Yes. I really hope this teaches them a lesson and they fix it before 4chan acts but that problem won't happen. Also If I would have stayed quiet and not informed the public that the app doesnt care about your privacy, a databreach was bound to happen at some point, because they are just leaving holes for bad guys to discover.
I do want people's privacy to be protected, this app has been insecure since day one, and they obviously don't care, it's been 9 months. I posted about it since they obviously didnt give a shit, because this will now hopefully force them to actually fix it.
Instead of fixing these issues they have been implement "ai matchmaking" like that is more important.
And these fixes aren't that hard either. Its not rocket science.
My goal is not to get hired, my goal is to hold them responsible and hopefully make them fucking fix it.
I hate companies that don't give a rats ass about their users security and waste time making ai shit instead of fixing their problems cuz they dont care.
You absolutely nailed it. As the researcher who found these vulns, I can confirm the over-engineering is real.
They literally had internal user IDs (ofId) already implemented and working, but kept the email-based JIDs for "legacy support." The entire XMPP system could have used these internal IDs from day one.
The "14 months to fix" claim was even more ridiculous when you realize the fix was just... using the IDs they already had. No architectural changes needed. They even admitted they had a 1-month fix ready but chose not to deploy it.
Your microservice translation layer guess is scary accurate - that's essentially what their "v2" endpoints were trying to do. They created new HTTP endpoints that used internal JIDs instead of email-based ones, but the XMPP layer still exposed everything, making the whole effort pointless.
The best part? After going public, they implemented the "impossible" fix in 48 hours. Turns out you don't need 14 months when the Internet is watching.
Hi HN, I'm the researcher who found these vulnerabilities. Happy to answer questions.
A few clarifications on the technical side:
The XMPP issue wasn't just about JIDs containing emails - it was that their roster sync actively linked internal IDs to real email JIDs. Even their "v2" endpoints that tried to hide emails were useless because the XMPP layer still exposed everything.
Regarding the "14 months to fix" claim - they actually had the fix ready (they admitted they could do it in 1 month) but chose not to deploy it for "legacy support." The fix they implemented after public pressure was exactly what I suggested months ago: just use the internal IDs they already had.
The most frustrating part was discovering other researchers reported these exact bugs in 2022 and 2023. Lovense told them it was "fixed" while paying them peanuts ($350 vs the $3000 they paid me for the same bugs).
Also, to address the over-engineering comment by chmod775 - you're spot on. They had internal user IDs (ofId) the whole time but maintained this complex dual system. The "architectural complexity" was self-inflicted.
