Members of dating site FindSomeone could have had secret photos exposed, the owner Trade Me has admitted.
Want to buy or sell? Head to Trade Me, NZ's biggest & most popular auction & classifieds site, with thousands of new & used items in a wide range of categories. Trade Me plays down FindSomeone vulnerability. A FindSomeone member has found a way to view members' photos that should be hidden. Members of dating site FindSomeone could have had secret photos.
Spokesman Logan Mudge played down the risk, saying it had no evidence that had happened and that staff vetted all photos that members uploaded to ensure they contained 'nothing of a highly personal or salacious nature'.
FindSomeone allows members to upload photos that they can 'hide' from other members, until they want to share them with trusted correspondents.
But a member of the public said a combination of flaws allowed FindSomeone members to see if other members had hidden photos, work out the web address where they were located, and then download them at their full resolution.
READ MORE:
* Drive on for Trade Me to become more relevant
* How online dating became mainstream
* Kiwi singles reveal the most annoying dating habits
Mudge acknowledged the latter two issues were a risk but said Trade Me had not been able to replicate the first one.
The complainant contacted Stuff on Wednesday morning with details of the exploits after Trade Me failed to respond to an email he sent the previous day asking if the company paid a bounty for people who found 'bugs' in its system.
Mudge said fewer than 10 per cent of FindSomeone members chose to use the hidden photos feature and it was mainly useful for members trialling the service, who were limited in the number of photos they could show.
He did not believe the risk of the vulnerability being exploited was high and said Trade Me did not believe it warranted taking down the photo service until a fix was in place.
'It is technically possible for someone to find a hidden photo but it's not something we've had an issue with before, and it's well beyond the skills of most internet users. We have not had any complaints from members, or anyone else about this,' he said.
'Now it is on our radar we are certainly taking a look. I don't think 'concerned' is probably a word we would use.
'We think we could probably explain the 'hidden' feature better and we'll do that in our help section shortly,' he said.
The complainant said the detailed web addresses (hash tags) generated by the content delivery network that FindSomeone used to host photos were not sufficiently random.
But Mudge said 'using a content delivery network as we do with FindSomeone is standard industry practice'.
Trade Me announced last week that it had written off its $8 million investment in the dating site because of competition from the likes of Tinder, and that it would 'divert resources' to larger opportunities.
But it said FindSomeone was still visited by more than 22,000 people each day and it did not intend to close the service.
Google uses cookies and data to:Trademe Findsomeone Taranaki
- Deliver and maintain services, like tracking outages and protecting against spam, fraud, and abuse
- Measure audience engagement and site statistics to understand how our services are used
Find Someone By Name
If you agree, we’ll also use cookies and data to:- Improve the quality of our services and develop new ones
- Deliver and measure the effectiveness of ads
- Show personalized content, depending on your settings
- Show personalized or generic ads, depending on your settings, on Google and across the web
Findsomeone Trade Media
Click “Customize” to review options, including controls to reject the use of cookies for personalization and information about browser-level controls to reject some or all cookies for other uses. You can also visit g.co/privacytools anytime.