Hacker News Reader

Comment by nerdjon | Hacker News Reader

I hate that all of these apps (Grindr and similar) appear to take security and privacy secondary... which is just insane given the market they are serving.

Sex is still considered taboo in many parts of the world and some parts of the US.

Now this, we have them using the Facebook API and them knowing every time I open the app (or did).

I have made every choice I can to reduce the privacy invasion that these companies engage in, but there are simply no alternatives for this one. I would be very surprised to find out that Scruff is actually any better.

The web based ones are likely far far worse.

I hate that this has become normal so much.

View on HN

> Sex is still considered taboo in many parts of the world and some parts of the US.

Gay sex is still illegal in 71 countries in the world. Many of them still have the death penalty

https://76crimes.com/76-countries-where-homosexuality-is-ill...

It's extremely sad how homosexuality is criminalised in such a large part of the world and it makes leaks of Grindr even more dangerous than just for the prospect of blackmail or just exposure.

> It's extremely sad how love is criminalised

First of all, we need to stop characterizing it as some kind _emotional_ thing like "love". It is not an emotional thing. It's a real thing.

I think there's nothing more profound than love in the human condition to be honest. I don't think it's not real at all. It is probably the strongest driving force in human behaviour. I didn't mean to downplay the significance.

But I changed my comment as it was not my intention to offend. On the contrary. Just saying "homosexuality" sounds distant and clinical so I said love to make it feel more real. Because really that's what it's about isn't it? For me love is what makes a relationship real. One based on just sex isn't, at least not to me.

Why would something emotional not be real? Sexual attraction is a big part of love but I think the term goes much further than that.

I wasn't intending for you to change anything in your comment at all! It was very thoughtful and well-articulated and I really didn't have anything else to offer. I just always zoom in on the "love" keyword when talking about gays. It's just not a keyword term to use anymore.

Thanks, I didn't know that.

I've heard that some American religions try to 'fit' gay feelings into their principles by telling members it's ok to feel but not to act. Perhaps this is the reason for this sentiment? That by saying "love" I subscribe to the idea that only the physical act makes it 'real'? I find that concept very strange. As if the act is more real than the feeling of love or attraction for someone. For me it's the opposite.

In any case I changed it because I was clearly expressing a sentiment I didn't want to convey. Thanks for pointing it out.

In the context of Grindr though, ppl be fuckin for fucks sake, same with Tinder for the most part.

Emotions are real though? I’m confused. Attraction is real. Love is real. Dopamine and serotonin are real.

I’m guessing the GP was referring to the illegal aspect being not love, but sex.

It doesn’t make these laws less regressive, but it does (in most cases) somewhat limit the scope of the laws.

The death penalty is not applied in the vast majority of prosecutions where it is illegal

Yeah but do you really wanna roll the dice on that one

great!

The laws are still coercive and discriminatory though.

Agree

If you are a startup, you cannot create a popular app in a crowded marketplace by being scrupulous about best practices.

Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

Because of the consolidated nature of the market, and the winner-takes-all nature of the industry, I really believe that it is impossible for a new entry to gain popularity and focus on hard problems like security.

This is fundamentally a problem with capital allocation and incentives. There's not much that a small team can do about it.

You appear to be arguing that it's better to betray your customers' intimate confidences, than to find a market you can address without doing that.

I'm sure that can't be what you are trying to say - although, if it is, I can certainly understand why you made a throwaway to say it.

I'm pretty sure it's just an observation about the situation that any player in that market would find itself in, so therefore when you look at apps in that market they're shitty about privacy.

It's a comment about dating apps, not about people who decided not to go into dating apps i.e. found "a market you can address without doing that."

I'm not saying it's better, but that it is unavoidable given current market conditions.

We all want our data to be handled securely, and we should try to understand why that does not happen.

There's a difference between understanding why people behave dishonestly, and making excuses for dishonest behavior. You're doing the second one under the color of the first.

No one has to make a dating app. I don't see how "no one else could do it without betraying their users either!" as you argue - and, again, even granting this is true, which you've done nothing thus far to show - excuses the actual betrayal that actually has occurred. If you'd like to make an argument that it does, I'd be interested to hear that.

I think you're shooting the messenger here. OP was explaining the incentives for the behavior we're seeing, not excusing it.

Maybe so. It's easy to get your blood up when you're addressing flagrantly careless behavior that substantially helps make possible the systematization of the same kind of targeted, but back then still by necessity only interpersonal and mostly opportunistic, violence that was a daily feature of your life throughout most of its first couple decades.

So, sure, the one comment to which you've directly responded here, I'll call that out of line on my part. Everything else I've said throughout these comments stands.

He's saying that in the end, all that will be available to customers will be the unscrupulous ones - because if someone tries the other approach, they'll fail.

And there always will be someone trying the unscrupulous approach, no matter how many people decide not to.

I think he’s saying don’t even try, because some other company won’t bother and it’ll crush you.

Fine! Don't try, then. "Someone is going to do this shameful thing, therefore there is no reason why I should not do this shameful thing" isn't quite the logic of a sociopath, but only because a sociopath sees no need in the first place to excuse to himself his own immoral behavior.

If your attitude is "if you can't do it right, don't do it at all", that's fine. But a predictable consequence of that attitude is that, when the cost of "doing it right" is high enough, the only people who do it at all are the people who don't do it right.

The incentives are broken, and telling the people who point out that the incentives are broken that they're just making excuses for bad behavior doesn't actually fix the incentives.

I’m pretty sure no one in this thread is saying that but you?

It’s an observation that market conditions seem to disadvantage anyone who DOESN’T do that, so unless you like spending a bunch of effort and time (and being less competitive overall because of it, and likely go nowhere), maybe spend your effort somewhere else if you don’t like to be that way.

There are a ton of markets like this. If you wanted to open a ‘good’ check cashing place for instance, go right ahead. Just don’t be surprised if you lose your shirt trying it by not being like the other, less scrupulous players.

You appear to be taking a very uncharitable interpretation.

This thread reads to me as there may be perverse incentives due to nature of dating and capital markets that make it nearly impossible to compete while valuing security.

Exactly. If “do think X” is my goal, and there are zero successful moral paths to doing thing X, then the only option is to not do it.

u/firephonestival is stating the obvious and much repeated: any conscientious effort will be buried by the horde of amoral and immoral players. They are not defending, excusing, or in any way minimizing the excreble outcomes of our winner-takes-all economic regime.

Maybe for security (however that being second for any app is a serious issue).

But this is a conscious choice. A small team should not need to make the decision to do something like this.

Also Grindr or Scruff isn't exactly small and have a fairly devoted base that doesn't end just because they get into a relationship.

Users kinda suck and hate to pull out their wallets if they don't have to.

Dating apps also suck at giving compelling reasons to pay them unless the app is purposefully made worse so they can sell the functionality back.

How much of that is because they have been conditioned that things should be free though?

We have 10+ years of Google, Facebook, and others handing out major tools and functionality for free because of the privacy invasion.

I have to wonder how things would have looked had that not become the norm.

As far as being purposefully made worse, yeah both apps do that. Grindr charges $100, Scruff charges $120 a year. Considering how popular both apps are I have to assume they are pulling in quite a bit of money.

> have a fairly devoted base that doesn't end just because they get into a relationship.

At least in the US, one might imagine this is more important to users than hiding their sexual preference.

That's quite a claim when, until Grindr's practice of selling PII was disclosed, no one had any reason to imagine that by using the app they would be disclosing their sexual orientation and behavior. In light of that I have no idea what preference you imagine to have been meaningfully revealed here.

My claim is that for a large number of Americans, it's probably worse to be outed for seeking extra-relationship (I'm not sure of the proper term) casual sex than for being gay/bi/queer. Of course, both of those could be revealed at the same time which would be quite the double-whammy to an unsuspecting partner.

Oh, I see what you mean.

I'm not sure I agree, though. In an open relationship it'd be no surprise to my partner if I were using Grindr (he probably would be too, in that case!) and I think therefore that'd be more or less orthogonal to the concern around the risk of forcible outing posed by Grindr's misuse of data. Both are certainly of concern, but I think independently so.

> If you are a startup, you cannot create a popular app in a crowded marketplace by being scrupulous about best practices. > Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

understood. the only practical response to the banal corporate indifference of modern markets is ultraviolence. establish a rival dating app and send ninjas to the bedrooms of match owners to threaten their lives

hn says "there's not much a small team can do about it" but they are clearly considering only a small team of technologists and a few salespeople/growth marketers. hn has drastically discounted the impact a small team of (kunai-wielding, not mid-2010s startup recruiter speak) ninjas can have

>If you are a startup, you cannot create a popular app in a crowded marketplace by being scrupulous about best practices.

>Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

Match owns almost all of the dating app market because they've acquired who? Startups who created popular apps in a crowded marketplace that they don't already own.

Now, if you want to argue that you cannot create a popular app in a crowded marketplace without accepting a buyout offer from the dominant player, now that's a topic I think is worth quite a bit of discussion.

Dating apps likely face a lot of churn because those customers who succeed cancel permanently. So for young apps burning out trying to compete it may be very hard to resist a big buyout from larger players with deeper pockets and fewer moral constraints.

On the other hand, programmingwise dating apps are simple as heck and require almost no staff (source: Match's presumptive development priorities across their apps). Wasn't Plenty of Fish famously one guy for years and years? Heck, nowadays you can even seed a new app with fake accounts even easier with thispersondoesnotexist.com. Couple that with Facebook's GPT-3'ish release today[1] and you can probably create some pretty convincing activity, including messaging.

1: https://news.ycombinator.com/item?id=31243569

>I really believe that it is impossible for a new entry to gain popularity and focus on hard problems like security.

Well, they can. New entrants to the dating app market always start out this way. They gain loads of initial trust and word of mouth growth by putting users first. But they inevitably fall victim to the same market forces as their competition, and slowly become the same thing. It happened to Tinder, it happened to Bumble, and it will happen to Hinge.

Or they get acquired by the Match company (Tinder, OKC, Match.com, others) and just start poisoning the UX straight away.

> Match owns almost all of the dating-app market, and they have extremely deep pockets to buy/extinguish competition with.

Sounds like a business opportunity.

Google owns most of the search space, it’s an even bigger business opportunity!

Ok sure but the point nerdjon and GekkePrutser are making (which I agree with 1,000%) is that it's super selfish to prioritize "creating a popular app" at all costs over protecting people's actual lives. Creating a popular app is great but don't risk the lives of your users!! That should go without saying!

That’s bullshit. Being incompetent isn’t a success factor - you’re not gonna beat Match.com by allowing people to steal your customer data.

That’s now what they’re saying . They’re saying if customer data security won’t be a deciding factor, you’ll lose by focusing on that instead of what IS the deciding factor.

People still use Grindr a ton even though these security issues have been well known for years and in most areas users have real concerns for their safety and lives if they’re caught using it, so I can’t say they’re wrong.

Little known fact: Facebook Dating doesn't sell any subscriptions, there are no limitations behind a paywall. They probably have the best security but I guess you could argue that Facbebook sells your data in other ways.

It is actually what I would expect from a dating site. Match group apps look more like a vehicle that only exists to transfer money from your pocket into theirs.

Move fast and break society.

Eventually EU is going to ban data warehousing for any purpose other than storing and giving it back to the user.

And honestly, I think it's necessary.

I really hope so. Maybe this will yield better privacy-preserving schemes for data analysis and recommendation engines. Necessity is the mother of invention (or whatever the equivalent idiom is in English).

I think I'm hardly making an original argument, but a big problem is binding Compute and Data, so companies have an incentive to hoard as much data as possible and keep it hostage. Feels like deep down that's the whole valuation of Silicon Valley

I worked on Prio, now divvi up by ISRG. I don't even think that was really the best solution out there, but certainly better than the status quo.

Honestly I should look to see if there's places that are working on privacy preserving metrics systems and apply.

Didn't know Prio, seems like an interesting approach. I also would like to work with these problems someday. As a layman, I'd love to see something like fully homomorphic encryption taking over.

But in the end, IMHO what really needs to happen is to enable full data ownership. The semantic web, there was also another project by Tim Berners Lee...

Why do you think the EU will do it?

They are the closest to doing it than anywhere else at least, and still edging in the direction of greater regulation not less or on a plateau.

Because most of that kind of industry is US based, and they earn money from EU users, so on one hand, you seem to be working "for the people", on the other hand, you fuck the americans :)

Probably because they're the jurisdiction that's taking user privacy rights the most seriously so far, with enough market share to leverage their demands.

The EU doesn't everything right in the digital sphere but at least some parts of it understand the importance of privacy.

Of course there is an opposition that believes this hinders digital development in Europe, which is quite slow or nonexistent, but that is also often caused by said opposition itself instead of privacy laws. Because the few digital experts need all their energy in fighting their ideas and corruption.

They don’t have a tech industry so they have nothing to lose from it.

> I hate that all of these apps (Grindr and similar) appear to take security and privacy secondary.... I would be very surprised to find out that Scruff is actually any better.

The average case is quite bad, but I wouldnt generalize it to quite every app. Scruff, for example, does take privacy seriously - both in rhetoric and in their user-visible design decisions.

That's not to say there might not be vulnerabilities (which could be said about any company or service), but they don't treat it as a secondary priority.

Grindr, on the other hand, is actively malicious with how aggressively it sells and/or exposes user data willfully.

Maybe I am just jaded by Grindr (and even non hookup apps) at this point.

But I just take Scruff's words with a grain of salt at this point. There is so much that they can do server side that we can't block.

A big part of me thinks it is just inevitable until something like this comes out about Scruff. I don't want to think that... but we have been burned way too many times by apps. Look at what came out about several mental health apps a few days ago.

There's a few other sites that are good for hookups, but I wouldn't trust any apps. Sniffies and A4A are the ones I know of

I don't imagine sniffies, a4a, MH, bbrts (for anyone reading, please don't look these up while at work... or at least not on a work computer... these are all Gay hookup sites) is any better. Particularly the first one when it comes to location data considering it just legit shows a map if people.

I really don't trust any of them (App or Website), enough so I have seriously contemplated getting an iPod touch or something and tethering anytime I want to use them. But I have not quite gone that far yet.

There are certain conveniences the apps get you.

There's less data tying you to your identity with the web apps, and you can use an adblocker to reduce your profile even further. The location data is troubling but I've seen at least one of those randomize the pin slightly each time it updates your location, though in a circle radius so I guess you could triangulate it by staring at the pin a bunch.

I am not entirely sure I by there being less data. I don't allow Grindr or Scruff access to anything on my phone. Even for photos I use the iOS feature to limit what photos they can see. The only real difference between the... accepted profile structure. Grindr and Scruff tend to be face...ish pictures vs Sniffles that is... not.

Facebook and Google have become very good at tracking you across the web. Sniffles has ads (admittedly all of them are to sign up for premium but I don't know how those ads are served... I have not looked).

So add in google fonts or some other tracking mechanism and suddenly you have a ton of data to tie someone too a website that is meant to be anon. (more or less, I know its not quite that simple but I don't think being on the web makes it necessarily any better)

Reply on news.ycombinator.com