A security flaw could allow anyone to access your Grindr account .
Many would think that a dating app that knows your sexuality and HIV status would take detailed precautions to keep that information protected, but the Grindr app has let the world down once again – this time, with an extremely terrible security vulnerability that could literally allow anyone who could guess email your user account.
Fortunately, French security researcher Wassime Bouimadaghene discovered the vulnerability, and if users are lucky, it won't have had time to be exploited, and it has now been fixed.
Unfortunately for Grindr, the company ignored his revelations until security researcher Troy Hunt (of Have I Been Pwned) and journalist Zack Whittaker (of TechCrunch) confirmed the issue and wrote about it.
For the skeptical, there are details available, but the short version is this: if you put an email address into form reset Grindr's password, it would send a message back to your browser with the key you need to reset the password stored in it.
You could then theoretically just copy and paste that key into a password reset URL (which Hunt did) and take over an account just like that.
Grindr COO Rick Marini told TechCrunch that “we believe we addressed the issue before it was exploited by malicious actors,” and said Grindr will partner with a “leading security firm” and introduce a bug bounty program . This will hopefully mean that security researchers like Bouimadaghene will have an easier time getting in touch.
It's worth noting that it's not just an app that simply contains a few messages. Grindr's users include gay, bi, trans , and queer people, and the mere presence of the app on a person's phone can indicate something about their sexuality that they may not want to reveal to the world.
However, this is the company that was caught sharing its users' HIV status with other companies and sharing other personal information with third-party advertisers.
It may be a slightly different company now, as in March, the company’s Chinese owners sold it to a group of U.S., who also became Grindr’s new management. Marini, the COO, was one of the group’s investors. Another, Jeff Bonforte, is the company’s new CEO, according to The Verge.
