Bumble and Hinge allowed stalkers to pinpoint users' locations down to 2 meters

Researchers from KU Leuven have identified vulnerabilities in popular dating apps, including Bumble and Hinge, that allowed stalkers to determine users' locations with a precision of up to 2 meters. The study analyzed 15 dating apps and found that several, including Badoo, Grindr, and Hily, shared this flaw. Although these apps do not display exact locations, they utilize precise coordinates for their distance filters, which can be exploited using a method called "oracle trilateration." This technique involves estimating a target's location and then adjusting proximity until the exact position is triangulated.

The researchers expressed surprise that such vulnerabilities persisted in widely used applications. However, following their findings, all affected apps have since modified their distance filter mechanisms to mitigate the risk, rounding coordinates to reduce precision to approximately one kilometer. Bumble confirmed it addressed the issue promptly after being informed in early 2023. Hily's CTO stated that while the potential for trilateration existed, their internal protections made exploitation impractical. Grindr, which rounds user locations to 111 meters, defended its approach as a necessary feature for connecting users within the LGBTQ+ community.

The study highlights ongoing concerns about user privacy and security in location-based services, emphasizing the need for robust protective measures in app design.