Online Dating ?

[humble3d]

Online Dating ?

7 Sites That May Be Invading Your Privacy

While you probably already know that you need to be aware of scammers who take to dating sites and apps to lure unsuspecting victims into financial fraud, you may not be aware that online dating companies themselves don’t have the greatest reputation for protecting your privacy.

 

In fact, many popular dating sites and apps have a history of security vulnerabilities and privacy violations — something you might want to be aware of if you’re trying to figure out how to make online dating work for you.

 

We’ve known for years about the privacy compromises you make when you sign up for an online dating site or app, as Rainey Reitman reported for the Electronic Frontier Foundation a few years ago.

 

For instance, your dating profile and photos can hang around on the company’s servers for years, even after you cancel your subscription.

Depending on your privacy settings, your profile can be indexed by search engines, and services like Google Image Search can connect the photos on your profile with your real identity, as Carnegie Mellon researchers demonstrated. Dating sites collect data on you — such as your age, interests, ethnicity, religion, and more — and lend or sell it to marketers.

And popular dating services rarely prioritize strong privacy practices, which means they’re often riddled with vulnerabilities.

 

As Min-Pyo Hong of SEWORKS recently reported for VentureBeat, the top dating apps are “just waiting to be hacked.” Each app that SEWORKS analyzed was decompilable, which means that hackers could reverse-engineer and compromise the app.

 

None had protections to prevent or delay unauthorized decompiling; none had obfuscated their source code, which means hackers could access sensitive data; and one wasn’t even using secure communication, which would make it easy for hackers to intercept data being exchanged between the app and the server.

Convinced that the security and privacy of your online dating service is worth a second look? Here’s how seven popular dating sites and apps have violated users’ privacy over the years.

1. Tinder

Tinder is a fun dating service for the smartphone generation, but its integration with Facebook can compromise the privacy of an activity that most people don’t want their Facebook friends snooping on. Users who want to keep their Tinder hookups separate from what they do on Facebook are left with limited options for minimizing the connection — since logging in to Tinder with Facebook that means that your Tinder matches can easily find you on Facebook, the social network can broadcast that you’re using Tinder, and the dating app can set you up with Facebook friends.

As Katie Knibbs reports for The Daily Dot, there are a few precautions you can take and privacy settings you can change to preserve the confidentiality of your Tinder usage. Some users have held out on making a Tinder account until the company decides to enable users to sign up without sharing their Facebook logins — though you may end up waiting a while for that kind of privacy-minded option. An alternative is to create a Facebook account just for your Tinder use.

Even worse than the privacy risks inherent in Tinder’s Facebook login system is the series of security vulnerabilities that aren’t that far in the dating app’s past. As Anthony Wing Kosner reported for Forbes in 2014, the feature that enables users to find potential matches nearby also put them at risk of stalking. Location data for matched users within a 25-mile radius was delivered directly to users’ phones, and it’s accurate within 100 feet or less, and researchers found that anyone with rudimentary programming skills could get the exact latitude and longitude for any Tinder user.

The company fixed the vulnerability, which would have been a good thing except that the fix created another vulnerability by replacing the latitude and longitude coordinates with precise measurements in miles to 15 decimal places. With some basic triangulation and three dummy accounts, a stalker could figure out exactly where a user is. For users of Tinder and other location-based apps, the lesson is that you shouldn’t take an app’s word for it that your location is actually secure.

 

2. Grindr

Tinder isn’t the only dating app that’s violated the privacy of users who trusted the company with their location data. Grindr, which calls itself “the world’s largest gay social network app,” has come under fire for enabling users to be tracked closely, since Grindr tells you the location of other users in your area.

 

As Kat Callahan and Chris Mills reported for Jezebel, that might not sound so scary on its own, but users can trick the app into thinking that they’re somewhere they’re not. If you do that a few times in quick succession, you’ll be able to get the distance of each individual from three different points, and you’ll be able to triangulate the precise location of each individual Grindr user.

 

That’s a major security flaw that should have the company worried, but Grindr didn’t react as you might expect. The team refused to make any comment outside of the several blog posts it wrote on the topic of security, saying that the app’s “geolocation technology is the best way for users to meet up simply and efficiently” and “as such, we do not view this as a security flaw.”

 

Users can disable the “show distance” option on their profiles, and the app began automatically hiding the distance of users in “territories with a history of violence against the gay community,” including Russia, Egypt, Saudi Arabia, Nigeria, Liberia, Sudan, and Zimbabwe.

 

But Dan Goodlin reported for Ars Technica that automatically disabling the distance function doesn’t actually solve the problem. Grindr could implement protections that stop users from changing their own location repeatedly, or introduce some rounding error to make other users’ locations less precise. As it is, security researchers could track where (volunteer) users went to work, what gyms they exercised at, where they slept at night, and other places that they frequented.

 

Because users often share personal details and link their social media accounts with their profiles, they could correlate users’ profiles with their real identities. The privacy implications are obvious, and are something that Grindr should take more seriously, especially because of the continuing frequency of attacks on LGBT individuals.

3. Zoosk

Luckily, not every privacy violation on the part of a dating app or website will leave your location vulnerable to stalkers. But it’s probably not much better that some online dating companies have some pretty deceptive and unethical practices when it comes to getting new users to sign up for their services via popular social networks like Facebook.

A CBC report about a married woman who found that Zoosk created a profile for her when she clicked on a Facebook ad made the rounds online, gathering sympathy from other users who were similarly duped and then had explaining to do when their significant others’ discovered that they’d accidentally signed up for a dating service.

 

Thanks to the authentication protocol that enables Zoosk to pull information from users’ Facebook profiles, the dating site used her Facebook profile photo, her name, and her zip code on her profile. The Facebook login is intended to make it easier for users to log in to the dating service without having to remember another password.

However, the login also made it easy for countless users to click an ad or take a quiz (an “IQ test” was cited by several users) and inadvertently create a profile on the dating site, which they’d only realize when they were bombarded with messages from matches. Zoosk denied creating profiles without users’ permission, and explained that users have to explicitly grant permission for Zoosk to use their data during the signup process.

 

The problem is that it turned out to be pretty easy for users to grant permission to access their data and create a profile without knowing what they were authorizing. Users have also found it difficult to cancel their accounts on Zoosk, which just adds to the frustration and sense of violation.

4. OkCupid

It’s well known that OkCupid makes the most of the extensive data that its users and their interactions generate. As Natasha Singer reported for The New York Times, OkCupid president Christian Rudder is a Harvard math grad who mines the depths of the site’s data to “study the calculus of human attraction,” and publicizes the results on a company blog called OkTrends.

 

(The same blog where Rudder famously revealed that the company “experiment on human beings” and manipulates the information that some users see on the website, all in the name of experiments in social science.)

 

OkCupid’s use of your data in its own research may not bother you, and you may even find the insights that Rudder gains interesting.

 

But you’ll likely be less thrilled to know that OkCupid has been a little too cavalier about users’ privacy with its method of moderating exchanges and profiles that users have flagged. As Rachel Swan reported for the San Francisco Public Press a few years ago, the company was enlisting seemingly random users to read other people’s (private) messages to one another and peruse profiles flagged for possible terms of service violations.

 

Those users would find themselves eavesdropping on correspondence that was assumed to be private, including messages containing real names and phone numbers.

 

Each conversation was viewed by several moderators, who would converse over whether what was said in private messages constituted a violation of the site’s rules.

 

While many moderators kept the conversations to themselves, others created Tumblr blogs to share unredacted screenshots of private messages. While OkCupid couldn’t be held accountable for the behavior of moderators who abused their access, some lawyers questioned the policy of outsourcing moderation to regular users instead of paid employees, since most users probably don’t expect a third party — particularly one with no obligation to protect his or her privacy — to be reading private messages.

5. Positive Singles

A major concern with dating services owned by large companies is the data sharing that can happen between services owned by the same parent company. A horrifying example is the case of Positive Singles, a site that promises a confidential and positive experience for users who have STDs.

 

As Truman Lewis reported a few years ago for Consumer Affairs, the site is “part of a vast miasma of dating sites run by SuccessfulMatch.com,” which would be OK except that user profiles are shared across affiliated sites. And a class-action lawsuit alleged that when profiles of Positive Singles users showed up on other sites, their HIV and STD status was displayed for anyone to see.

The plaintiffs in that lawsuit said that the information-sharing broke the site’s promise of a fully anonymous and “100 percent confidential” service. That case was followed by another that found the site’s policy of sharing photos and profile details to be in violation of its promise of a confidential service.

 

SuccessfulMatch not only runs a number of its own niche dating sites, but also manages an affiliate service for those who want to set up dating sites of their own. It offers software and databases containing the details of hundreds of thousands of profiles — a pretty sketchy practice when you’re promising users that their information is private.

While the Positive Singles registration page included a link to terms of service that specify that users’ profile details could be shared with other sites within the SuccessfulMatch network, few members would click on or read those terms, and few were aware that the company was creating other dating sites, like AIDSDate, Herpesinmouth, ChristianSafeHaven, MeetBlackPOZ, and PositivelyKinky, that would include their profiles.

 

The jury ordered the company to pay $1.5 million in compensatory damages and another $15 million in punitive damages.

6. Plenty of Fish 

Accessing your data, broadcasting your activity, or sharing your profile are, unfortunately, not the only way that online dating services can violate your privacy. Like any other company, they can also fill your email inbox with spam. As John Hawes reported for Naked Security, the operators of popular dating site Plenty of Fish were hit with a $48,000 fine for violating Canada’s anti-spam laws.

 

The company failed to provide proper unsubscribe options in the emails it sent to users, since the emails in question either didn’t provide an unsubscribe feature or had an option that was either insufficiently prominent or not functioning well enough to satisfy the requirements of the legislation.

The Canadian Radio-television and Telecommunications Commission (CRTC) didn’t say how many emails were involved in the investigation or how many complaints it received, but did say that the campaign took place between July and October 2014.

 

The legislation states that commercial emails either have to provide a reply address or a web link for unsubscribe requests, and they must remain live for at least 60 days after sending emails. Requests to unsubscribe must be acted on “without delay,” within a maximum of 10 days.

Plenty of Fish sends members emails to notify them of new messages and to highlight users with similar interests, and it’s easy to imagine how annoyingly frequent those emails can be, even for users who are enthusiastic about using the dating service but don’t want it emailing them regularly and clogging up their inboxes.

7. Match.com

 

One of the most well-known names in the online dating world is Match.com, a dating site that’s made its share of serious privacy missteps over the years.

 

As far back as 2011, users were accusing the company of operating a “scam” by offering a list of potential matches mostly populated by canceled subscribers, people who never subscribed in the first place, duplicate profiles, and fake profiles that the company created to get users to cough up a subscription fee.

As Jim Hood reported for Consumer Affairs, a class action lawsuit alleged that less than 10% of Match’s members could actually be reached by another user, largely because of a subscription scheme in which only members who are paying subscribers can actually respond to winks and emails from other users or view the profiles of those who contact them.

 

The company often offers members or former subscribers free trials that enable them to access privileges normally restricted to paying subscribers, but then displays their profiles alongside those of subscribers.

 

At the time, Match.com was advertising that it had 15 million “Members,” but didn’t disclose that only 1.4 million of its members were actually subscribers.

It was a deceptive practice, and on the surface somewhat akin to one that the FTC charged England-based JDI Dating $616,165 for, since its sites were using fake profiles to trick people into upgrading to paid memberships.

 

But in the case of Match’s inflated membership numbers, it wasn’t a practice that necessarily violated anyone’s privacy — or at least that’s what you could assume until further allegations over Match’s fake profiles surfaced.

As Rich Calder and Leonard Greene reported for The New York Post, models and celebrities claimed that the site used their photos and biographical details to create fake profiles — or at least didn’t screen out fake profiles created by other users with their information. The site was uncooperative in helping a former Miss New York determine who was responsible for impersonating her on the dating site, though it did take down thprofile.

 

http://www.cheatsheet.com/gear-style/online-dating-7-sites-that-may-be-invading-your-privacy.html/?a=viewall