Learn More
Resend Email
393
Story of code affecting your dating?
Week 143 Group Rant
localjoost
5y

Last year I built the platform 'Tindex'. It was an index of Tinder profiles so people could search by name, gender and age.

We scraped the Tinder profiles through a Tinder API which was discontinued not long ago, but weird enough it was still intact and one of my friends who was also working on it found out how to get api keys (somewhere in network tab at Tinder Online).

Except name, gender and age we also got 3 distances so we could calculate each users' location, then save the location each 15 minutes and put the coordinates on a map so users of Tindex could easily see the current location of a specific Tinder user.

Fun note: we also got the Spotify data of each Tinder user, so we could actually know on which time and which location a user listened to a specific Spotify track.

Later on we started building it out: A chatbot which connected to Tinder so Tindex users could automatically send a pick up line to their new matches (Was kinda buggy, sometimes it sent 3 pick up lines at ones).

Right when we started building a revenue model we stopped the entire project because a friend of ours had found out that we basically violated almost all terms.

Was a great project, learned a lot from it and actually had me thinking twice or more about online dating platforms.

Below an image of the user overview design I prototyped. The data is mock-data.

rant

rip

tindex

wk143

yeah call us creeps
Favorite
Ranter
Comments
  • 139
    5y
    Woah.
    Project looked really good and shows exactly how fucked up (as in "leaking" all information) it is.

    It would be interesting to write an article on the whole thing. I'm sure lots of people would read that!
  • 116
    5y
    Write an article about this.

    Now.
  • 35
    5y
    and how many matches for your self did you fabricate? 😄
  • 31
    5y
    @010001111 if he want tinder lawyers to hunt him he totaly should.
  • 22
    5y
    @heyheni Can't remember how many but we scraped at least all users from the Netherlands, Belgium and Germany at the time :')
  • 42
    5y
    Sounds like a data leak if you you ask me....
  • 30
    5y
    I don’t know how to feel about this. The work you have done is amazing, and thank god you didn’t publish the platform. On the other hand it does sound like a major privacy issue that should get publicity.
  • 7
    5y
    Love it. I worked at Match for a short contract. This would have put their underwear in some serious knots!
  • 14
    5y
    @wiwe2210 @620hun if you think about it: we could scrape the data from either the api or the website, the api is just a tool. So doesn't this mean the data is public to everyone?
  • 10
    5y
    @localjoost yep, that’s the problem. It shouldn’t be available through API. This is why Facebook and Instagram basically killed their public API after the CA scandal.
  • 18
    5y
    If you're jobless, send the project to Tinder HQ and they probably employ you as their security engineer
    j/k
  • 13
    5y
    Thumbs up on the timing 👍
    Scare off the already lonely coders from Tinder just before before Valentines 😂
  • 9
    5y
    @620hun well but that's kinda retarded cause there's always an API... It might not be public but as long as you can use the app/webapp in any way you can always extract the keys and scrape...
  • 4
    5y
    @eval Well, yeah, but the scope will be limited. If you can only scrape stuff that you’d see in the app anyway it’s fine. That was clearly not my (or anyone’s) issue.
  • 5
    5y
    I wanted to do the same but didnt find the API :(. 6tin for example is an app for windows where you can move your location (which as far as I know, is only possible with the "premium" subscription). They must have some deal with tinder I must guess, but It's fun to watch how easily you can consume a public API and get something done with it (even if its bad)
  • 15
    5y
    "we basically violated almost all terms."

    No shit... Why the hell was all that info made so easily available O_O
  • 5
    5y
    @bennythecat96 It's not a public API, the api isn't supposed to be there anymore. Tinder uses it for gotinder.com I think. Otherwise they would've taken it offline.
  • 9
    5y
    Does it really matter if you violate any terms? They are not law, so the only consequence could be that your contract with Tinder could be ended... which is pointless if you have no profile and with that no contract.

    I am very sure that they couldn't have forced you to stop using a public and documented API.
  • 7
    5y
    About the data being public anyway: I'm no lawyer, so this ain't legal advice. I do know the laws in Switzerland a bit howerver. As far as I know at least here it doesn't matterbif it is/was "publicly" available to technical users, it's about if you did or didn't give access to a new group of users.

    Abstract example: your university/employer has a contract with a publisher for some books or whatever which allow all employees/students to read them as pdf. If you now go on and share that pdf on your website or socialmedia, you've given other users access to that data.
    At least in switzerland it would probably be the same. Before that data was only available to "power users", like people who know how to scrape a website and/or use an api. With a public accessable website you'd expose this data to a non technical audience...

    That's just my two cents...
  • 6
    5y
    If the API wasn't supposed to still exist, Tinder made a boo boo and should publicly confirm the leak because they presumably updated their privacy policy to reflect less public data.

    I can't believe you built an entire application with that much logic and scraping and didn't think to read the TOS...

    Violating TOS can mean legal issues and being shut down from current and future use of their service/API. This is true for any service.
  • 6
    5y
    That is amazing and scary in the same time. Post an article.
  • 7
    5y
    That's some fucked up shit son. Good job
  • 7
    5y
    I'd definitely like to read an article on that. If at all possible, post it to Tinder's security mailing list in a less wide scope (this would definitely qualify as user exploitation) and hope that they don't check their API log (well they probably would). Maybe best to report anonymously. How much personal information about you did those API requests hold (don't wanna know, just think about it and make an appropriate conclusion)? If it's anonymous enough that you'd say that their security chaps wouldn't be able to trace it down to you even if they wanted to (which should always be assumed, experienced that firsthand), maybe consider reporting it. Anonymous nature wouldn't allow for bug bounty unless you decide to donate it though. Either way, really interesting story! Hopefully my Tinder data wasn't in it, but I don't have high hopes for it, haha. At least I've got the fact that I only turned on location (because apparently that's mandatory) when I opened Tinder going for me 😅
  • 5
    5y
    Make a paper out of that! Not only an article. Break all the stuff you can break a write a report on what you could or could not do. From what you've written there's quite a lot of data leakage.
  • 3
    5y
    I'm not on Tinder... should I still be worried? Lol as much interesting this sounded, it's still scary. Kudos for stopping the project and not being greedy after realising that you guys violated the terms. 👍
  • 3
    5y
    Did you get any dates out of it though ?
  • 5
    5y
    I remember Ashley Madison data breach analyses proved that most of woman on their portal are bots and only 5% are real.
    I saw some bots working on social portals but how is it compared to dating platforms?
  • 17
    5y
    The Verge
    "Over 20 million Tinder accounts leaked in Tindex scandal."

    Buzzfeed
    "Tindex: find out if your ex's Tinder account data has been leaked!"

    New York Times
    "EU sues tinder for 300 million euros over tindex data breach"

    Techcrunch
    "Chinese venture capital takes over Tinder stock after the €300 mio GDPR fine."

    😆
  • 3
    5y
    @heyheni Hahahaha love it, thanks for this 😁
  • 4
    5y
    @heyheni this is perfect. Lol
  • 3
    5y
    Lekker bezig
  • 3
    5y
    Do a medium post, let them burn
  • 7
    5y
    I want to see your code 😐
  • 5
    5y
    @hobyrr yes for research purposes and stuff... 🎓🙈🤞
  • 4
    5y
    Crazy shit. Well done how you worked with the data to generate even more data.
    I agree with the others though, you should bring this to their attention.
  • 5
    5y
    i don't want to kill the mood here but this is the same-old-programmers-are-lazy-to-secure-the-app story + a bit of reverse api engineering and it's not worth more than a nicely wrapped article.

    while poking around i found out that i can freely book the "premium" seats for ryanair/wizzair (and maybe many more companies might have the same bug 😅) and this just the tip of the iceberg, but you don't see me bragging about it... oh wait... 🙈
  • 3
    5y
    @pitzyrulz 😲 are you a hacker? can you hack facebook?
  • 4
    5y
    @heyheni i don't hack and tell 😅
  • 3
    5y
    @010001111 bump.
  • 3
    5y
    @heyheni “ case study” 😁
  • 3
    5y
    Your story should be covered by some great podcast, including all dirty details 🤔
  • 2
    5y
    Report to tinder and spotify, so hopefully you get bounty from them. Then blog about it
  • 3
    5y
    Maybe grindex next? I imagine they have a few open backdoors.
  • 2
    5y
    @fullslack Grindex as in grind your ex?
  • 3
    5y
    @heyheni grinder. Thought i saw you there
  • 2
    5y
    As long as I was reading I was like "Is all this allowed by Tinder? Or is it even legal?"
    The conclusion answered to my thoughts
  • 1
    3y
    Interesting to see some of these takes.
  • 0
    3y
    Hi there friends jow
  • 0
    3y
    Interesting story. I also really addicted to different dating websites and decided that it will be a pretty good idea to chat with interesting people online.
  • 0
    163d
    If you're a transgender individual seeking love or companionship, I've got something special to share. I've come across an exceptional https://taimi.com/transgender-datin... dating app created specifically for people like us. This app offers a welcoming community and a diverse pool of potential matches, making the quest for genuine connections and relationships more attainable and enjoyable than ever before.
Related Rants
devRant © 2021 Hexical Labs LLC
Privacy Policy  |  Terms of Service
Add Comment