←back to thread

I hacked a dating app (and how not to treat a security researcher)

(alexschapiro.com)
560 points bearsyankees | 1 comments | 12 May 25 16:39 UTC | HN request time: 0.209s | source
Show context
gxs ◴[12 May 25 18:50 UTC] No.43966319[source]▶
FYI the Hinge app works the same way

I requested my data and all the image URLs are publicly accessible - and the URLs provided are both your own images and the images of anyone who’d ever viewed your profile

replies(1): >>43967698 #
1. reliablereason ◴[12 May 25 21:37 UTC] No.43967698[source]▶
The security is in the fact that you cant just list every single user and all their info. You would need to scrape the info.

A URL with a cryptic file name is theoretically just as secure as a a random password.