←back to thread

I hacked a dating app (and how not to treat a security researcher)

(alexschapiro.com)
561 points bearsyankees | 5 comments | 12 May 25 16:39 UTC | HN request time: 1.113s | source
Show context
nixpulvis ◴[12 May 25 17:50 UTC] No.43965715[source]▶
People need to be forced to think twice before taking in such sensitive information as a passport or even just addresses. This sort of thing cannot be allowed to be brushed off as just a bunch of kids making an app.
replies(5): >>43965749 #>>43966078 #>>43966320 #>>43966383 #>>43968604 #
jonny_eh ◴[12 May 25 18:25 UTC] No.43966078[source]▶
There should to be some kind of government operated identity confirmation service that is secure/private.

Or by someone "government-like" such as Apple or Google.

replies(4): >>43966153 #>>43966160 #>>43967625 #>>43969390 #
1. behringer ◴[12 May 25 18:34 UTC] No.43966160[source]▶
when I worked for the government, within 2 months they had leaked all of my data to the black market.

Governments should not be confirming shit.

replies(1): >>43966794 #
2. pixl97 ◴[12 May 25 19:45 UTC] No.43966794[source]▶
The government already has all your data so I'm not sure who you think should be confirming identity.
replies(1): >>43967532 #
3. behringer ◴[12 May 25 21:15 UTC] No.43967532[source]▶
and my point is that they leak it. So it's hardly useful to have them both house and confirm the data when they can't house it properly.

They'll be confirming data that is publicly available.

replies(1): >>43967610 #
4. jonny_eh ◴[12 May 25 21:26 UTC] No.43967610{3}[source]▶
But what additional data are you worried about them having?
replies(1): >>43998986 #
5. behringer ◴[15 May 25 20:28 UTC] No.43998986{4}[source]▶
If a private company can't do it. You can bet double or nothing that the government can't do it:

https://news.ycombinator.com/item?id=43996307