Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

Post reply on HN
Print view View original

41–50 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#41

Post by hmsimha »

I believe this also requires that OKCupid has not set the 'SameSite=lax' attribute on their cookies, which is good practice as well; the browser won't send the user's cookies on cross-origin POST, PUT, PATCH, or DELETE requests when this attribute is set.

So this exploit is really the confluence of failing to follow 2 standard security practices, as well as another unfortunate configuration quirk:

- Failing to set SameSite=lax on their session cookie attribute - Not using a CSRF token to authenticate on unsafe HTTP actions - Not checking the content-type of API requests (though I'm not sure to what extent this is considered bad practice)

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#43

Post by gbl08ma »

AlchemistCamp wrote: post #33
cmckn wrote: post #19

Earlier quoted context omitted.

I find that passwordless links usually expire after 1 use or some amount of time; generating eternal alt-passwords for an OkCupid account in every message notification email seems pretty heinous.

Gmail now pretty much breaks single-use tokens in links because it consumes them itself after a user clicks on them, but before redirecting the user to the site. It's an unfortunate change that has made single-use links a worse UX and less popular in the last couple of years.

This sounds like it would break a bunch of email address verification systems, password recovery links and the like. I wonder if indeed it does break them, but since it only affects smaller websites nobody seems to care.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#44

Post by m0rti »

the__alchemist wrote: post #7

Anecdote: OkCupid is the only website or app where I've had an account hijacked. I got it back with a password reset, but the profile and pics were filled with bogus content.

I had the same experience. My profile was transformed into a 50-year-old white male wearing a trucker hat without my knowledge. By the time I was able to access my account, it had a bunch of matches and messages from 50-60 year-old American women.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#45

Post by nonameiguess »

quacked wrote: post #9
PicassoCTs wrote: post #5

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site.

But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There were weirdly specific things about your photos that mattered, too, like you'd get a much better response rate if other people weren't in the photo with you, you'd get a better response rate if you weren't looking at the camera. Women were more attractive if they were smiling but men did better if they were not smiling.

Christian Rudder used to publish gold mines for anyone who wanted to just game hot-or-not. Plenty of this was stuff you could control, not genetic. Though I guess you can't exactly control your age even if it isn't genetic. It also let you sift through the lies, like women would always say they were turned off by shirtless pictures, but based purely on response rates, that definitely wasn't true for men who actually had lean bodies.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#46

Post by ncallaway »

AlchemistCamp wrote: post #33
cmckn wrote: post #19

Earlier quoted context omitted.

I find that passwordless links usually expire after 1 use or some amount of time; generating eternal alt-passwords for an OkCupid account in every message notification email seems pretty heinous.

Gmail now pretty much breaks single-use tokens in links because it consumes them itself after a user clicks on them, but before redirecting the user to the site. It's an unfortunate change that has made single-use links a worse UX and less popular in the last couple of years.

This isn't the case in my experience.

We have a tool that sends me an email with a single use link when it's used.

I just now confirmed that I receive the email containing the single-use link, that I can click on it and view the page, and that the single-use link is no longer available after I've viewed the link.

Is this perhaps conditional behavior of some sort?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#47

Post by Johnny555 »

EpicEng wrote: post #27
thih9 wrote: post #21

Earlier quoted context omitted.

I guess when an adversary knows about the feature and uses some social engineering against the user?

In order to get access to their... OkCupid account? Not sure that I care.

You might care if you were married and using OKCupid to find a girlfriend.

You may say that getting exposed for trying to have an affair is a good thing, but that's a still a reason why someone may care how secure their OKCupid activity is.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#48

Post by nonameiguess »

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower 50%. I think they eventually made this more sophisticated by augmenting the explicit average star rating with other measures of engagement like how often people saved your profile, how many messages you received, and the rate at which your own messages were answered.

Something like this could have been valuable to get you into the upper tier.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#49

Post by xiphias2 »

OminousWeapons wrote: post #16
xiphias2 wrote: post #15

Earlier quoted context omitted.

Not anymore, but before online dating people were hiding it much more

People were trying to hide that they actually want to be sexually attracted to their partner?...

To me (a not attractive man) yes. But I'm from Eastern Europe, the culture is different there.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#50

Post by moneywoes »

nonameiguess wrote: post #45
quacked wrote: post #9

Earlier quoted context omitted.

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site. But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There we…

Interestng, have a link for the study? Can't seem to find it
Post reply on HN