Hacker News new | past | comments | ask | show | jobs | submit login

How could you even prevent this vulnerability?

As long as the undocumented API is publicly accessible, and Tinder intends on reporting a users distance to each other (4.5 miles), it will always be possible to triangulate the position.

The only thing I can think of is to obfuscate the user ID in a way that you cant use the ID to guarantee a lookup of the same user.




Instead of having the client use the distance data to filter out people within a certain radius, the server could do the filtering and send back the result.

Of course, you could probably do a lot of requests from different locations and intersect the results to find a more accurate position of the target with this fix too, though with some randomness to each request on the server side it will probably make it not worthwhile.


I thought Apple's Find my Friends app had a built-in 'fuzz my location by...' setting where you could do 0, 0.1, 0.2, 0.5 etc. miles. I can't find it now though and am possibly therefore misremembering it as something else.

Either way, it's trivial to take a lat and long and randomise a +/- on each value, or alternatively if you want a ciruclar error randomise a magnitude and angle and resolve the shift to lat and long.


I think it's a matter of precision of the distance measurement. If they round to the nearest mile, then the possible location is basically square mile (technically circle - closer to .8 sq miles), which is less of a privacy concern.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: