Cyber Liability

Growing concerns about cybersecurity in dating apps

Matt McKenna
Updated: Apr 19, 2024

TL:DR

Key Takeaways

Matt McKenna

Underwriting Manager

Vulnerabilities have been discovered in some popular dating apps.

What lessons can other businesses take away?

Anyone who uses an app assumes that there’s a certain amount of privacy involved. This isn’t unique to dating apps. Consumers accept that the app marketplace and/or developer will collect usage and error data and certain forms of personally identifiable information.

What they don’t expect is that unauthorized third parties will be able to view and even control user experience on the app.

That’s the exact situation that dating app Tinder is dealing with right now. One flaw in the mobile app’s security gave some creative hackers a point of entry. Then they were able to view the pictures a user was looking and even track the user’s swipes.

In theory, a bad actor could sell this info, use it for blackmail or who knows what else.

But they’re not alone, as the Hustle noted. Several other dating apps have been called out for vulnerabilities in their geo-location system. Hackers were actually able to physically locate users despite deliberate efforts from the companies to hide GPS data.

Cybersecurity in dating apps is the topic of the day but every company with an online presence bears similar risks. What can they learn from Tinder’s experience?

Spotting vulnerabilities is a constant battle

It’s a marathon, not a sprint, and companies use various methods to address this. Third party security firms and bug bounties have emerged as valuable solutions.

Tinder is well aware of the ongoing threat:

In a statement to WIRED, a Tinder spokesperson wrote that “like every other technology company, we are constantly improving our defenses in the battle against malicious hackers,” and pointed out that Tinder profile photos are public to begin with. (Though user interactions with those photos, like swipes and matches, are not.) The spokesperson added that the web-based version of Tinder is in fact HTTPS-encrypted, with plans to offer those protections more broadly. “We are working towards encrypting images on our app experience as well,” the spokesperson said.

This shows us two things: 1) fixes take time and 2) no plan is foolproof.

Vulnerabilities will be found and exploited, and they can be expensive to fix.

Whether it’s by you, bad actors or white hat hackers who want to raise awareness/promote their services, vulnerabilities will be found. The goal is for you to find them first so you can avoid bad press, or much worse.

In the case of Tinder, the problem is a clear vulnerability in their protocol: they use HTTP instead of HTTPS encryption. Pretty simple. But not all vulnerabilities will be so clear. The costs of finding and fixing these vary on a case-by-case basis. (One cyber security expert estimated an average cost of $28,000 to repair all of the bugs on a website.)

Insurance can protect you from data breaches when all else fails

Year after year, high-profile data breaches are showing us that companies who are proactive about cyber security are investing in their future. The cost of failure is simply too high.

By the time insurance enters the picture, the vulnerabilities have been found and exploited by bad actors. Now is the time for damage control.

Cyber insurance offers two main protections after a data beach happens:

Paying the costs of defending you from certain suits and investigations.
Reimbursing the company for certain direct expenses that arise.

Policies often include limits for defense costs, regulatory investigations, PCI compliance fines and expenses, breach notification costs, PR and crisis management consultation and the costs of maintaining a call center and credit monitoring for affected users. And these are just the basics in terms of protections available from carriers today. More nuanced and advanced coverages can be tailored to special risks.