How Tinder and Facebook make stalkers’ life easier

T. Delemazure - P. Bourhis - R. Rouvoy - W. Rudametkin

Abstract

Edit: Tinder patched this breach and does not use Face-

book informations anymore. Everything explained here

is outdated. Launched in 2012, Tinder is the first mo-

bile app in several countries with more than 100 mil-

lions download. This dating app enable its users to meet

people with close geographical proximity. In this paper,

with more than 100 millions downloads on the play store.

The challenge of this kind of app is to enable date be-

tween persons with common interests, and for that, Tin-

der use an easy solution : The Facebook profile of the

user. Indeed, Facebook profiles say a lot about who we

are : Where do we live, who are our friends, what are my

interests, what pictures I liked, who are my classmates,

etc.

By promoting the connection between your Tinder ac-

count and Facebook account, Tinder get a lot of informa-

data and social networks like Facebook don’t really help

them.

2 Tools

To create a Tinder account, people have two possibilities

: Use their phone number, or use their Facebook account.

In any case, they have to give a phone number to the app.

We are interested in the case where the user use his

Facebook account to log in. In that case, we may have

access to several information about the user, according

to his privacy settings : The first name is mandatory and

unchangeable, the age and the distance from me are often

a user can link is Tinder account to an Instagram account

and a Spotify account. An example of what a Tinder pro-

file look like is presented in Figure 1.

Figure 1: A Tinder profile

All these information can be shared publicly, even

with people you don’t match with.

In our experiment we will use Facebook interests. This

information contains the 100 last Facebook pages liked

by the users and display the intersection of my 100 in-

terests and the 100 interests of the user of who I see the

Tinder profile.

page), their work place, their university, their city. Most

importantly, one can do the intersection of several selec-

tion like these.

Since the first name is a part of the public profile, we

are sure to find the user on the result of a query selecting

only according to the first name. But there is billions

users on Facebook and their might be too many results

for a stalker. We can then use Facebook interest, job,

studies and city, but the user have the possibility to hide

those information on Facebook.

order is done even if those attributes are hidden.

3 The restrictive power of interests

It is known that our Facebook interests (i.e. pages we like

on Facebook) tells many things about us. Actually, they

can also say who we are, like a fingerprint. To be precise

enough, we don’t need to know every page you like on

Facebook. Indeed, with your first name and around 10

interests, there is a really high probability to find you.

First of all, what happen if we assume probabilities of

like are random and independents ?

ity that a user u like a page P ∈ P is P(u, P) =

φ(P)

.

If we assume that F > 30000000 and ∀P ∈ P,φ (P) <

5000000, then

If we assume every like is independent and we know

for a user u 10 liked pages, then we have P(u,P

) <

In France, the most common first name is ”Marie” and

there is less than 3% french citizen with this name. Then

the probability for n ∈ N is P(u, n,P

,..., P

) < 3.5 ×

10

It means that the probability that 2 french citizen have

the first name n and that their interests contains P

,..., P

is around 1 − (1 − P(u,n, P

= 1,7%.

With 15 interests, there is almost no probability of false

positive.

3.2 What happen in reality ?

diences of different pages with users named ”Manon” (in

order to reduce the number of results)

Figure 2: Intersection of audiences

In the second example shown Figure 3, we can see that

it is useless to do the intersection between pages with

identical audiences, for instance between a Youtuber 1

(2M Likes) and a Youtuber 2 (4,5M Likes). At the oppo-

site, the intersection with a different kind of audience is

very restrictive, for instance between the same Youtuber

1 (2M Likes) and a newspaper (4,2M Likers).

Moreover, first name are not equally distributed. For

instance, a page with 96K likes will have ten times more

name as last name or who have a name similar to this

one. For instance, with the same page with 96K likes,

if you want likers named ”Jean”, the Facebook tool will

return more than 2,2K results, because of every ”Jean-

Pierre”, ”Jean-Jacques”, etc., even if the actual number

of ”Jean” who liked this page does not exceed 300.

Another important point is to adapt the selection of

pages to the kind of audience we want to target. Two

important criteria are the gender and the age range. For

instance, some pages have 90% of their like which are

A view of users from a particular profession :

Reasons why this attack does not work anymore is

probably the recent changes on Google reverse search al-

the last 100 pages liked, so the page of a famous singer

who did nothing since 2012 will be useless.

Actually, we can sometimes Notwithstanding those

rules with around 10% of the pages liked. If we add

pages with more than 5M likes, we will probably have

more users with common interest and if we add pages

with less than 100K likes, maybe they will not appear

often, but they will be useful when appeared. If we use

only local pages, tourists/foreigners will not be found.

Finally, we have to take in account that it is the last 100

Once the Tinder account is created, we can begin to

link Tinder profile to Facebook account : For each Tinder

profile shown, we looked at the common interests (i.e.

common Facebook pages liked, see Figure 5). If there

were no common interests, we did nothing (even if the

user was probably vulnerable, if he linked his Instagram

To find the user, we need his first name (public), his

gender (public) and every common interests (sometimes

private). With those information we can then do a

If the target gives his location to Facebook, then it will

probably appear on top of the results, making the work

of the stalker easier. If their is too many results for a

human stalker, then we can also add a selection on the

job, studies and city (but their is more probability for

those information to be private)

If the target does not appear in the results, then he

probably secure his account on one of the criteria used.

mon interest, several incompatible interests (for instance

5.3 Data gathering

Now that we know it is possible for a human to stalk

manually Tinder users, what about bots ? Actually, we

can totally imagine a script which link each Tinder ac-

count with a Facebook account.

For that, we need to create hundred of Facebook ac-

count and like 100 different Facebook pages for each tin-

der account. With 100 account we can cover 10000 Face-

and in another table it will save interests of each user and

gather interests collected by each fake account.

When we have more than 10 interests for one user,

we can do a query to find this user on Facebook. The

Figure 5: Example of a profile with many Facebook in-

terest

probability that there is a false positive is really low (see

section 7), so if there is one result, we can assume we

have find our user.

If there is more than one result, then we have a false

positive, so we can wait to have more interests for this

can minimize the number of queries by doing the union

of all the queries :

query

5.4 Who would have an interest to do that

?

Actually, it is easy to found an interest on those informa-

tion. First of all, a firm can get a database of Facebook

sell those information. They can also associated infor-

mation appearing on the Tinder account to the user and

sell those information.

It also enables stalker to found their target really eas-

ily.

with attractive profiles. When they have a match, they

will ask questions about him/her, like if it was part of the

seduction game but it is just to collect data.

6 Results of experiments

We did two slots of the stalker attack presented in section

3.2.

6.1 First experiment

In the first experiment we create a profile with gender

male, interested in females. No city added on Facebook,

no profile picture and 100 pages liked (see References).

38 of those 117 profiles were easily find (32 %). At

the end, we find the Facebook id of 12% of the profiles

shown (See Figure 7).

78 of the 100 Facebook pages appeared at least one

time and 35 of them appeared on at least 1% of the profile

shown.

Actually, 12% is not bad, but we made many mistake

enough and we forget to provide a city of residence to

Facebook, in order to obtain people living near on the

top of the results.

Figure 7: Statistics on the 300 profiles shown

6.2 Second experiment

In our second experiment, we create a profile with the

experiment). See Figure 8.

Figure 8: Number of users in terms of number of com-

mon interests

87 of the 144 profiles were easily found (60%), 33

were not found because of a there were too many results

(23%), 18 were not identifiable (13%) and in 6 other case

there were a doubt on the identity (4%). See Figure 9.

only 4 of the 30 profiles with at least 6 common inter-

ests where not found (success rate of 86%). See Figure

10.

83 of the 100 pages appeared at least one time

Figure 9: Statistics on the 144 profiles with common in-

0 156

1 19 10 8 0 1

2 29 15 11 2 1

3 33 16 9 8 1

4 18 12 3 2 0

5 15 8 1 4 2

6 12 9 1 2 0

7 2 2 0 0 0

9 3 3 0 0 0

bots and other fake account on Tinder (see [6]). Those

fakes users are often not linked to a Facebook account.

their Tinder account, some did not give the permission to

Tinder to see their interests (but we assume few people

do this). Finally, many users does not have common in-

terests with our account (which have only 100 interests).

Same thing to create a Tinder account, you need a

phone number, but you can use the same number several

Figure 12: Access control policies for cities

to see your interests, and set restrictive access controls

on your Facebook account for pages liked, residence city,

jobs and studies.

References