Tantan , the Chinese clone of Tinder, does not use HTTPS to encrypt traffic and exposes almost all(!) of its users' personal information, as reported by Larry Salibra , founder and CEO of Pay4Bugs , a crowd-sourced pay-per-bug software testing platform.
Salibra ,intrigued by its similarity to the popular Tinder, but also by the apps UI and UX, which are far superior to Tinder's interface. Looking to see if the app's backend was as clean and well-made as the "wrapper", he connected their iPhone to the computer and using Xcode, took a look at what was going on "under the hood".
Surprisingly, the first thing he noticed was a plethora of debug messages spilling into the Xcode. These messages are usually hidden from other applications to prevent inadvertent data leaks with users' personal information.
Connecting to his home router and running a basic TCP dump command, the next thing he immediately noticed was a complete lack of encryption for the app-server communications.
He then discovered that his password was sent in cleartext along with a bunch of other information over an unprotected channel. After this interaction with the app, his "research" revealed that Tantan reveals almost everything about its users, sending data over unprotected HTTP channels that can be easily intercepted, recorded, and stolen.
The information disclosed includes the user's real name, password, dating, sexual orientation, interests, hobbies, chat messages, and location.
Tantan 's flawed privacy doesn't stop here, however, it not only puts the user at risk, but malicious actors will be able to easily detect the location of others simply through those who match them.
For each match, Tantan also reveals the distance to the matched person, a user would only need to obtain the distance for one ’ of his targets from three different points. The attacker can use these 3 different geographic coordinates, and find the exact location where the «partner» is, and even «fall» quite close. And here is an extremely simple way to spy on the object of your desire…
Mr. Salibra made all these discoveries in March 2015. He then contacted the app's developer, but after countless unanswered emails, he decided to raise the issue publicly. After the research was published, Tantan CEO and co-founder Yu Wang contacted him and promised to fix some of the app's security issues in future releases.
