Dating app Raw exposed users’ location data and personal information

TechCrunch uncovered a significant security lapse in the Raw dating app, which exposed sensitive user data, including display names, birth dates, preferences, and precise location information. The vulnerability, known as an insecure direct object reference (IDOR), allowed unauthorized access to user data through a simple web browser hack. Raw claimed to offer end-to-end encryption, but TechCrunch found no evidence of such security measures during their testing. The company has since patched the exposure but faces scrutiny over its lack of a third-party security audit and its decision not to notify affected users directly.
The implications of this breach are far-reaching, raising concerns about the app's commitment to user privacy and data protection, especially as it plans to release the Raw Ring, a device for tracking partners' physiological data. This incident highlights the critical need for robust cybersecurity practices, as emphasized by the U.S. cybersecurity agency CISA, to prevent IDOR vulnerabilities and protect sensitive data. Raw's handling of the breach and its potential impact on user trust underscores the importance of transparency and accountability in tech startups, particularly those dealing with personal and intimate user data.
RATING
The article provides a detailed and well-researched account of a security lapse at the Raw dating app, highlighting significant data privacy concerns. It effectively combines investigative findings with the company's response, offering a balanced perspective on the issue. The clarity and transparency of the report are commendable, with a clear explanation of the technical aspects and methodology used.
While the article is accurate and timely, some areas require further verification, such as the duration of the data exposure and the total number of affected users. The inclusion of additional expert opinions or user testimonials could enhance the balance and engagement of the piece. Overall, the article is a strong example of investigative journalism, addressing a topic of public interest with potential implications for data privacy and security practices.
RATING DETAILS
The article presents a detailed account of a security lapse at the Raw dating app, with specific claims about the types of data exposed, the vulnerability type, and the company's response. The factual accuracy is supported by TechCrunch's direct testing and network traffic analysis, which identified the insecure direct object reference (IDOR) vulnerability. The report accurately describes the nature of the data exposed, such as users' display names, birthdates, and precise location coordinates, which aligns with the findings presented.
However, some aspects require further verification, such as the duration of the exposure and the total number of affected users, which the company has not disclosed. The article also mentions Raw's claim of using end-to-end encryption, which TechCrunch found no evidence of during their analysis. This discrepancy highlights the need for independent verification of the app's encryption practices. Overall, the article's accuracy is high, but some details remain unconfirmed.
The article provides a balanced perspective by including statements from both TechCrunch's investigative findings and responses from Raw's co-founder, Marina Anderson. This dual perspective allows readers to understand both the technical issues identified and the company's stance on the matter. However, the article could have been more balanced by including perspectives from cybersecurity experts or affected users to provide additional context on the implications of the data breach.
The piece does not show overt favoritism towards either TechCrunch or Raw, maintaining a neutral tone throughout. However, the lack of external expert opinions or user testimonials slightly limits the breadth of viewpoints represented, which could have enriched the narrative and provided a more comprehensive understanding of the issue.
The article is well-structured and clearly written, with a logical flow that guides the reader through the incident, the investigation, and the company's response. The use of technical terms, such as 'insecure direct object reference (IDOR),' is explained in layman's terms, making the content accessible to a general audience.
The tone is neutral and informative, avoiding sensationalism while effectively communicating the seriousness of the security lapse. However, the article could benefit from a clearer distinction between verified facts and statements requiring further verification, which would enhance reader comprehension. Overall, the clarity is strong, with a well-organized presentation of complex technical information.
The primary source of information is TechCrunch, a reputable technology news outlet known for its investigative reporting. The article is based on TechCrunch's direct testing and analysis of the Raw app, lending credibility to the findings. The inclusion of direct quotes from Marina Anderson, Raw's co-founder, adds authenticity and reliability to the company's response.
While the article heavily relies on TechCrunch's investigation, the quality of the source is high due to the detailed methodology and technical expertise demonstrated. However, incorporating additional sources, such as cybersecurity experts or independent audits, could have further strengthened the source quality by providing external validation of the findings.
The article is transparent about the methodology used by TechCrunch to uncover the security lapse, detailing the use of a virtualized Android device and network traffic analysis tools. This transparency allows readers to understand the basis of the claims made and the process behind the investigation.
Moreover, the article discloses the limitations of the investigation, such as the unknown duration of the data exposure and the lack of a third-party security audit by Raw. However, the article could improve transparency by providing more information on TechCrunch's expertise in conducting such analyses and any potential conflicts of interest. Overall, the transparency is commendable, with clear explanations of the investigative process and acknowledgment of unresolved questions.
Sources
YOU MAY BE INTERESTED IN

A timeline of South Korean telco giant SKT’s data breach
Score 6.8
PowerSchool paid a hacker’s ransom, but now schools say they are being extorted
Score 7.8
Chinese Ghost Hackers Hit Hospitals And Factories In America And U.K.
Score 7.4
‘China Is Everywhere’—Your iPhone, Android Phone Now At Risk
Score 5.8