Tinder: Unencrypted images exposed activity on shared Wi-Fi

Researchers showed in 2018 that Tinder’s mobile apps sent images without encryption. Someone on the same Wi-Fi network could see which profiles a user viewed and what they swiped on. Tinder fixed the flaw that year.

What happened

Security company Checkmarx showed that Tinder’s iOS and Android apps sent profile pictures without HTTPS encryption. Someone on the same Wi-Fi network could see the pictures shown to a user and even replace them. The rest of the traffic was encrypted, but the data packets varied in size. This still made it possible to work out swipes and matches. The researchers created a demonstration tool that recreated the entire session. Later that year, Match Group confirmed in writing that the images were now encrypted and that swipe data had been adjusted so all actions produced the same packet size.

What is documented

• WIRED describes a working demonstration showing that images could be intercepted and replaced, and that swipes could be inferred.
• PCMag reproduces Match Group’s written confirmation that the flaws were fixed in February and June 2018.

What has not been established

• There is no documentation that any users were actually affected by malicious attacks.
• This was a technical vulnerability, not a decision by a court or regulator.
• The flaw has been fixed and should not be presented as currently active.

What this means for you

1. This was a historical flaw, not evidence that Tinder is insecure today.
2. The case shows that protecting images is not enough. Data about what you do in an app can also reveal information about you.
3. Be especially cautious when using sensitive apps on open networks such as café or hotel Wi-Fi.