Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

21–30 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#21
post #4

Earlier quoted context omitted.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

This isn't ideal, but why would anyone forward this kind of email?

I guess when an adversary knows about the feature and uses some social engineering against the user?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#22

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

The official blog is the cleaned-up version, they removed the most interesting articles when they sold out to match.com

Famously, the article "Why You Should Never Pay For Online Dating" got deleted during the acquisition.

[1] Mirror: https://www.gwern.net/docs/psychology/okcupid/whyyoushouldne...

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#23
post #9

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

The way I see it, people sort on both genes (aka looks) and personality/values/morals/etc.

The thing is, by just scrolling through the feed/list of people to swipe on, you don't get to see much personality, mostly looks. To get to personality, you gotta talk to the person.

So when you swipe, you filter mostly by looks. And once you match and start talking, that's when you filter by personality.

Yes, one can say that you can get personality from their bio/profile, but that's such a non-consistent metric with tons of noise and misleading data (cliched/copypasted bio, nothing standing out, outdated bio, etc.). You need to have a conversation with a person to get a gauge of their real personality (of course, exceptions apply; if you see a profile/bio claiming that vaccines give kids autism and that the only valid covid treatment is essential oils, you kinda already have an idea who you are dealing with).

And out of all those people you spend a lot of time intensely reading thru profiles of before swiping, most of them won't even match with you. So imo, it makes sense to initially swipe based purely on looks and a 5-10 second glance at the profile, and then try to gauge their personality only after you match.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#24
Is it just me, or the images on the post are not loading?

Initially I tried on the most recent FF, and about half the images were not loading. Refreshed the page, no images were loading after that at all.

Then I tried on the most recent Chrome, images were not loading at all either.

If someone has a workaround, please let me know. I have confirmed that adblocker and such were all disabled.

Upon trying to access the images directly, I got this 403 error:

> Your client does not have permission to get URL /u/0/d/ from this server. (Client IP address: )

> Rate-limit exceeded. That’s all we know.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#25
post #4

Earlier quoted context omitted.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

Lots of sites do this, it’s a feature for the majority of users who prefer convenience over security.

[deleted]

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#26

Anecdote: OkCupid is the only website or app where I've had an account hijacked. I got it back with a password reset, but the profile and pics were filled with bogus content.

That's what I would say too ;)

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#27
post #21

Earlier quoted context omitted.

This isn't ideal, but why would anyone forward this kind of email?

I guess when an adversary knows about the feature and uses some social engineering against the user?

In order to get access to their... OkCupid account? Not sure that I care.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#28
post #24

Is it just me, or the images on the post are not loading? Initially I tried on the most recent FF, and about half the images were not loading. Refreshed the page, no images were loading after that at all. Then I tried on the most recent Chrome, images were not loading at all either. If someone has a workaround, please let me know. I have confirmed that adblocker and such were all disabled. Upon trying to access the i…

Not just you. On Edge Chromium and no images are loading.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#29

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

The official blog is the cleaned-up version, they removed the most interesting articles when they sold out to match.com Famously, the article "Why You Should Never Pay For Online Dating" got deleted during the acquisition. [1] Mirror: https://www.gwern.net/docs/psychology/okcupid/whyyoushouldne...

It's a good article, and one of the key takeaways:

If a dating site makes you pay to send messages, then they have an incentive to make you send messages to inactive accounts rather than active accounts, since people with inactive accounts have to pay in order to reply.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#30
post #9

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

OKCupid doesn't allow you to sort on anything anymore. It's all part of their business model of preventing people from creating permanent relationships. Yes, some slip through, don't @ me.
Post reply on HN