Dating App Raw Exposes Sensitive User Data: Privacy Concerns Unveiled

TL;DR

The dating app Raw, which aims to provide authentic matching experiences, has been found to expose sensitive user data due to a lack of proper authentication in its API. This raises serious concerns about user privacy and the effectiveness of the app’s security measures.

Introduction

In the realm of online dating, the sensitivity of user data is paramount. Unfortunately, the relatively new dating app Raw, which launched in 2023 with the promise of rewriting the rules of dating, has fallen short in protecting its users’ information. The app, designed to address traditional online dating issues such as fake photos and ghosting, has exposed user data to anyone who requests it, raising significant privacy concerns.

Raw’s Unique Approach to Dating

Raw aims to solve common problems in online dating by sharing user locations and requiring daily photo updates to create a more authentic matching experience. The app collects standard dating app data, including name, birth date, gender identity, photos, geolocation, and IP address, storing some of this data on servers in the US.

Privacy Policy and Encryption Claims

Raw’s privacy policy assures users that their information is protected with end-to-end encryption. The company’s FAQ section emphasizes this commitment:

“Your information is cloaked in encryption and guarded like a princess in a castle by our devs. We don’t sell or share your info in any way – your privacy is a promise we don’t break.”

However, recent findings by TechCrunch reveal that these claims may not hold up under scrutiny.

Data Exposure and API Vulnerabilities

TechCrunch conducted an investigation by running a copy of the Raw app on a virtualized Android device. They created a new user account and observed that the app’s server returned profile data without requiring any authentication. This vulnerability allows anyone to access user information by simply requesting it through the app’s API, using an 11-digit user ID.

The API’s lack of authentication means that anyone can grab profile information and potentially vacuum lots of peoples’ data en masse by changing the user ID numbers. This highlights a significant flaw in Raw’s data protection measures.

Company Response and Future Plans

At the time of writing, Raw had not mentioned the issue on its site. CEO Marina Anderson told TechCrunch that the issue had been resolved and regulators had been notified. However, Anderson had not arranged for a third-party audit of the app, raising further concerns about the app’s security practices.

Raw has ambitious plans beyond improving matches. The company is developing a wearable device called the Raw Ring, which includes sensors to read vital signs and an audio tracker to analyze voice and emotional cues. Marketed as an anti-infidelity tool, the Raw Ring promises end-to-end data encryption, but the recent data leak casts doubt on the effectiveness of these security measures.

Implications and Concerns

The idea of the Raw Ring raises concerns about surveillance tech, which has a dark history of being used to monitor partners in controlling relationships. There are numerous cases of such apps exposing sensitive data, adding to the existing privacy issues.

Given the recent data leak, it remains to be seen how many users will trust Raw with their personal information, especially with the introduction of the Raw Ring. The company’s technological faux-pas has raised serious questions about its commitment to user privacy and data security.

Conclusion

The exposure of sensitive user data by the dating app Raw underscores the importance of robust data protection measures in online platforms. As users increasingly rely on such apps for personal connections, ensuring the security and privacy of their information is crucial. The future of Raw and similar apps will depend on their ability to address these concerns and regain user trust.

Additional Resources

For further insights, check:

• TechCrunch Report on Raw’s Data Exposure
• Malwarebytes on Stalkerware

References