Section 10: Four Miles From Priya - Security, Privacy & Trust and Safety

Executive Summary: A dating app's worst failures aren't outages. They are a stalker finding an apartment, a scammer draining someone's savings, or a user's sexual orientation leaking to an ad network. This section names the attackers and answers each one with a mechanism: location snapped to a ~1 km cell and rounded to whole miles (D13), a match decision that never leaves the server (D14), a like cap and deck-bound likes against bots, moderation before any photo is visible, blocks that take effect everywhere in under a second, and a deletion event that reaches every store inside GDPR's one-month window.

The interviewer pushes Section 9's capacity numbers aside. "That traffic was honest. Now assume some of your 20 million daily users want to hurt the others. Who are they?"

You: "Six kinds. Stalkers want a location. Scrapers want the profile catalog. Bots and scammers want attention, then money. Harassers want to reach someone who has said no. Minors want in. Insiders already have access. A profile here holds face photos, a neighborhood and, in effect, a sexual orientation, so I'll go in order of harm."

Trilateration: Why Priya Is Always "4 Miles Away"

A stalker makes three fake accounts, spoofs GPS to three points around Austin, and has each one fetch Priya's card. If the server returned exact distances, the three answers would read 4.13 mi, 2.80 mi and 6.02 mi. Three circles cross at one point, which is her apartment. Dating apps, Tinder among them, have had publicly disclosed bugs of exactly this kind.

D13 defends in three layers:

1. Snap first. PUT /v1/me/location is converted by the location service into an S2 level-13 cell, roughly 1 km across. Distances are computed between snapped positions, and the raw fix isn't kept once the cell is known.
2. Round. Whole miles, minimum "1 mile away".
3. Never ship coordinates. The rejected alternative, computing distance on the client, means sending Priya's coordinates to every phone that renders her card, the attacker's included.

Rounding alone isn't enough. The attacker can creep a fake position until "4 miles" flips to "5 miles", and enough flip points trace a circle that pinpoints the true position. With snapping, that circle surrounds the cell's center instead of Priya, so the best possible attack recovers a ~1 km cell: a neighborhood, not a front door.

Fake GPS is trivial, so the attack needs accounts that move. The location service compares each update with the previous cell. A jump faster than any real traveler could manage is rate-limited (the old cell stays) and flagged. Fresh accounts in nearby cells all pulling the same profile get scored by the risk system as well.

Interviewer: "A kilometer of fuzz. Doesn't that break 'within 15 miles'?"

You: "Combined snapping error is about a mile at worst, plus half a mile of rounding, against a 15-mile radius, so a candidate right at the edge may or may not appear, and nobody notices. Exact distance is the one feature this app should never ship. No trigger flips that."

Quick check before moving on: