Client-side filtering of private data is a bad idea

Matthew Garrett discusses the security vulnerabilities he discovered in the dating app Feeld, which is popular among alternative relationship communities. He highlights that the app's claim of protecting user privacy is misleading, as he found that private data could be accessed through simple queries. By analyzing the app's code, he identified that certain fields, such as "lookingFor" and "ageRange," were not displayed in the user interface but were still retrievable through the app's queries. This indicates that the app was not adequately protecting sensitive information. Additionally, hidden profiles were still included in the data sent to the app, raising further privacy concerns. Garrett faced challenges in reporting these issues, as there was no clear security contact, but eventually communicated with Feeld's security team, who confirmed that the vulnerabilities had been addressed. He emphasizes that client-side filtering is insufficient for protecting private data and that developers must implement robust security measures to prevent unauthorized access. While he acknowledges that some aspects, like private images and location data, appeared to be secure, he stresses the importance of thorough verification to ensure all potential vulnerabilities are resolved.

- Feeld's privacy claims were found to be misleading, as private data could be accessed through queries.

- Sensitive fields were retrievable even if not displayed in the app's user interface.

- Hidden profiles were still included in data sent to the app, raising privacy concerns.

- Garrett faced difficulties reporting the vulnerabilities but successfully communicated with Feeld's security team.

- Emphasizes the need for robust security measures beyond client-side filtering to protect private data.