Stalking your Facebook friends on Tinder

He doesn't succumb to the temptation to be abusive (to either the people who made the thing he's testing, the people reading, or anyone who might be impacted by it), which is something a lot of security researchers seem to find impossible to avoid; there's a lot of calling people various forms of stupid in many incident reports. Even when given ample opportunity by the Tinder folks to call them names, he didn't do so (and, didn't blow it out of proportion, either...it's problematic, but if you're using Facebook and Tinder, you probably are already aware you're giving up a lot of privacy; this is a big deal, but not vastly bigger than using facebook all by itself).

He explains clearly what he did, and what tools he used to do it, which is another thing that often gets left out. Many security folks follow the magician's code ("never show'em how it's done"), and are dismissive that mere mortals could ever understand what they do.

And, he tells a good story in the process. All around, top notch technical writing about a usually boring subject.

Any social network with deteriorating privacy is bad. One where the content can potentially be sensitive is even worse. If you started on a service and it kept becoming more private by default, that's fine - potentially annoying, but fine. If you start on a service and it kept becoming more public by default, then we have a problem.

The fact that Tinder don't realize Tinder profiles may contain sensitive information for a significant portion of their user base is hugely disturbing. As stated in the article, there are so many circumstances beyond cheating that this is still an issue.

Assume for a fictional argument that I was born into a religious family, "no sex before marriage" type of thing, but enjoyed one night stands. One might use Tinder to do so quietly. Tinder didn't allow your friends to see that information before - I assumed I was safe from judgement by my family and their friends. Then Tinder rips that privacy you thought you had away!

Saying that users should have known better is not an excuse. As developers we must operate under the assumption that best practices are likely going to be missed or misunderstood. Tinder violated that in an extreme way in an attempted land grab for a large social market beyond hook-ups and dating.

Disclosure: I'm friends with the author and commented on drafts.

  curl -v -X POST 'https://api.gotinder.com/auth' -H 'Content-Type: application/json' --data '{"facebook_token": "facebook_token_string", "facebook_id": "facebook_id_string"}'

        self.headers["X-Auth-Token"] = 'auth_token_string'
        print("Authenticated to Tinder ")
        self.authed = True
        print self.authed

> """Yeah it's really important to write extremely enterprise well-documented hacky API code. Hacker News will love it I swear."""

[0]: https://github.com/defaultnamehere/tinder-detective/blob/13b...

Feature can be disabled at any time.

There's nothing new to discover with this 'hack', seeing your friends' tinder profiles is what tinder social does.

Do I have to create an App featuring access to my friend list for that?

On an unrelated note, I liked the way that the post was written. It made reading the details more interesting (but then again, I'm one of those young whippersnappers, so maybe I'm just more prone to liking that sort of thing).

And I grabbed the user_id from the groups json "user_id" var

I also made the request from the browser on my phone.. same thing.

Do I need to add some tinder oauth credential to the curl request?

f = open(SECRETS.json) self.fb_auth = json.load(f)

So does it matter what I name the auth parameters or just that I set the values correctly?

i.e:

{ "auth_token" : "TOKENVAL", "fb_id" : "IDVAL" }

C'mon Tinder.