Tinder me softly – How safe are you really on tinder?

Abstract

There are known privacy concerns with the use of Tinder, a popular dating app. In this paper, we examine previous attacks on Tinder that have not been documented academically. We also documented the Tinder network API in order to test the previous attacks in a live environment. Although our testing revealed accurate user location data, which was the crux of the prior attacks, has since been patched; we were able to: associate a Facebook profile with a Tinder account due to their shared information, see Facebook pages a user had liked or was a member of, as well as gather user images, which Tinder sends via plain HTTP, for a reverse image search. We also demonstrated the potential for a less accurate location attack that takes into account Tinder’s updated security.