News for hackers. Stuff that matters.
Re:Grindr user data has been for sale for years by nerdjon on Monday May 02, 2022 @03:05PM (#31239390)
I hate that all of these apps (Grindr and similar) appear to take security and privacy secondary... which is just insane given the market they are serving.

Sex is still considered taboo in many parts of the world and some parts of the US.

Now this, we have them using the Facebook API and them knowing every time I open the app (or did).

I have made every choice I can to reduce the privacy invasion that these companies engage in, but there are simply no alternatives for this one. I would be very surprised to find out that Scruff is actually any better.

The web based ones are likely far far worse.

I hate that this has become normal so much.

Re:Grindr user data has been for sale for years by GekkePrutser on Monday May 02, 2022 @08:23PM (#31242824)
> Sex is still considered taboo in many parts of the world and some parts of the US.

Gay sex is still illegal in 71 countries in the world. Many of them still have the death penalty

https://76crimes.com/76-countries-where-homosexuality-is-ill...

It's extremely sad how homosexuality is criminalised in such a large part of the world and it makes leaks of Grindr even more dangerous than just for the prospect of blackmail or just exposure.

Re:Grindr user data has been for sale for years by VWWHFSfQ on Monday May 02, 2022 @08:31PM (#31242873)
> It's extremely sad how love is criminalised

First of all, we need to stop characterizing it as some kind _emotional_ thing like "love". It is not an emotional thing. It's a real thing.

Re:Grindr user data has been for sale for years by GekkePrutser on Monday May 02, 2022 @08:34PM (#31242894)
I think there's nothing more profound than love in the human condition to be honest. I don't think it's not real at all. It is probably the strongest driving force in human behaviour. I didn't mean to downplay the significance.

But I changed my comment as it was not my intention to offend. On the contrary. Just saying "homosexuality" sounds distant and clinical so I said love to make it feel more real. Because really that's what it's about isn't it? For me love is what makes a relationship real. One based on just sex isn't, at least not to me.

Why would something emotional not be real? Sexual attraction is a big part of love but I think the term goes much further than that.

Re:Grindr user data has been for sale for years by VWWHFSfQ on Monday May 02, 2022 @08:52PM (#31243008)
I wasn't intending for you to change anything in your comment at all! It was very thoughtful and well-articulated and I really didn't have anything else to offer. I just always zoom in on the "love" keyword when talking about gays. It's just not a keyword term to use anymore.
Re:Grindr user data has been for sale for years by GekkePrutser on Monday May 02, 2022 @09:07PM (#31243098)
Thanks, I didn't know that.

I've heard that some American religions try to 'fit' gay feelings into their principles by telling members it's ok to feel but not to act. Perhaps this is the reason for this sentiment? That by saying "love" I subscribe to the idea that only the physical act makes it 'real'? I find that concept very strange. As if the act is more real than the feeling of love or attraction for someone. For me it's the opposite.

In any case I changed it because I was clearly expressing a sentiment I didn't want to convey. Thanks for pointing it out.

Re:Grindr user data has been for sale for years by brailsafe on Tuesday May 03, 2022 @10:45AM (#31248977)
In the context of Grindr though, ppl be fuckin for fucks sake, same with Tinder for the most part.
Re:Grindr user data has been for sale for years by SamoyedFurFluff on Monday May 02, 2022 @08:42PM (#31242954)
Emotions are real though? I’m confused. Attraction is real. Love is real. Dopamine and serotonin are real.
Re:Grindr user data has been for sale for years by csa on Monday May 02, 2022 @09:08PM (#31243105)
I’m guessing the GP was referring to the illegal aspect being not love, but sex.

It doesn’t make these laws less regressive, but it does (in most cases) somewhat limit the scope of the laws.

Re:Grindr user data has been for sale for years by orangepurple on Monday May 02, 2022 @09:00PM (#31243060)
The death penalty is not applied in the vast majority of prosecutions where it is illegal
Re:Grindr user data has been for sale for years by nvr219 on Monday May 02, 2022 @09:16PM (#31243149)
Yeah but do you really wanna roll the dice on that one
Re:Grindr user data has been for sale for years by cullenmacdonald on Monday May 02, 2022 @09:03PM (#31243077)
great!
Re:Grindr user data has been for sale for years by octodog on Monday May 02, 2022 @10:48PM (#31243893)
The laws are still coercive and discriminatory though.
Re:Grindr user data has been for sale for years by orangepurple on Wednesday May 04, 2022 @09:48AM (#31260349)
Agree
Re:Grindr user data has been for sale for years by firephonestival on Monday May 02, 2022 @03:52PM (#31240014)
If you are a startup, you cannot create a popular app in a crowded marketplace by being scrupulous about best practices.

Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

Because of the consolidated nature of the market, and the winner-takes-all nature of the industry, I really believe that it is impossible for a new entry to gain popularity and focus on hard problems like security.

This is fundamentally a problem with capital allocation and incentives. There's not much that a small team can do about it.

Re:Grindr user data has been for sale for years by throwanem on Monday May 02, 2022 @04:59PM (#31240851)
You appear to be arguing that it's better to betray your customers' intimate confidences, than to find a market you can address without doing that.

I'm sure that can't be what you are trying to say - although, if it is, I can certainly understand why you made a throwaway to say it.

Re:Grindr user data has been for sale for years by pessimizer on Monday May 02, 2022 @05:27PM (#31241170)
I'm pretty sure it's just an observation about the situation that any player in that market would find itself in, so therefore when you look at apps in that market they're shitty about privacy.

It's a comment about dating apps, not about people who decided not to go into dating apps i.e. found "a market you can address without doing that."

Re:Grindr user data has been for sale for years by firephonestival on Monday May 02, 2022 @05:18PM (#31241051)
I'm not saying it's better, but that it is unavoidable given current market conditions.

We all want our data to be handled securely, and we should try to understand why that does not happen.

Re:Grindr user data has been for sale for years by throwanem on Monday May 02, 2022 @06:08PM (#31241640)
There's a difference between understanding why people behave dishonestly, and making excuses for dishonest behavior. You're doing the second one under the color of the first.

No one has to make a dating app. I don't see how "no one else could do it without betraying their users either!" as you argue - and, again, even granting this is true, which you've done nothing thus far to show - excuses the actual betrayal that actually has occurred. If you'd like to make an argument that it does, I'd be interested to hear that.

Re:Grindr user data has been for sale for years by tdfx on Monday May 02, 2022 @07:56PM (#31242650)
I think you're shooting the messenger here. OP was explaining the incentives for the behavior we're seeing, not excusing it.
Re:Grindr user data has been for sale for years by throwanem on Monday May 02, 2022 @08:28PM (#31242858)
Maybe so. It's easy to get your blood up when you're addressing flagrantly careless behavior that substantially helps make possible the systematization of the same kind of targeted, but back then still by necessity only interpersonal and mostly opportunistic, violence that was a daily feature of your life throughout most of its first couple decades.

So, sure, the one comment to which you've directly responded here, I'll call that out of line on my part. Everything else I've said throughout these comments stands.

Re:Grindr user data has been for sale for years by tgsovlerkhgsel on Monday May 02, 2022 @08:41PM (#31242941)
He's saying that in the end, all that will be available to customers will be the unscrupulous ones - because if someone tries the other approach, they'll fail.

And there always will be someone trying the unscrupulous approach, no matter how many people decide not to.

Re:Grindr user data has been for sale for years by bombcar on Monday May 02, 2022 @05:18PM (#31241047)
I think he’s saying don’t even try, because some other company won’t bother and it’ll crush you.
Re:Grindr user data has been for sale for years by throwanem on Monday May 02, 2022 @06:10PM (#31241659)
Fine! Don't try, then. "Someone is going to do this shameful thing, therefore there is no reason why I should not do this shameful thing" isn't quite the logic of a sociopath, but only because a sociopath sees no need in the first place to excuse to himself his own immoral behavior.
Re:Grindr user data has been for sale for years by JoshuaDavid on Monday May 02, 2022 @08:00PM (#31242672)
If your attitude is "if you can't do it right, don't do it at all", that's fine. But a predictable consequence of that attitude is that, when the cost of "doing it right" is high enough, the only people who do it at all are the people who don't do it right.

The incentives are broken, and telling the people who point out that the incentives are broken that they're just making excuses for bad behavior doesn't actually fix the incentives.

Re:Grindr user data has been for sale for years by lazide on Monday May 02, 2022 @07:58PM (#31242659)
I’m pretty sure no one in this thread is saying that but you?

It’s an observation that market conditions seem to disadvantage anyone who DOESN’T do that, so unless you like spending a bunch of effort and time (and being less competitive overall because of it, and likely go nowhere), maybe spend your effort somewhere else if you don’t like to be that way.

There are a ton of markets like this. If you wanted to open a ‘good’ check cashing place for instance, go right ahead. Just don’t be surprised if you lose your shirt trying it by not being like the other, less scrupulous players.

Re:Grindr user data has been for sale for years by paulryanrogers on Monday May 02, 2022 @07:58PM (#31242657)
You appear to be taking a very uncharitable interpretation.

This thread reads to me as there may be perverse incentives due to nature of dating and capital markets that make it nearly impossible to compete while valuing security.

Re:Grindr user data has been for sale for years by bombcar on Monday May 02, 2022 @08:58PM (#31243052)
Exactly. If “do think X” is my goal, and there are zero successful moral paths to doing thing X, then the only option is to not do it.
Re:Grindr user data has been for sale for years by specialist on Tuesday May 03, 2022 @12:25AM (#31244601)
u/firephonestival is stating the obvious and much repeated: any conscientious effort will be buried by the horde of amoral and immoral players. They are not defending, excusing, or in any way minimizing the excreble outcomes of our winner-takes-all economic regime.
Re:Grindr user data has been for sale for years by nerdjon on Monday May 02, 2022 @03:55PM (#31240068)
Maybe for security (however that being second for any app is a serious issue).

But this is a conscious choice. A small team should not need to make the decision to do something like this.

Also Grindr or Scruff isn't exactly small and have a fairly devoted base that doesn't end just because they get into a relationship.

Re:Grindr user data has been for sale for years by madamelic on Monday May 02, 2022 @04:21PM (#31240389)
Users kinda suck and hate to pull out their wallets if they don't have to.

Dating apps also suck at giving compelling reasons to pay them unless the app is purposefully made worse so they can sell the functionality back.

Re:Grindr user data has been for sale for years by nerdjon on Monday May 02, 2022 @04:40PM (#31240622)
How much of that is because they have been conditioned that things should be free though?

We have 10+ years of Google, Facebook, and others handing out major tools and functionality for free because of the privacy invasion.

I have to wonder how things would have looked had that not become the norm.

As far as being purposefully made worse, yeah both apps do that. Grindr charges $100, Scruff charges $120 a year. Considering how popular both apps are I have to assume they are pulling in quite a bit of money.

Re:Grindr user data has been for sale for years by aerostable_slug on Monday May 02, 2022 @04:47PM (#31240716)
> have a fairly devoted base that doesn't end just because they get into a relationship.

At least in the US, one might imagine this is more important to users than hiding their sexual preference.

Re:Grindr user data has been for sale for years by throwanem on Monday May 02, 2022 @06:31PM (#31241903)
That's quite a claim when, until Grindr's practice of selling PII was disclosed, no one had any reason to imagine that by using the app they would be disclosing their sexual orientation and behavior. In light of that I have no idea what preference you imagine to have been meaningfully revealed here.
Re:Grindr user data has been for sale for years by aerostable_slug on Tuesday May 03, 2022 @12:48PM (#31250501)
My claim is that for a large number of Americans, it's probably worse to be outed for seeking extra-relationship (I'm not sure of the proper term) casual sex than for being gay/bi/queer. Of course, both of those could be revealed at the same time which would be quite the double-whammy to an unsuspecting partner.
Re:Grindr user data has been for sale for years by throwanem on Tuesday May 03, 2022 @06:00PM (#31254167)
Oh, I see what you mean.

I'm not sure I agree, though. In an open relationship it'd be no surprise to my partner if I were using Grindr (he probably would be too, in that case!) and I think therefore that'd be more or less orthogonal to the concern around the risk of forcible outing posed by Grindr's misuse of data. Both are certainly of concern, but I think independently so.

Re:Grindr user data has been for sale for years by fivre on Tuesday May 03, 2022 @01:25AM (#31244961)
> If you are a startup, you cannot create a popular app in a crowded marketplace by being scrupulous about best practices. > Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

understood. the only practical response to the banal corporate indifference of modern markets is ultraviolence. establish a rival dating app and send ninjas to the bedrooms of match owners to threaten their lives

hn says "there's not much a small team can do about it" but they are clearly considering only a small team of technologists and a few salespeople/growth marketers. hn has drastically discounted the impact a small team of (kunai-wielding, not mid-2010s startup recruiter speak) ninjas can have

Re:Grindr user data has been for sale for years by rhizome on Monday May 02, 2022 @05:42PM (#31241297)
>If you are a startup, you cannot create a popular app in a crowded marketplace by being scrupulous about best practices.

>Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

Match owns almost all of the dating app market because they've acquired who? Startups who created popular apps in a crowded marketplace that they don't already own.

Now, if you want to argue that you cannot create a popular app in a crowded marketplace without accepting a buyout offer from the dominant player, now that's a topic I think is worth quite a bit of discussion.

Re:Grindr user data has been for sale for years by paulryanrogers on Monday May 02, 2022 @08:00PM (#31242678)
Dating apps likely face a lot of churn because those customers who succeed cancel permanently. So for young apps burning out trying to compete it may be very hard to resist a big buyout from larger players with deeper pockets and fewer moral constraints.
Re:Grindr user data has been for sale for years by rhizome on Tuesday May 03, 2022 @02:03AM (#31245186)
On the other hand, programmingwise dating apps are simple as heck and require almost no staff (source: Match's presumptive development priorities across their apps). Wasn't Plenty of Fish famously one guy for years and years? Heck, nowadays you can even seed a new app with fake accounts even easier with thispersondoesnotexist.com. Couple that with Facebook's GPT-3'ish release today[1] and you can probably create some pretty convincing activity, including messaging.

1: https://news.ycombinator.com/item?id=31243569

Re:Grindr user data has been for sale for years by ramesh31 on Monday May 02, 2022 @04:13PM (#31240290)
>I really believe that it is impossible for a new entry to gain popularity and focus on hard problems like security.

Well, they can. New entrants to the dating app market always start out this way. They gain loads of initial trust and word of mouth growth by putting users first. But they inevitably fall victim to the same market forces as their competition, and slowly become the same thing. It happened to Tinder, it happened to Bumble, and it will happen to Hinge.

Re:Grindr user data has been for sale for years by rchaud on Monday May 02, 2022 @04:38PM (#31240593)
Or they get acquired by the Match company (Tinder, OKC, Match.com, others) and just start poisoning the UX straight away.
Re:Grindr user data has been for sale for years by rootusrootus on Monday May 02, 2022 @04:59PM (#31240857)
> Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

Sounds like a business opportunity.

Re:Grindr user data has been for sale for years by makeitdouble on Monday May 02, 2022 @08:34PM (#31242900)
Google owns most of the search space, it’s an even bigger business opportunity!
Re:Grindr user data has been for sale for years by upwardbound on Monday May 02, 2022 @08:52PM (#31243014)
Ok sure but the point nerdjon and GekkePrutser are making (which I agree with 1,000%) is that it's super selfish to prioritize "creating a popular app" at all costs over protecting people's actual lives. Creating a popular app is great but don't risk the lives of your users!! That should go without saying!
Re:Grindr user data has been for sale for years by Spooky23 on Monday May 02, 2022 @07:31PM (#31242495)
That’s bullshit. Being incompetent isn’t a success factor - you’re not gonna beat Match.com by allowing people to steal your customer data.
Re:Grindr user data has been for sale for years by lazide on Monday May 02, 2022 @08:00PM (#31242674)
That’s now what they’re saying . They’re saying if customer data security won’t be a deciding factor, you’ll lose by focusing on that instead of what IS the deciding factor.

People still use Grindr a ton even though these security issues have been well known for years and in most areas users have real concerns for their safety and lives if they’re caught using it, so I can’t say they’re wrong.

Re:Grindr user data has been for sale for years by aeyes on Monday May 02, 2022 @10:36PM (#31243790)
Little known fact: Facebook Dating doesn't sell any subscriptions, there are no limitations behind a paywall. They probably have the best security but I guess you could argue that Facbebook sells your data in other ways.

It is actually what I would expect from a dating site. Match group apps look more like a vehicle that only exists to transfer money from your pocket into theirs.

Re:Grindr user data has been for sale for years by specialist on Tuesday May 03, 2022 @12:16AM (#31244548)
Move fast and break society.
Re:Grindr user data has been for sale for years by aaomidi on Monday May 02, 2022 @03:26PM (#31239656)
Eventually EU is going to ban data warehousing for any purpose other than storing and giving it back to the user.

And honestly, I think it's necessary.

Re:Grindr user data has been for sale for years by doliveira on Monday May 02, 2022 @04:06PM (#31240206)
I really hope so. Maybe this will yield better privacy-preserving schemes for data analysis and recommendation engines. Necessity is the mother of invention (or whatever the equivalent idiom is in English).

I think I'm hardly making an original argument, but a big problem is binding Compute and Data, so companies have an incentive to hoard as much data as possible and keep it hostage. Feels like deep down that's the whole valuation of Silicon Valley

Re:Grindr user data has been for sale for years by aaomidi on Monday May 02, 2022 @07:38PM (#31242536)
I worked on Prio, now divvi up by ISRG. I don't even think that was really the best solution out there, but certainly better than the status quo.

Honestly I should look to see if there's places that are working on privacy preserving metrics systems and apply.

Re:Grindr user data has been for sale for years by doliveira on Thursday May 05, 2022 @06:20PM (#31279018)
Didn't know Prio, seems like an interesting approach. I also would like to work with these problems someday. As a layman, I'd love to see something like fully homomorphic encryption taking over.

But in the end, IMHO what really needs to happen is to enable full data ownership. The semantic web, there was also another project by Tim Berners Lee...

Re:Grindr user data has been for sale for years by perfunctory on Monday May 02, 2022 @03:30PM (#31239701)
Why do you think the EU will do it?
Re:Grindr user data has been for sale for years by dspillett on Monday May 02, 2022 @03:42PM (#31239865)
They are the closest to doing it than anywhere else at least, and still edging in the direction of greater regulation not less or on a plateau.
Re:Grindr user data has been for sale for years by ajsnigrutin on Monday May 02, 2022 @05:54PM (#31241462)
Because most of that kind of industry is US based, and they earn money from EU users, so on one hand, you seem to be working "for the people", on the other hand, you fuck the americans :)
Re:Grindr user data has been for sale for years by OkayPhysicist on Monday May 02, 2022 @03:44PM (#31239901)
Probably because they're the jurisdiction that's taking user privacy rights the most seriously so far, with enough market share to leverage their demands.
Re:Grindr user data has been for sale for years by raxxorraxor on Tuesday May 03, 2022 @03:54AM (#31245813)
The EU doesn't everything right in the digital sphere but at least some parts of it understand the importance of privacy.

Of course there is an opposition that believes this hinders digital development in Europe, which is quite slow or nonexistent, but that is also often caused by said opposition itself instead of privacy laws. Because the few digital experts need all their energy in fighting their ideas and corruption.

Re:Grindr user data has been for sale for years by baisq on Monday May 02, 2022 @04:50PM (#31240759)
They don’t have a tech industry so they have nothing to lose from it.
Re:Grindr user data has been for sale for years by chimeracoder on Monday May 02, 2022 @08:44PM (#31242968)
> I hate that all of these apps (Grindr and similar) appear to take security and privacy secondary.... I would be very surprised to find out that Scruff is actually any better.

The average case is quite bad, but I wouldnt generalize it to quite every app. Scruff, for example, does take privacy seriously - both in rhetoric and in their user-visible design decisions.

That's not to say there might not be vulnerabilities (which could be said about any company or service), but they don't treat it as a secondary priority.

Grindr, on the other hand, is actively malicious with how aggressively it sells and/or exposes user data willfully.

Re:Grindr user data has been for sale for years by nerdjon on Tuesday May 03, 2022 @09:36AM (#31248122)
Maybe I am just jaded by Grindr (and even non hookup apps) at this point.

But I just take Scruff's words with a grain of salt at this point. There is so much that they can do server side that we can't block.

A big part of me thinks it is just inevitable until something like this comes out about Scruff. I don't want to think that... but we have been burned way too many times by apps. Look at what came out about several mental health apps a few days ago.

Re:Grindr user data has been for sale for years by tomc1985 on Monday May 02, 2022 @04:22PM (#31240392)
There's a few other sites that are good for hookups, but I wouldn't trust any apps. Sniffies and A4A are the ones I know of
Re:Grindr user data has been for sale for years by nerdjon on Monday May 02, 2022 @04:38PM (#31240591)
I don't imagine sniffies, a4a, MH, bbrts (for anyone reading, please don't look these up while at work... or at least not on a work computer... these are all Gay hookup sites) is any better. Particularly the first one when it comes to location data considering it just legit shows a map if people.

I really don't trust any of them (App or Website), enough so I have seriously contemplated getting an iPod touch or something and tethering anytime I want to use them. But I have not quite gone that far yet.

There are certain conveniences the apps get you.

Re:Grindr user data has been for sale for years by tomc1985 on Monday May 02, 2022 @09:18PM (#31243179)
There's less data tying you to your identity with the web apps, and you can use an adblocker to reduce your profile even further. The location data is troubling but I've seen at least one of those randomize the pin slightly each time it updates your location, though in a circle radius so I guess you could triangulate it by staring at the pin a bunch.
Re:Grindr user data has been for sale for years by nerdjon on Tuesday May 03, 2022 @09:33AM (#31248095)
I am not entirely sure I by there being less data. I don't allow Grindr or Scruff access to anything on my phone. Even for photos I use the iOS feature to limit what photos they can see. The only real difference between the... accepted profile structure. Grindr and Scruff tend to be face...ish pictures vs Sniffles that is... not.

Facebook and Google have become very good at tracking you across the web. Sniffles has ads (admittedly all of them are to sign up for premium but I don't know how those ads are served... I have not looked).

So add in google fonts or some other tracking mechanism and suddenly you have a ton of data to tie someone too a website that is meant to be anon. (more or less, I know its not quite that simple but I don't think being on the web makes it necessarily any better)