When popular dating app Tinder pulled an Instagram and branched out of its iPhone-only shell to cater to Android users, we were pretty excited. It’s one of the hottest new dating apps out there, focusing on the local talent thanks by only showing you dateables in your area. The only problem is, the app unwittingly exposed users’ locations in a recent security faux pas. According to a Quartz report, location data isn’t readily available on the Tinder app, but was easily accessed using a simple hack, leaving various accounts vulnerable. Upon learning about this security breach last weekend, Tinder’s CEO Sead Rad released a statement: “We had a very, very, very brief security flaw that we patched up very quickly. We were not exposing any information that can harm any of our users or put our users in jeopardy.”
Tinder found out about the problem and fixed it right away – that’s good, right? Unfortunately, the security breach Tinder claims to have under control is a lot more serious than they are admitting. Appthority, which analyzes apps for security issues, found out that the dating app is still putting users’ private data at risk. “Through our automated risk analysis engines, we noticed that the dating app Tinder received a very low Appthority Trust Score,” says Kevin Watkins, CTO and co-founder of Appthority. “We decided to take a closer look and made some surprising discoveries. We found that Tinder is serving up Facebook IDs and exact birth dates in its API information without the user’s knowledge.” Their findings also show that although Tinder stopped sharing specific latitudinal and longitudinal user information, the app is still sharing their exact distance away from another users – Watkins believes that anyone with some technical chops could get another user’s Facebook ID, birth date, and exact distance, along with the last time that Tinder user submitted their geo-location. “A motivated user could track someone down by spoofing their own location several times to see how far away they are,” Watkins explains.
From Appthority’s understanding, there doesn’t seem to be any reason for Tinder to send out super-specific location information that’s exact in distance, down to the decimal point. That’s just a wide-open opportunity for a lot of stalking, kidnapping, and who knows what else – they’re all pretty scary circumstances if you think about the type of people who would use this kind of data exposure maliciously.
So should prospective online daters still use Tinder? “If you knew that strangers on Tinder could see your full name, birth date, and other info, would you still use the app? We recommend that users stop using Tinder or assume their whole Facebook profile and location are exposed,” Watkins urges. Of course, maybe you find no issues with these things being out there: You signed up for the app using Facebook, right? It stands to reason you want to be broadcasting a lot of information about yourself. Still, be wary of what this means: Someone who maybe likes you a little too much could use Tinder to find you in real life more easily than you think.
If there’s one thing to be learned from this (and the many other situations like this), it’s that one cannot be overly nitpicky when it comes to choosing what sort of personal information to unleash into the Internet wild. No matter how innovative or awesome or creative a site or app is, nothing’s fool-proof. If you’re still unconvinced, just take a look at this visual and interactive representation of 300 of the world’s biggest data breaches recently compiled by Information is Beautiful:
