This just in: Grindr has just been exposed for having some major and majorly creepy security flaws.

The flaws were first discovered by Trever Faden who first contacted Queerty earlier this month about his website C*ckblocked.

The site allowed users to enter their Grindr info and see who had blocked them on the app. Once they did so, however, Faden says he found another, even bigger security loophole.

Faden tells NBC he was able to gain access to all sorts of other data not publicly available on their profiles, including unread messages, email addresses, deleted photos, and the location data of users, even those who opted not to publicly share their locations.

“One could, without too much difficulty or even a huge amount of technological skill, easily pinpoint a user’s exact location,” Faden says.

Related: This simple new tool lets you see exactly who’s blocked you on Grindr

And by “exact location,” he means right down to the exact area of the building in which a user was located, which can be found in mere minutes by anyone with the know-how.

But it gets creepier.

NBC reports:

Faden also discovered a separate security flaw related to location data that did not require users to log in to any third-party apps or websites with their Grindr credentials. Grindr requires users to send location data to its servers in order for the app to work. Some of that information is not encoded, meaning that passive observers of internet traffic — for instance, on a public Wifi network watched over by a country’s government — can identify the location of anyone who opens the app.

Yikes.

“There are a million reasons why you might not want someone to find your location through Grindr, and Grindr is dealing with that as a non-issue,” Cooper Quintin, a security researcher at the Electronic Frontier Foundation, tells NBC. “They’re putting people’s lives at risk by doing that.”

Faden says he has no intention of using the data his website has collected for nefarious purposes, so you can relax about that. He merely wants to use the experiment to raise awareness to some very serious security flaws on one of the most popular dating apps among gay men.

“The single weakest point in most security chains is often the human element,” he says. “Not backdoors, not weak authentication schemes — just people with malicious intent that know enough to dupe other people.”

Related: C*ckblocked app exposes all the micro-aggressive racists on Grindr

h/t: NBC

Don't forget to share:

Help make sure LGBTQ+ stories are being told...

We can't rely on mainstream media to tell our stories. That's why we don't lock Queerty articles behind a paywall. Will you support our mission with a contribution today?

Once Monthly Annually

Cancel anytime · Proudly LGBTQ+ owned and operated