Bumble and Hinge allowed stalkers to pinpoint users’ locations down to 2 meters, researchers say

Oracle trilateration works slightly differently. The researchers wrote in their paper that the first step for the person who wants to identify their target’s location “roughly estimates the victim’s location,” for example, based on the location displayed in the target’s profile. Then, the attacker moves in increments “until the oracle indicates that the victim is no longer within proximity, and this for three different directions. The attacker now has three positions with a known exact distance, i.e., the preselected proximity distance, and can trilaterate the victim,” the researchers wrote. 

“It was somewhat surprising that known issues were still present in these popular apps,” Karel Dhondt, one of the researchers, told TechCrunch. While this technique doesn’t reveal the exact GPS coordinates of the victim, “I’d say 2 meters is close enough to pinpoint the user,” Dhondt said. 

The good news is that all the apps that had these issues, and that the researchers reached out to, have now changed how distance filters work and are not vulnerable to the oracle trilateration technique. The fix, according to the researchers, was to round up the exact coordinates by three decimals, making them less precise and accurate. 

“This is approximately an uncertainty of one kilometer,” Dhondt said. 

A Bumble spokesperson said that the company was “made aware of these findings in early 2023 and swiftly resolved the issues outlined.”

Dmytro Kononov, CTO and co-founder of Hily, told TechCrunch in a statement that the company received a report on the vulnerability in May 2023 and then did an investigation to assess the researchers claims. 

“The findings indicated a potential possibility for trilateration. However, in practice, exploiting this for attacks was impossible. This is due to our internal mechanisms designed to protect against spammers and the logic of our search algorithm,” Kononov said. “Despite this, we engaged in extensive consultations with the authors of the report and collaboratively developed new geocoding algorithms to completely eliminate this type of attack. These new algorithms have been successfully implemented for over a year now.

Neither Badoo, which is owned by Bumble, nor Hinge responded to a request for comment.

Happn CEO and President Karima Ben Abdelmalek told TechCrunch in an emailed statement that the company was contacted by the researchers last year. 

“After review by our Chief Security Officer of the research findings, we had the opportunity to discuss the trilateration method with the researchers. However, happn has an additional layer of protection beyond just rounding distances,” said Ben Abdelmalek. “This additional protection was not taken into account in their analysis and we mutually agreed that this extra measure on happn makes the trilateration technique ineffective.”

The researchers also found that a malicious person could locate users of Grindr, another popular dating app, to around 111 meters of their exact coordinates. While this is better than the 2 meters that the other apps allowed, it could still be potentially dangerous, according to the researchers. 

“We argue that 111 meters, which is the corresponding distance that goes with this precision, is not sufficient in densely sparsely populated areas,” said Dhondt. 

Grindr makes it impossible to go below 111 meters because it rounds users’ precise locations by three decimals. And when they reached out to Grindr, the company said that this was a feature, not a bug, according to the researchers. 

Kelly Peterson Miranda, chief privacy officer at Grindr, said in a statement that “for many of our users, Grindr is their only form of connection to the LGBTQ+ community, and the proximity Grindr offers to this community is paramount in providing the ability to interact with those closest to them.” 

“As is the case with many location-based social networks and dating apps, Grindr requires certain location information in order to connect its users with those nearby,” Miranda said, adding that users can disable their distance to be displayed if they want. “Grindr users are in control of what location information they provide.”