Bumble, Badoo, Hinge, Hily: Users could be located to within 2 metres

KU Leuven researchers found that distance filters in several dating apps could reveal a user's near-exact location. The companies say the flaws were fixed after disclosure in 2023.

What happened

Researchers at KU Leuven analysed 15 location-based dating apps and published their results at the USENIX Security conference in August 2024. They found that Badoo, Bumble, Hinge and Hily used exact distances in their distance filters. An attacker could move a test account step by step until the target dropped out of the filter in three directions, then calculate the target's position. The researchers call this "oracle trilateration". According to TechCrunch, this could pinpoint a user to within about 2 metres, even where distance was hidden in the app. Happn leaked more precise distances than it displayed, and Grindr users could be located to within about 111 metres. Tinder and LOVOO were not vulnerable. After their analysis in January 2023 the researchers disclosed their findings to all 15 vendors, and TechCrunch reported that all affected apps they contacted had changed how distance filters work.

What is documented

• KU Leuven / USENIX Security paper: Badoo, Bumble, Hinge and Hily were susceptible to oracle trilateration; Grindr (to about 111 m) and Happn also allowed location inference.
• TechCrunch: Bumble says it was made aware in early 2023 and resolved the issues, also in Badoo; Hinge says it took action in early 2023; Hily says it received the report in May 2023; Happn says an extra protection made the technique ineffective; Grindr says certain location information is needed to connect nearby users.

What has not been established

• Whether any user was actually located by an attacker using this method.
• Happn says that the technique was ineffective against its app.

What this means for you

1. Turn off distance display if the app allows it, and avoid using the app at home or at work if your safety is at risk.
2. Do not reveal where you live in your profile or early chats.
3. If you are being stalked, consider pausing location-based apps and contact the police.