Security researchers have discovered that your Tinder swipes might not be as private as you thought.
The dating app does not yet use HTTPS encryption when it comes to fetching images, according to security firm Checkmarx. This lack of encryption means your Tinder activity could be exposed over a local Wi-Fi network, revealing Tinder likes and matches in real time.
Researchers at Checkmarx demoed their attack in a YouTube video using a custom-made program called "TinderDrift." It leveraged two vulnerabilities, the first of which exploited the lack of HTTPS encryption.
When the Tinder app shows you a new dating profile, it does so by making a non-encrypted HTTP request over the network. This can leave the entire request, including the web address for the image, exposed.
The researchers paired this with another vulnerability that can discern your Tinder swipes. They found the dating app indicates a left swipe (for profiles you don't like) whenever it sends 278 bytes of encrypted information to the company's image server.
For a right swipe (on dating profile you like), it'll send 374 bytes. When it comes to matches that appear on Tinder, the app will send 581 bytes.
By combining both vulnerabilities, the researchers were able to spy on a Tinder app running on a nearby smartphone. Fortunately, the hack has limitations; it only works when the attacker is on the same Wi-Fi network as the victim, for example.
"This is possible via any public hotspot. Other scenarios where an attacker can intercept traffic include VPN or company administrators," the researchers said in their report.
The vulnerabilities also don't involve credit cards or passwords, making them of little use to common cybercriminals. Nevertheless, Checkmarx found the lack of encryption to be problematic. "Knowing an ill-disposed attacker can view and document your every move on Tinder, who you like, or who you decide to chat with is definitely disturbing," the company said.
The security researchers sent their findings to Tinder, which said it's working to roll out encryption for the app's image fetching. Both the desktop and mobile web versions of the dating app already use the encryption.
"Like every other technology company, we are constantly improving our defenses in the battle against malicious hackers," the company said.