Group sex dating app has "the worst security for any dating app"

One of the wonderful and terrible things about the internet is how it allows people seeking others with hard-to-find traits to find them: advertisers can find people thinking about buying a refrigerator; people who think they might be trans can find others in the same boat and make common cause; people with the same rare disease can form support groups, and Nazis can find sociopaths to march through the streets of Charlottesville carrying tiki torches and chanting "Jews will not replace us."

This has been especially pronounced in human sexuality. Anonymous access to porn lets people explore different sexual activities. Online dating services lets people find those who share their kinks, interests, or special needs.

Enter 3fun, an online dating service for those seeking group sex with others. While there is nothing wrong with this activity, and while it's one that dates back to antiquity and probably before, there is still substantial social stigma associated with it, so apps are a great way of finding partners without exposing yourself to retaliation from employers, family, peers and friends.

That is, unless 3fun is designed with security as an afterthought in a way that exposes its users to snoops who could use the data it leaks to harass, blackmail, or expose its users.

Guess what!

Pen Test Partners's audit of 3fun revealed "probably the worst security for any dating app weve ever seen."

The audit revealed vulnerabilities that would allow attackers to enumerate all 3fun users, including sexual orientation, preferred matches, usernames, ages, partners' usernames, full-rez profile photos, and some dates of birth. Read the rest