News for hackers. Stuff that matters.
Re:Grindr Shares Personal Information With Third-Parties by JumpCrisscross on Monday April 02, 2018 @12:49PM (#16736300)
Even within its confines, Grindr's data are rich for blackmail. (Consider: images and messages sent and received within 100 feet of Capitol Hill.) It was recently acquired by an offshore billionaire [1].

[1] https://www.bloomberg.com/news/articles/2016-01-12/china-tec...

Re:Grindr Shares Personal Information With Third-Parties by rdtsc on Monday April 02, 2018 @02:02PM (#16737228)
Yikes. Combine this with the Chinese OPM hack, where extremely personal data for most government employees with security clearance has been stolen, and they have a blackmail goldmine on their hands.

https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

They can verify what has been reported on sf-86 vs what might be found from this service. Any affairs or issues not reported are ripe for blackmail. Possibilities are endless as they say.

Re:Grindr Shares Personal Information With Third-Parties by kbenson on Monday April 02, 2018 @06:01PM (#16739806)
You know, maybe we'll actually see some legislation on personal information and privacy and how it must be handled over time and in acquisitions sooner than later. I Facebook's problems were promising in this respect, but with the additional disclosures happening so often, and especially in situations like this, we might see some real change for the better soon.

If so, I consider all those that had their Grindr info stolen or even just acquired by individuals that may have less moral qualms about selling it to those that would use it for ill patriots who suffered for us all.

Re:Grindr Shares Personal Information With Third-Parties by flukus on Monday April 02, 2018 @08:10PM (#16740678)
> You know, maybe we'll actually see some legislation on personal information and privacy and how it must be handled over time and in acquisitions sooner than later.

Depending on how many influential people they can black mail already, it could be too late. A would be blackmailer isn't going to give up their method of control.

Re:Grindr Shares Personal Information With Third-Parties by kbenson on Monday April 02, 2018 @08:36PM (#16740850)
A would-be blackmailer isn't going to want competition. They've already got their material, and a law changing future exposure would have little to no effect on them, so get it while the getting's good, then close the door in the face of the next guy.
Re:Grindr Shares Personal Information With Third-Parties by GVIrish on Monday April 02, 2018 @02:26PM (#16737578)
I feel like it's only a matter of time before we see some devastating compromise(s) of security using the OPM hack and/or hacks of private data sources.

When you look at some of the common methods intelligence adversaries use to ensnare assets (extortion, money, exploiting sympathies, stroking egos, revenge, etc.) the information in these hacks are a treasure trove the likes of which may never have been seen before. I can't imagine the various powers that be in the US Gov't are ready for the espionage threat posed by this..

Re:Grindr Shares Personal Information With Third-Parties by Analemma_ on Monday April 02, 2018 @03:18PM (#16738185)
> I feel like it's only a matter of time before we see some devastating compromise(s) of security using the OPM hack and/or hacks of private data sources.

I'm willing to bet that the devastating compromises thanks to the OPM hack have already happened, and that they're either classified, or, even scarier, the USG doesn't even know about them yet (e.g. people blackmailed into being spies who haven't yet been caught).

Re:Grindr Shares Personal Information With Third-Parties by GVIrish on Monday April 02, 2018 @03:26PM (#16738282)
Yeah it is really frightening to think about. Cautious moles were hard to catch even before some of these breaches. There could be an exponential increase of compromised people in cleared environments and like you said, we might not even be aware yet.

And even then, our counter-espionage resources in all likelihood are not enough to address a massive increase in the threat.

Re:Grindr Shares Personal Information With Third-Parties by koheripbal on Monday April 02, 2018 @06:03PM (#16739827)
We should look out for suicides. Someone who's given the choice between destroying his family and betraying his country might be pretty likely to off himself.
Re:Grindr Shares Personal Information With Third-Parties by ams6110 on Monday April 02, 2018 @04:57PM (#16739204)
If the Chinese have compromising information, the NSA and/or CIA probably has the same and more. I think it's unlikely that we don't "know" about it, in fact could be using it as a way to turn compromised individuals into double agents.
Re:Grindr Shares Personal Information With Third-Parties by smacktoward on Monday April 02, 2018 @03:22PM (#16738237)
Think of it as a business opportunity. Blackmail as a Service™!
Re:Grindr Shares Personal Information With Third-Parties by wukerplank on Monday April 02, 2018 @04:51PM (#16739147)
The free market in full swing!
Re:Grindr Shares Personal Information With Third-Parties by tekism on Monday April 02, 2018 @05:38PM (#16739631)
BMaaS
Re:Grindr Shares Personal Information With Third-Parties by stevehawk on Tuesday April 03, 2018 @09:29AM (#16744403)
Uh, none of this would be on an SF86. You don't report affairs or dating on an SF86. They could still correlate membership and expose anyone who is private about their sexuality or hobby, but they won't be able to say "omg you didn't tell the government you banged Paul!"
Re:Grindr Shares Personal Information With Third-Parties by rdtsc on Tuesday April 03, 2018 @01:00PM (#16746691)
You're right, that specific stuff is not on sf-86. But was pessimistic that more than just sf-86 was exfiltrated. From the wiki saw "that OPM systems containing information related to the background investigations of current, former, and prospective federal government employees, to include U.S. military personnel, and those for whom a federal background investigation was conducted, may have been exfiltrated". I read that as notes from people doing the background checks, which would include some of that kind of information.
Re:Grindr Shares Personal Information With Third-Parties by jimmy1 on Monday April 02, 2018 @05:00PM (#16739237)
Why is this a blackmail goldmine? I am ignorant of Grindr, but what I have heard it is basically Tinder but for gay men. Would Tinder be blackmail data? It's hook ups and relationships, dating, etc, no?
Re:Grindr Shares Personal Information With Third-Parties by rdtsc on Monday April 02, 2018 @05:42PM (#16739663)
> but what I have heard it is basically Tinder but for gay men. Would Tinder be blackmail data? It's hook ups and relationships, dating, etc, no?

Absolutely when cross-referenced with information from OPM database. Employee with TS/SCI clearance working on a <military project X> hasn't reported reported his gay affairs (that his wife might not know about even). The Chinese find out, approach him and make him an offer "Look buddy, how 'bout we become friends. You just tell us what you know and we'll give you some money and most importantly keep quiet about your meeting with your secret partner on such and such dates or places?"

Re:Grindr Shares Personal Information With Third-Parties by crankylinuxuser on Monday April 02, 2018 @07:06PM (#16740265)
And that's why lack of blackmailability is one of the biggies on clearance applications.

Or, "Lets not become friends. You can tell my wife. She thought it'd be fun to do that!" aaaaand so much for that blackmail. And just don't forget to tell the security officer that someone tried funny shit.

Re:Grindr Shares Personal Information With Third-Parties by rdtsc on Monday April 02, 2018 @10:43PM (#16741477)
Normally yeah, nothing wrong with the lifestyle as long as it is declared and is known and no fear of it being exposed. Except that the Chinese got their hands on the OPM database so they tell what is declared there and what isn't. If they didn't disclose these things there, they'd still hopefully run to the security officer and report but they might be think again since they'd be in hot water as well for lying before.
Re:Grindr Shares Personal Information With Third-Parties by macintux on Monday April 02, 2018 @05:07PM (#16739308)
Being gay is still a sensitive subject in the U.S., moreso in many other parts of the world.

And I'd suspect that there are more than a few married (nominally heterosexual) men seeking out extramarital affairs on Grindr.

Re:Grindr Shares Personal Information With Third-Parties by protomyth on Monday April 02, 2018 @08:23PM (#16740763)
It is more than a sensitive subject in certain other countries, and I can only imagine the horror of someone who is in the US as a visitor of some sort being revealed to be a Grindr user.
Re:Grindr Shares Personal Information With Third-Parties by fbonetti on Monday April 02, 2018 @05:07PM (#16739307)
You really can't imagine any scenario in which this information could be used for blackmail?
Re:Grindr Shares Personal Information With Third-Parties by loceng on Monday April 02, 2018 @01:08PM (#16736561)
Makes me think that data should be treated differently in the case of a potential new owner, allowing users to opt-out from their data from being transferred; you may trust the leadership and governance, and may not trust whomever takes over or who will newly has access to the data.
Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @01:18PM (#16736676)
Change of control is a huge problem when it comes to privacy sensitive data. That's also a big factor in why I have a problem with governments collecting data. You may trust the present day administration (or not...), but who knows what a future administration (or occupying force) is going to be up to (beside the obvious risk of a leak or a breach).

The same goes for situations like bankruptcies and 'bad leavers', there is absolutely no way short of airtight procedures and implementations to guard your privacy over the length the data resides with some company. And for most companies that means 'forever' so even the smallest chances tend to sooner or later materialize. In almost every company that I've looked at over the last couple of years (including medical, fintech and so on) there was always at least one person and usually more that had unfettered access to all the data, either in bulk or through some convenient interface.

I'm not even sure this can be fixed anymore, but I am also not going to give up.

Re:Grindr Shares Personal Information With Third-Parties by seszett on Monday April 02, 2018 @02:18PM (#16737470)
> That's also a big factor in why I have a problem with governments collecting data. You may trust the present day administration (or not...), but who knows what a future administration (or occupying force) is going to be up to

The standard example is how the Netherlands were rather religiously tolerant, but used to keep track of Jews for tax collection purposes before WW2. Then when the Nazis arrived, they had all the records they needed to achieve their goals.

Who knows what will happen in the future, and how currently harmless data could be used by new actors then.

Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @02:43PM (#16737797)
> The standard example is how the Netherlands were rather religiously tolerant, but used to keep track of Jews for tax collection purposes before WW2.

I wrote about that exact example:

https://jacquesmattheij.com/if-you-have-nothing-to-hide

Re:Grindr Shares Personal Information With Third-Parties by weaksauce on Monday April 02, 2018 @03:54PM (#16738625)
Why did they keep those records? Different tax rates for different religions? Seems like none of their business.
Re:Grindr Shares Personal Information With Third-Parties by seszett on Monday April 02, 2018 @04:13PM (#16738819)
I thought it was for this reason, though the sibling comment's link seems to indicate that we don't really know (and I trust him more than my memory).

It used to be common to tax different religions in a different way in some countries of Europe. Even today in Germany you are legally required to pay taxes to your church, and I have read multiple accounts of French expatriates who have discovered this only after a year of working in Germany, and getting significant amounts of back taxes to pay, as well as being required to be debaptised, etc, if they wanted to stop paying for that.

In France that would be unthinkable, but every country has its customs.

Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @06:50PM (#16740189)
The way in which the German government has been co-opted by the church to act as their debt collectors is fairly disgusting and no longer of this day and age.
Re:Grindr Shares Personal Information With Third-Parties by bobthechef on Monday April 02, 2018 @08:24PM (#16740767)
I don't agree that such a tax is a good idea, but consider the following:

1. If it bothers the Germans, why don't they change it? Is there some concordat that makes it difficult?

2. Do I really have a right to comment given that I'm not German? Does it really makes sense for you to apply what are presumably post-revolution, secular French standards to Germany?

3. "co-opted by the church to act as their debt collectors " -- sounds conspiratorial. You think the Church is all-powerful and able to do that? Tithing isn't new.

4. "disgusting and no longer of this day and age" -- appeals to time period are rather silly. We're not talking about fashion, and it's important not to fall prey to the Idol of Progress.

5. Interesting that more religious countries, like Germany's neighbor Poland, have no such tax.

Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @09:42PM (#16741218)
> If it bothers the Germans, why don't they change it? Is there some concordat that makes it difficult?

The church is still very powerful in Germany.

> Do I really have a right to comment given that I'm not German?

You have a right to your opinion about what is happening in a country even if you are not living there.

> Does it really makes sense for you to apply what are presumably post-revolution, secular French standards to Germany?

It is fairly exceptional to see the state harnessed to do a private institution's bidding like this.

> "co-opted by the church to act as their debt collectors " -- sounds conspiratorial. You think the Church is all-powerful and able to do that? Tithing isn't new.

That it isn't new doesn't mean there is a place for it today. The state and the church should be firmly separated. In Germany this is - not yet - the case.

> "disgusting and no longer of this day and age" -- appeals to time period are rather silly. We're not talking about fashion, and it's important not to fall prey to the Idol of Progress.

It's not the 15th century any more.

> Interesting that more religious countries, like Germany's neighbor Poland, have no such tax.

My point exactly.

Re:Grindr Shares Personal Information With Third-Parties by ggg9990 on Monday April 02, 2018 @07:40PM (#16740494)
Well if you don’t think it’s a big deal, you may collect it just to have the data (data was as appealing to bureaucrats 200 years ago as it is to big-data engineers today). For example the DMV asks for your height and weight today, but if a fat-hating government came to power and decided to kill all fat people, they would have a target list that was of very questionable value for the DMV to collect in the first place.
Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @05:55PM (#16739754)
To be able to give the proper last rights absent any other family. Just in case...
Re:Grindr Shares Personal Information With Third-Parties by rmc on Monday April 02, 2018 @03:11PM (#16738113)
EU's data protection law covers this.
Re:Grindr Shares Personal Information With Third-Parties by loceng on Monday April 02, 2018 @06:36PM (#16740089)
If so, that's great.
Re:Grindr Shares Personal Information With Third-Parties by kayfox on Monday April 02, 2018 @01:15PM (#16736639)
You can delete the data from your profile.
Re:Grindr Shares Personal Information With Third-Parties by moate on Monday April 02, 2018 @01:28PM (#16736786)
Do you have any idea how hard/illegal it is to hack into those servers and manually delete every file relating to JUST your profile without alerting an admin?
Re:Grindr Shares Personal Information With Third-Parties by y4mi on Monday April 02, 2018 @01:38PM (#16736902)
You forgot the cold storage backups. Its just plain impossible with anything more serious than a hobby project.
Re:Grindr Shares Personal Information With Third-Parties by loceng on Monday April 02, 2018 @06:35PM (#16740074)
Made me laugh - thank you.
Re:Grindr Shares Personal Information With Third-Parties by bognition on Monday April 02, 2018 @01:19PM (#16736686)
lol, that means nothing. It most likely means that data is marked as deleted but the original values are retained.
Re:Grindr Shares Personal Information With Third-Parties by kayfox on Monday April 02, 2018 @01:22PM (#16736724)
Well, you could also just not fill it out in the first place.

To be clear, this is public profile information displayed to any user of the Grindr app.

Re:Grindr Shares Personal Information With Third-Parties by hluska on Monday April 02, 2018 @01:39PM (#16736916)
Except that if a user fills in a Grindr profile, they believe they are only sharing information with Grindr/its users. The truth is that they share all of the information (in less than secure ways) with a variety of third parties and fail to disclose that fact. That's illegal in many countries (including mine) and it demonstrates an unbelievable lack of regard for user privacy or safety.
Re:Grindr Shares Personal Information With Third-Parties by chimeracoder on Monday April 02, 2018 @02:00PM (#16737199)
> That's illegal in many countries (including mine) and it demonstrates an unbelievable lack of regard for user privacy or safety.

There's a very strong chance that this is illegal in many states in the US as well (not sure about federal law).

Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @01:43PM (#16736979)
Not only does it get shared, it gets shared in bulk. That's a huge difference between the intended use and what actually happens.
Re:Grindr Shares Personal Information With Third-Parties by jacquesm on Monday April 02, 2018 @01:18PM (#16736680)
Correction: you can mark it as deleted.
Re:Grindr Shares Personal Information With Third-Parties by exelius on Monday April 02, 2018 @02:00PM (#16737195)
Reminds me of the relationship between the Mafia and the homosexual community of the early-mid 20th century. The Mafia didn’t particularly like gays, but they ran all of the gay bars because it gave them the opportunity to blackmail their patrons.
Re:Grindr Shares Personal Information With Third-Parties by JumpCrisscross on Monday April 02, 2018 @02:16PM (#16737432)
> The Mafia didn’t particularly like gays, but they ran all of the gay bars because it gave them the opportunity to blackmail their patrons

Source? Curious to read more about this.

Re:Grindr Shares Personal Information With Third-Parties by DoreenMichele on Monday April 02, 2018 @02:24PM (#16737539)
The Mafia controlled most gay bars due to their illegal status, and extracted a monetary premium from the gay community. This recognized both the legal risk the Mob was taking and the near-monopoly status it enjoyed. After all, where else were gay folks going to meet? There were often high cover charges and minimum drink requirements. Moreover, gay men were at risk of blackmail from their Mob overlords

https://www.vice.com/en_us/article/gqmym3/how-the-mafia-once...

I had never heard this before, but it is easy enough to find it. There are at least a couple of other articles that readily came up.

Re:Grindr Shares Personal Information With Third-Parties by paulie_a on Monday April 02, 2018 @02:37PM (#16737726)
The "Stuff you should know" podcast discussed that on the stonewall uprising episode.

Blackmail probably existed but it was just a great opportunity to sell drugs and booze in illegal bars.

Re:Grindr Shares Personal Information With Third-Parties by Spooky23 on Monday April 02, 2018 @06:26PM (#16740002)
More than that... Bars are great targets for mafia types. My grandfather ran a bar in NYC in the 40s-70s... Any business concession other than the phone company was mob controlled. The cigarette machine, jukebox, tap cleaner, pinball, ice was mob controlled.

When you hit the nadir of NYC in the 70s, it was difficult to make sales tax payments with all of the leeches attached to the business.

Re:Grindr Shares Personal Information With Third-Parties by DarkIye on Tuesday April 03, 2018 @08:53AM (#16744145)
"At the time of the 1969 Stonewall Uprising, the Greenwich Village bar Stonewall Inn was owned and operated by the New York Mafia."

http://www.pbs.org/wgbh/americanexperience/features/stonewal...

Re:Grindr Shares Personal Information With Third-Parties by lopmotr on Monday April 02, 2018 @09:40PM (#16741208)
The fact they could be blackmailed means the rest of the society didn't like them either. If a minority is doing something today that the rest of society thinks is wrong but actually isn't, then don't we have a more serious problem already by persecuting whoever is the modern equivalent of early 1900's gays?
Re:Grindr Shares Personal Information With Third-Parties by exelius on Thursday April 05, 2018 @01:01AM (#16761909)
Totally different things and it’s almost an offensive comparison.

Someone’s HIV status, for example, could definitely expose them to social stigma. Is that a problem? Yeah; but it doesn’t change human behavior — there are some things we would prefer to keep private.

Re:Grindr Shares Personal Information With Third-Parties by DataWorker on Tuesday April 03, 2018 @03:01AM (#16742452)
Wasn’t that the case with Jack Ruby?
Re:Grindr Shares Personal Information With Third-Parties by api on Monday April 02, 2018 @04:45PM (#16739108)
I've hypothesized that the recent blast of negative press about Facebook and other social media companies like this is driven in part by the realization at the heights of US intelligence that these massive surveillance honeypots are a threat to US national security.

If that's the case I agree with them. How many people with secret and top secret clearance have exploitable (or compromised by design) 'smart' devices in their home or could be blackmailed using data in possession of these services? Then there's the whole mass election manipulation angle which just adds to the problem.

The social and 'smart device' panopticon opens the potential for a completely remote cyber-invasion and takeover of the country by a foreign actor. It would be the first full-scale invasion with not only no shots fired but no actual physical army on the ground. I don't think this is really all that sci-fi.

Re:Grindr Shares Personal Information With Third-Parties by andrei_says_ on Monday April 02, 2018 @02:26PM (#16737577)
Makes me wonder, what would it take to legislate the use of personal information?

Maybe we are getting close to this point?

Seems like situations that result in direct pressure on the legislators would be more productive than ones involving us, their “employers”...

Re:Grindr Shares Personal Information With Third-Parties by swombat on Monday April 02, 2018 @02:43PM (#16737808)
It’s already legislated in Europe. The new law, GDPR, is coming into force in May across the EU.
Re:Grindr Shares Personal Information With Third-Parties by mbesto on Monday April 02, 2018 @04:00PM (#16738685)
Another data point on why you should not take money or sell your business to Chinese investors. Their price points for pricing companies is strange (e.g. a lot higher than western pricing) and it would make sense that they're doing it for other, perhaps more nefarious, reasons.
Re:Grindr Shares Personal Information With Third-Parties by monochromatic on Monday April 02, 2018 @06:05PM (#16739836)
If I’m selling my company and a Chinese buyer offers me more, I’m not going to turn him down just because he’s Chinese.
Re:Grindr Shares Personal Information With Third-Parties by dwaltrip on Tuesday April 03, 2018 @02:55AM (#16742434)
The question doesn't mean much without knowing more details.

In general, most people would say that the short-term financial outcome is not the only important factor.

Re:Grindr Shares Personal Information With Third-Parties by HeyLaughingBoy on Thursday April 05, 2018 @11:58AM (#16766078)
They may say that, but they're probably still going to take the short-term financial outcome because there's no discernible long-term downside for them.
Re:Grindr Shares Personal Information With Third-Parties by DataWorker on Tuesday April 03, 2018 @09:38AM (#16744466)
Your patriotism and integrity are noted. The things some people will do for a buck tells you all you need to know about unregulated trade.
Re:Grindr Shares Personal Information With Third-Parties by saagarjha on Monday April 02, 2018 @04:24PM (#16738939)
Acquisitions for a company's data is not something that's limited to China.
Re:Grindr Shares Personal Information With Third-Parties by DataWorker on Tuesday April 03, 2018 @09:40AM (#16744483)
He seems to be suggesting that they place an abnormally high valuation on that data which suggests, maybe I’m misinterpreting?, nefarious aims.
Re:Grindr Shares Personal Information With Third-Parties by ben_jones on Monday April 02, 2018 @03:41PM (#16738476)
Reminds me of the old KGB tactic where they would have agents seduce politicians and business men into compromising (recorded) sexual situations then use it for blackmail. I find it inevitable that many acting politicians on both sides of the aisle are being manipulated in this way.
Re:Grindr Shares Personal Information With Third-Parties by zrobotics on Monday April 02, 2018 @03:54PM (#16738619)
-Now, I know you're familiar with the honey pot.

-Seducing and blackmailing a hot female enemy agent. I love the honey pot.

https://www.springfieldspringfield.co.uk/view_episode_script...

Re:Grindr Shares Personal Information With Third-Parties by nzpopa on Tuesday April 03, 2018 @04:00AM (#16742693)
In this article, an investigative Romanian journalist covers the story of the "Shanghai" network in Bucharest. This network has been supplying dozens of high ranking Romanian officials with underage girls for 13 years, who in turn were instructed by the Chinese to film the sex scenes with hidden cameras, obviously for blackmail. The leader of the Shanghai network now operates the only working copper mine in Romania, extracting 100% of the copper and exporting it to China, while his citizenship was canceled 4 years ago at the request of Romania's Intelligence Service because of actions which undermine the state's democratic institutions: http://www.tolo.ro/2018/03/24/de-13-ani-filmari-cu-zeci-de-i...

Seems like blackmail works just fine!

Re:Grindr Shares Personal Information With Third-Parties by knuththetruth on Monday April 02, 2018 @04:41PM (#16739069)
That’s the business model of Cambridge Analytica nowadays!

https://www.channel4.com/news/cambridge-analytica-revealed-t...

Re:Grindr Shares Personal Information With Third-Parties by duxup on Monday April 02, 2018 @10:37PM (#16741458)
Who needs to hack government systems anymore!?!?!?