TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

I hacked a dating app (and how not to treat a security researcher)

545 点作者 bearsyankees2 天前

31 条评论

michaelteter2 天前
Not excusing this is any way, but this app is apparently a fairly junior effort by university students. While it should make every effort to follow good security (and communication) practices, I&#x27;d not be too hard on them considering how some big VC funded &quot;adult&quot; companies behave when presented with similar challenges.<p><a href="https:&#x2F;&#x2F;georgetownvoice.com&#x2F;2025&#x2F;04&#x2F;06&#x2F;georgetown-students-create-cerca-a-new-dating-app-that-swipes-right-on-safety&#x2F;" rel="nofollow">https:&#x2F;&#x2F;georgetownvoice.com&#x2F;2025&#x2F;04&#x2F;06&#x2F;georgetown-students-c...</a>
评论 #43966578 未加载
评论 #43965782 未加载
评论 #43966281 未加载
评论 #43967558 未加载
评论 #43968803 未加载
评论 #43969670 未加载
评论 #43965723 未加载
评论 #43966222 未加载
评论 #43965600 未加载
评论 #43966035 未加载
SpaceL10n2 天前
I worry about my own liability sometimes as an engineer at a small company. So many businesses operate outside of regulated industries where PCI or HIPAA don&#x27;t apply. For smaller organizations, security is just an engineering concern - not an organizational mandate. The product team is focused on the features, the PM is focused on the timeline, QA is focused on finding bugs, and it goes on and on, but rarely is there a voice of reason speaking about security. Engineers are expected to deliver tasks on the board and litte else. If the engineers can make the product secure without hurting the timeline, then great. If not, the engineers end up catching heat from the PM or whomever.<p>They&#x27;ll say things like...<p>&quot;Well, how long will that take?&quot;<p>or, &quot;What&#x27;s really the risk of that happening?&quot;<p>or, &quot;We can secure it later, let&#x27;s just get the MVP out to the customer now&quot;<p>So, as an employee, I do what my employer asks of me. But, if somebody sues my employer because of some hack or data breach, am I going to be personally liable because I&#x27;m the only one who &quot;should have known better&quot;?
评论 #43966875 未加载
评论 #43966760 未加载
评论 #43966170 未加载
评论 #43966467 未加载
评论 #43966356 未加载
评论 #43966138 未加载
评论 #43966741 未加载
andrelaszlo2 天前
Oops! Nice find!<p>To limit his legal exposure as a researcher, I think it would have been enough to create a second account (or ask a friend to create a profile and get their consent to access it).<p>You don&#x27;t have to actually scrape the data to prove that there&#x27;s an enumeration issue. Say your id is 12345, and your friend signs up and gets id 12357 - that should be enough to prove that you can find the id and access the profile of any user.<p>As others have said, accessing that much PII of other users is not necessary for verifying and disclosing the vulnerability.
评论 #43966460 未加载
mtlynch2 天前
This is a pretty confusing writeup.<p>&gt;<i>First things first, let’s log in. They only use OTP-based sign in (just text a code to your phone number), so I went to check the response from triggering the one-time password. BOOM – the OTP is directly in the response, meaning anyone’s account can be accessed with just their phone number.</i><p>They don&#x27;t explain it, but I&#x27;m assuming that the API is something like api.cercadating.com&#x2F;otp&#x2F;&lt;phone-number&gt;, so you can guess phone numbers and get OTP codes even if you don&#x27;t control the phone numbers.<p>&gt;<i>The script basically just counted how many valid users it saw; if after 1,000 consecutive IDs it found none, then it stopped. So there could be more out there (Cerca themselves claimed 10k users in the first week), but I was able to find 6,117 users, 207 who had put their ID information in, and 19 who claimed to be Yale students.</i><p>I don&#x27;t know if the author realizes how risky this is, but this is basically what weev did to breach AT&amp;T, and he went to prison for it.[0] Granted, that was a much bigger company and a larger breach, but I still wouldn&#x27;t boast publicly about exploiting a security hole and accessing the data of thousands of users without authorization.<p>I&#x27;m not judging the morality, as I think there should be room for security researchers to raise alarms, but I don&#x27;t know if the author realizes that the law is very much biased against security researchers.<p>[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Goatse_Security#AT&amp;T&#x2F;iPad_email_address_leak" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Goatse_Security#AT&amp;T&#x2F;iPad_emai...</a>
评论 #43966116 未加载
评论 #43965949 未加载
shayanbahal2 天前
I had a similar experience with another dating app, although they never got back to me. When I tried to get the founders attention by changing his bio to contact me text, they restored a backup lol<p>years later I saw their instagram ad and tried to see if the issue still exists, and yes it did. Basically anyone with the knowledge of their API endpoints (which is easy to find using the app-proxy-server) you have full on admin capabilities and access to all messages, matching, etc.<p>I wonder if I should go back and try again... :-?
评论 #43966635 未加载
nixpulvis2 天前
People need to be forced to think twice before taking in such sensitive information as a passport or even just addresses. This sort of thing cannot be allowed to be brushed off as just a bunch of kids making an app.
评论 #43966320 未加载
评论 #43966383 未加载
评论 #43966078 未加载
评论 #43968604 未加载
评论 #43965749 未加载
blantonl2 天前
Returning the OTP in the request API response is wild. Like why?
评论 #43965989 未加载
评论 #43965664 未加载
评论 #43965527 未加载
评论 #43965678 未加载
评论 #43967689 未加载
评论 #43965452 未加载
bearsyankees2 天前
<a href="https:&#x2F;&#x2F;yaledailynews.com&#x2F;blog&#x2F;2025&#x2F;04&#x2F;24&#x2F;yale-student-exposes-data-leak-in-college-dating-app&#x2F;" rel="nofollow">https:&#x2F;&#x2F;yaledailynews.com&#x2F;blog&#x2F;2025&#x2F;04&#x2F;24&#x2F;yale-student-expos...</a><p>^another article on this
评论 #43972846 未加载
ungreased06752 天前
I would like to see laws that make storing PII as dangerous as storing nuclear waste. Leaks should result in near-certain bankruptcy for the company and legal jeopardy for the people responsible.<p>That’s the best way I can think of to align incentives correctly. Right now there’s very little downside to storing as much user information as possible. Data breach? Just tweet an apology and keep going.
评论 #43966149 未加载
评论 #43967701 未加载
edm0nd2 天前
&gt; I have been met with radio silence.<p>Thats when its time to inform them you are dumping the vuln to the public in 90 days due to their silence.
评论 #43965374 未加载
评论 #43965518 未加载
评论 #43965359 未加载
92834092322 天前
There&#x27;s no penalty for failing at privacy and security so companies would rather play the odds that they will be fine than invest in proper practices. Alex says Cerca is being misleading when it comes to encryption but it seems to me they are outright lying and will likely face no consequences for it. In a more just world, this would trigger so many regulatory and compliance audits.
评论 #43965867 未加载
评论 #43965421 未加载
评论 #43965598 未加载
gwbas1c2 天前
FYI: This is more common than you think.<p>I briefly worked with a company where I had to painfully explain to the lead engineer that you can&#x27;t trust anything that comes from the browser; because a hacker can curl whatever they want.<p>Our relationship deteriorated from there. Needless to say, I don&#x27;t list the experience on my resume.
xutopia2 天前
That&#x27;s crazy to not have responded to his repeated requests!
评论 #43965190 未加载
评论 #43965306 未加载
评论 #43965227 未加载
12_throw_away2 天前
Hot take: just like real engineers, there should be a Software Engineer licensing exam that&#x27;s legally required before you can handle PII ... because this is the alternative.<p>Before I was allowed to hand out juice cups at my kids&#x27; preschool, I had to do a 2 hour food safety course and was subject to periodic inspections. That is infinity% more oversight than I received when storing highly sensitive information for ~10^5 users.
评论 #43965905 未加载
评论 #43967732 未加载
hamish-b2 天前
I&#x27;m not sure how I hadn&#x27;t heard about Charle&#x27;s Proxy for iPhone before! I&#x27;ve done some light pentesting before and had to manually result to grepping for strings throughout the app binary. Glad to have found out about this, especially for when apps are only on iOS.
评论 #43968510 未加载
swyx2 天前
&gt; Since then, I have reached out multiple times (on March 5 and March 13) seeking updates on remediation and user notification plans. Unfortunately, as of today’s publication date (April 21, 2025), I have been met with radio silence. To my knowledge, Cerca has not publicly acknowledged this incident or informed users about this vulnerability, despite their earlier assurances to me. They also never followed up with me following our call and ignored all my follow up emails.<p>there can always be another side to this story but also wtf. this kind of shit makes me want to charles-proxy every new app i run because who knows what security any random startup has
评论 #43965832 未加载
评论 #43965162 未加载
andoando2 天前
If they&#x27;re sending the OTP to the user, its because the OTP is being checked client side, so you might have been able to just call the authentication endpoint directly.
评论 #43967955 未加载
some_furry2 天前
<a href="https:&#x2F;&#x2F;archive.ph&#x2F;rOQVe" rel="nofollow">https:&#x2F;&#x2F;archive.ph&#x2F;rOQVe</a>
gxs2 天前
FYI the Hinge app works the same way<p>I requested my data and all the image URLs are publicly accessible - and the URLs provided are both your own images and the images of anyone who’d ever viewed your profile
评论 #43967698 未加载
AlienRobot2 天前
&gt;the OTP is directly in the response<p>I forgot my password.<p>Type your username:<p>Your password is hunter2.<p>Vibes.
评论 #43966630 未加载
yieldcrv2 天前
this is useful! I am considering building a dating app with its own twist and seeing the api endpoints this team went with is useful<p>under the hood they&#x27;re all the same, just with different theming and market segmentation
sillywabbit2 天前
There&#x27;s probably some benefit to having people who will tell you about security issues rather than exploit them. You can&#x27;t really blame businesses &#x2F; app devs for wanting to be left alone though.
评论 #43972553 未加载
camcil2 天前
In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure.<p>They may have &quot;patched&quot; the ability to exploit it in this way, but the plaintext data is still there in that same fragile architecture and still being handled by the same org that made all of these same fundamental mistakes in the first place. Yikes.
评论 #43966157 未加载
tuwtuwtuwtuw2 天前
I m not sure I understand properly. Did he try to hack a random service he encountered? Is that even legal? Where I live (Sweden) it&#x27;s definitely not legal.
评论 #43965809 未加载
评论 #43965259 未加载
评论 #43965316 未加载
评论 #43965357 未加载
koakuma-chan2 天前
I thought Apple was checking apps? How did this go through? In any sane jurisdiction exposing PII like that is illegal.
评论 #43965622 未加载
评论 #43965750 未加载
评论 #43965706 未加载
评论 #43965575 未加载
soco2 天前
It doesn&#x27;t even look that they tried to secure anything initially. Security by design? Ha.
sherdil20222 天前
They might not have a playbook on how to handle such reports. Doesn’t mean they shouldn’t respond. They are also probably sh*t scared about legal ramifications - but not responding only makes them look even worse. None-the-less it is amazing how many of these products and services don’t put security and user privacy first.<p>Open for discussion - What would make them pay attention?
评论 #43965836 未加载
评论 #43965311 未加载
评论 #43965210 未加载
hoseja1 天前
It used to be you matched yourself with babes if you had power over a dating app.
j452 天前
A real issue is how much data and functionality to access said data is exposed for the front end that could conveniently be held server side.
voytec2 天前
I&#x27;m flagging this submission. Look at the author[0], at the &quot;Georgetown students...&quot; (won&#x27;t backlink again) post linked below stating that Cerca was 2 months old in April, and OP&#x27;s post from April stating that they hacked this thing two months earlier.<p>It&#x27;s some self-promo or whatever scheme&#x2F;scam bullshit.<p>[0] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;from?site=alexschapiro.com">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;from?site=alexschapiro.com</a>
评论 #43965937 未加载
评论 #43966205 未加载
phyzix57612 天前
Imagine every time you entered a specific physical location you would increase your exposure to a detrimental disease. After only entering a couple of times you&#x27;ve contracted this disease and each subsequent visit to this place makes the illness worse.<p>A few people try to warn you but you choose not to listen and, in fact, you recruit the government to make it easier to enter such places with safeguards that don&#x27;t actually protect you from the disease and encourage you to enter more frequently.<p>You&#x27;re then surprised why you&#x27;re ill to the brink of death and blame the location as the sole cause for your ails. Yes, the location is to blame but so are you for continuing to enter even after getting sick.<p>Why do you do this? Because you want something. Convenience, pleasure, a distraction, etc. But you refuse to acknowledge that its killing you.<p>This is how we should view optional services that require us to give our PII data in exchange for hours of attention-grabbing content. They&#x27;re designed to sell your eyeballs and data to advertisers. You know this already but you can&#x27;t say no. You&#x27;re sick and refuse to acknowledge it.
评论 #43965870 未加载
评论 #43966002 未加载