News
Grindr security flaw exposes user location data
the breach put more than three million daily users at risk

(Logo courtesy of Grindr)
More than three million of Grindr’s daily users were temporarily put at risk because of a major security flaw in the app that was exposed by a third-party site.
C*ckblocked, a now-defunct site that allowed Grindr users to view who blocked them by entering a Grindr user name and password, was able to access user information from Grindr’s Application programming interface (API). The information included email addresses, deleted photos, personal messages and the location of users.
Trever Faden, founder of C*ckblocked, told NBC that it would be easy for anyone to access a user’s private information.
“One could, without too much difficulty or even a huge amount of technological skill, easily pinpoint a user’s exact location,” Faden told NBC.
In a separate security issue, Faden claimed that Grindr users’ location, which must be inputed directly into the app and not via a third-party site, was not encoded and could be accessed by anyone monitoring public online traffic.
Faden emphasized that the ability to find a user’s location was “a feature, not a bug.”
NBC reports that two independent cybersecurity researchers confirmed the security flaw.
After Faden informed Grindr of the security issues, Grindr blocked the flaw that allowed third-party sites like C*ckblocked to receive data.
Grindr released a statement advising users not to use their username and password for other sites.
“Grindr moved quickly to make changes to its platform to resolve this issue. Grindr reminds all users that they should never give away their username and password to any third parties claiming to provide a benefit, as they are not authorized by Grindr and could potentially have malicious intent,” the statement reads.
However, Grindr denied that user location isn’t encoded.
“Grindr is a location-based app. Location is a critical element of our social network platform. This allows our users to feel connected to our community in a world that would seek to isolate us. That said, all information transmitted between a user’s device and our servers is encrypted and communicated in a way that does not reveal your specific location to unknown third parties,” Grindr’s Chief Technology Officer Scott Chen told the Huffington Post.
The company also released a statement on Twitter to inform users that the problems have been addressed and to be safe using their service.
As a company that serves the LGBTQ community, we understand the delicate nature of our users’ privacy. Ensuring safety and security of our users is of paramount importance to us and will continue to be our top priority. pic.twitter.com/vD2zXqxSr0
— Grindr (@Grindr) March 29, 2018
The flaw is similar to the one in the Facebook/Cambridge Analytica scandal, which allegedly exposed the personal data of 50 million users.
The Comings & Goings column is about sharing the professional successes of our community. We want to recognize those landing new jobs, new clients for their business, joining boards of organizations and other achievements. Please share your successes with us at [email protected].
Congratulations to Gil Pontes III on his recent appointment to the Financial Advisory Board for the City of Wilton Manors, Fla. Upon being appointed he said, “I’m honored to join the Financial Advisory Board for the City of Wilton Manors at such an important moment for our community. In my role as Executive Director of the NextGen Chamber of Commerce, I spend much of my time focused on economic growth, fiscal sustainability, and the long-term competitiveness of emerging business leaders. I look forward to bringing that perspective to Wilton Manors — helping ensure responsible stewardship of public resources while supporting a vibrant, inclusive local economy.”
Pontes is a nonprofit executive with years of development, operations, budget, management, and strategic planning experience in 501(c)(3), 501(c)(4), and political organizations. Pontes is currently executive director of NextGen, Chamber of Commerce. NextGen Chamber’s mission is to “empower emerging business leaders by generating insights, encouraging engagement, and nurturing leadership development to shape the future economy.” Prior to that he served as managing director of The Nora Project, and director of development also at The Nora Project. He has held a number of other positions including Major Gifts Officer, Thundermist Health Center, and has worked in both real estate and banking including as Business Solutions Adviser, Ironwood Financial. For three years he was a Selectman, Town of Berkley, Mass. In that role, he managed HR and general governance for town government. There were 200+ staff and 6,500 constituents. He balanced a $20,000,000 budget annually, established an Economic Development Committee, and hired the first town administrator.
Pontes earned his bachelor’s degree in political science from the University of Massachusetts, Dartmouth.
Kansas
ACLU sues Kansas over law invalidating trans residents’ IDs
A new Kansas bill requires transgender residents to have their driver’s licenses reflect their sex assigned at birth, invalidating current licenses.
Transgender people across Kansas received letters in the mail on Wednesday demanding the immediate surrender of their driver’s licenses following passage of one of the harshest transgender bathroom bans in the nation. Now the American Civil Liberties Union is filing a lawsuit to block the ban and protect transgender residents from what advocates describe as “sweeping” and “punitive” consequences.
Independent journalist Erin Reed broke the story Wednesday after lawmakers approved House Substitute for Senate Bill 244. In her reporting, Reed included a photo of the letter sent to transgender Kansans, requiring them to obtain a driver’s license that reflects their sex assigned at birth rather than the gender with which they identify.
According to the reporting, transgender Kansans must surrender their driver’s licenses and that their current credentials — regardless of expiration date — will be considered invalid upon the law’s publication. The move effectively nullifies previously issued identification documents, creating immediate uncertainty for those impacted.
House Substitute for Senate Bill 244 also stipulates that any transgender person caught driving without a valid license could face a class B misdemeanor, punishable by up to six months in jail and a $1,000 fine. That potential penalty adds a criminal dimension to what began as an administrative action. It also compounds the legal risks for transgender Kansans, as the state already requires county jails to house inmates according to sex assigned at birth — a policy that advocates say can place transgender detainees at heightened risk.
Beyond identification issues, SB 244 not only bans transgender people from using restrooms that match their gender identity in government buildings — including libraries, courthouses, state parks, hospitals, and interstate rest stops — with the possibility for criminal penalties, but also allows for what critics have described as a “bathroom bounty hunter” provision. The measure permits anyone who encounters a transgender person in a restroom — including potentially in private businesses — to sue them for large sums of money, dramatically expanding the scope of enforcement beyond government authorities.
The lawsuit challenging SB 244 was filed today in the District Court of Douglas County on behalf of anonymous plaintiffs Daniel Doe and Matthew Moe by the American Civil Liberties Union, the ACLU of Kansas, and Ballard Spahr LLP. The complaint argues that SB 244 violates the Kansas Constitution’s protections for personal autonomy, privacy, equality under the law, due process, and freedom of speech.
Additionally, the American Civil Liberties Union filed a temporary restraining order on behalf of the anonymous plaintiffs, arguing that the order — followed by a temporary injunction — is necessary to prevent the “irreparable harm” that would result from SB 244.
State Rep. Abi Boatman, a Wichita Democrat and the only transgender member of the Kansas Legislature, told the Kansas City Star on Wednesday that “persecution is the point.”
“This legislation is a direct attack on the dignity and humanity of transgender Kansans,” said Monica Bennett, legal director of the ACLU of Kansas. “It undermines our state’s strong constitutional protections against government overreach and persecution.”
“SB 244 is a cruel and craven threat to public safety all in the name of fostering fear, division, and paranoia,” said Harper Seldin, senior staff attorney for the ACLU’s LGBTQ & HIV Rights Project. “The invalidation of state-issued IDs threatens to out transgender people against their will every time they apply for a job, rent an apartment, or interact with police. Taken as a whole, SB 244 is a transparent attempt to deny transgender people autonomy over their own identities and push them out of public life altogether.”
“SB 244 presents a state-sanctioned attack on transgender people aimed at silencing, dehumanizing, and alienating Kansans whose gender identity does not conform to the state legislature’s preferences,” said Heather St. Clair, a Ballard Spahr litigator working on the case. “Ballard Spahr is committed to standing with the ACLU and the plaintiffs in fighting on behalf of transgender Kansans for a remedy against the injustices presented by SB 244, and is dedicated to protecting the constitutional rights jeopardized by this new law.”
National
After layoffs at Advocate, parent company acquires ‘Them’ from Conde Nast
Top editorial staff let go last week
Former staff members at the Advocate and Out magazines revealed that parent company Equalpride laid off a number of employees late last week.
Those let go included Advocate editor-in-chief Alex Cooper, Pride.com editor-in-chief Rachel Shatto, brand partnerships manager Erin Manley, community editor Marie-Adélina de la Ferriére, and Out magazine staff writers Moises Mendez and Bernardo Sim, according to a report in Hollywood Reporter.
Cooper, who joined the company in 2021, posted to social media that, “Few people have had the privilege of leading this legendary LGBTQ+ news outlet, and I’m deeply honored to have been one of them. To my team: thank you for the last four years. You’ve been the best. For those also affected today, please let me know how I can support you.”
The Advocate’s PR firm when reached by the Blade said it no longer represents the company. Emails to the Advocate went unanswered.
Equalpride on Friday announced it acquired “Them,” a digital LGBTQ outlet founded in 2017 by Conde Nast.
“Equalpride exists to elevate, celebrate and protect LGBTQ+ storytelling at scale,” Equalpride CEO Mark Berryhill said according to Hollywood Reporter. “By combining the strengths of our brands with this respected digital platform, we’re creating a unified ecosystem that delivers even more impact for our audiences, advertisers, and community partners.”
It’s not clear if “Them” staff would take over editorial responsibilities for the Advocate and Out.
