The lack of encryption could let a snoop spy on your Tinder activity in places like coffee shops or at work. Though no passwords or other sensitive data is leaking, researchers said this tactic could potentially be used to blackmail someone.

Tinder says it knows about the missing encryption. A Tinder spokesperson told CNNTech in an email Tuesday that photos on the Tinder app are publicly available to anyone using Tinder. The company said its desktop and mobile web platforms already encrypt images, and it is working toward encrypting them in the app.

Erez Yalon, manager of application security research at Checkmarx, said the application should be fixed to prevent potential spying. He added that he reported the issue to Tinder in mid-November.

Related: This $18 key can protect you from hackers

"There's absolutely no reason not to use HTTPS for everything," Yalon told CNNTech. "Letting sensitive data be transferred unencrypted is wrong."

Tinder encrypts other information within the app, but it was possible for researchers to figure out patterns that correlate to swiping left, right, and matching with someone. For example, swiping left is represented by 278 bytes each time.

By pairing swiping data with visible images, researchers showed it's possible for a hacker to see on whom someone swiped left or right. The firm created an app called Tinder Drift to demonstrate a potential spying scenario.

Huntsville
Clear
62° wxIcon
Hi: 79° Lo: 53°
Feels Like: 62°
Florence
Clear
65° wxIcon
Hi: 79° Lo: 55°
Feels Like: 65°
Fayetteville
Clear
61° wxIcon
Hi: 78° Lo: 50°
Feels Like: 61°
Decatur
Clear
62° wxIcon
Hi: 79° Lo: 52°
Feels Like: 62°
Scottsboro
Clear
61° wxIcon
Hi: 77° Lo: 52°
Feels Like: 61°
WAAY Radar
WAAY WAAY-TV Cam
WAAY Temperatures

Alabama Coronavirus Cases

Confirmed Cases: 128818

Reported Deaths: 2284
CountyConfirmedDeaths
Jefferson18911337
Mobile13039289
Montgomery8628173
Madison750775
Tuscaloosa7180114
Lee570559
Shelby564550
Baldwin504749
Marshall382143
Etowah333447
Calhoun332039
Morgan318126
Houston269922
Elmore251947
DeKalb234619
St. Clair221335
Walker220780
Talladega205026
Limestone197319
Cullman183017
Franklin174128
Dallas173626
Russell17112
Autauga167324
Lauderdale164133
Colbert159326
Escambia155725
Blount154214
Jackson149411
Chilton147127
Dale132743
Covington130227
Coffee12708
Pike11519
Tallapoosa113183
Chambers112342
Clarke104917
Marion93728
Butler90838
Barbour8307
Marengo69919
Winston69912
Lowndes64527
Pickens63114
Bibb62810
Hale61228
Randolph60712
Bullock58514
Lawrence58220
Monroe5758
Geneva5634
Cherokee55516
Washington54413
Perry5376
Clay5367
Wilcox53011
Conecuh52311
Crenshaw52231
Macon47620
Henry4674
Fayette4189
Sumter41819
Lamar3452
Choctaw34412
Cleburne3206
Greene30015
Coosa1613
Out of AL00
Unassigned00

Tennessee Coronavirus Cases

Confirmed Cases: 181439

Reported Deaths: 2216
CountyConfirmedDeaths
Shelby29800446
Davidson25840289
Hamilton903388
Rutherford890287
Knox880672
Williamson503036
Sumner462993
Wilson331841
Putnam301937
Montgomery292243
Bradley281816
Out of TN281123
Unassigned28036
Madison259656
Sevier250013
Blount242523
Maury218323
Robertson215133
Washington212332
Sullivan203831
Hamblen183125
Tipton171117
Trousdale16477
Hardeman151325
Gibson149219
Wayne14785
Bedford129516
Dyer125312
Dickson117612
Cumberland114317
Anderson111711
Fayette111118
Carter110827
Weakley110419
Henderson110119
Loudon10996
Greene107936
Coffee106912
Obion10669
Jefferson105114
McMinn104524
Macon100719
Warren9977
Monroe99416
Hardin95414
Lawrence93911
Lauderdale92815
Haywood90016
Franklin8757
Lake8712
Bledsoe8444
Roane8284
Carroll81617
Cheatham78410
McNairy78316
Rhea76611
White7639
Hawkins74716
Cocke7309
Marshall6985
Overton6734
Smith66910
Johnson6352
Henry5949
Chester5769
Lincoln5761
Giles54917
DeKalb54111
Hickman5154
Crockett49719
Marion4937
Decatur4556
Claiborne4234
Fentress4223
Campbell4153
Polk37511
Grainger3462
Benton3319
Union3311
Jackson3024
Morgan3023
Unicoi2741
Cannon2690
Grundy2305
Humphreys2243
Sequatchie2193
Meigs2163
Scott1972
Clay1825
Houston1780
Lewis1691
Stewart1672
Van Buren1490
Moore1451
Perry1400
Hancock1063
Pickett942

Community Events