Due to the fact that distance matching is done server side the application doesn't have any knowledge with regard to distance. The only knowledge one has is whether or not one receives messages from an other user.

Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages). Thus significantly more difficult than if the actual distance measure was depicted in the UI or leaked elsewhere.

Finally closing the API to outside requests limits the ease with which the above could be automated. Any idea's for further improving these security measures are most welcome!