Members of dating site FindSomeone could have had secret photos exposed, the owner Trade Me has admitted.
Spokesman Logan Mudge played down the risk, saying it had no evidence that had happened and that staff vetted all photos that members uploaded to ensure they contained 'nothing of a highly personal or salacious nature'.
Experience Trade Me in a new streamlined, elegant and feature rich way – whether you’re chilling at home or cruising around out and about. We’re working our butts off to deliver you an app that earns its place on your device. Please note: This app features Nielsen's proprietary measurement software which will allow you to contribute to. Trade Me has 5060 Houses and properties for rent in Auckland. View availability and the local map, research local schools and contact the property manager today. 1.1 This policy covers our “Services”, meaning services or products by: Trade Me Limited such as Trade Me Marketplace, Trade Me Jobs, Trade Me Property, Trade Me Motors, Trade Me Insurance, Holiday Houses, FindSomeone, MotorWeb (NZ), Tenancy Tracker, Tradevine, Viewing Tracker, OneHub, Property Insights by Trade Me, DealerBase, and Ping.
FindSomeone allows members to upload photos that they can 'hide' from other members, until they want to share them with trusted correspondents.
But a member of the public said a combination of flaws allowed FindSomeone members to see if other members had hidden photos, work out the web address where they were located, and then download them at their full resolution.
READ MORE:
* Drive on for Trade Me to become more relevant
* How online dating became mainstream
* Kiwi singles reveal the most annoying dating habits
Mudge acknowledged the latter two issues were a risk but said Trade Me had not been able to replicate the first one.
The complainant contacted Stuff on Wednesday morning with details of the exploits after Trade Me failed to respond to an email he sent the previous day asking if the company paid a bounty for people who found 'bugs' in its system.
Mudge said fewer than 10 per cent of FindSomeone members chose to use the hidden photos feature and it was mainly useful for members trialling the service, who were limited in the number of photos they could show.
He did not believe the risk of the vulnerability being exploited was high and said Trade Me did not believe it warranted taking down the photo service until a fix was in place.
'It is technically possible for someone to find a hidden photo but it's not something we've had an issue with before, and it's well beyond the skills of most internet users. We have not had any complaints from members, or anyone else about this,' he said.
'Now it is on our radar we are certainly taking a look. I don't think 'concerned' is probably a word we would use.
'We think we could probably explain the 'hidden' feature better and we'll do that in our help section shortly,' he said.
The complainant said the detailed web addresses (hash tags) generated by the content delivery network that FindSomeone used to host photos were not sufficiently random.
But Mudge said 'using a content delivery network as we do with FindSomeone is standard industry practice'.
Trade Me announced last week that it had written off its $8 million investment in the dating site because of competition from the likes of Tinder, and that it would 'divert resources' to larger opportunities.
But it said FindSomeone was still visited by more than 22,000 people each day and it did not intend to close the service.
This policy has been awarded the WriteMark Plain Language Standard.
If you accidentally damage someone else’s car or property, we’ll cover you for your legal liability.
We’ll cover your car if it’s damaged by fire, stolen or someone attempted to steal it.
We’ll cover your car for accidental loss or damage.
If you use one of our recommended repairers for your car claim, we’ll guarantee the repairs for life.
Our 24/7 roadside assistance service covers the car, not the person, so anyone driving the car can use it across NZ. It includes three free call-outs per year.
Windscreen and window glass are automatically covered, but if you choose this benefit, you won’t have to pay any excess for any windscreen claims.