Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

51–60 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#51

Earlier quoted context omitted.

Maybe, but how much value is there in taking over people's OKCupid account?

If there's no value or downside to someone taking over my OKCupid account, why have a password on it in the first place?

This is a horrible take, obviously there’s different levels of security and risk associated with everything.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#52

Earlier quoted context omitted.

Gmail now pretty much breaks single-use tokens in links because it consumes them itself after a user clicks on them, but before redirecting the user to the site. It's an unfortunate change that has made single-use links a worse UX and less popular in the last couple of years.

This isn't the case in my experience. We have a tool that sends me an email with a single use link when it's used. I just now confirmed that I receive the email containing the single-use link, that I can click on it and view the page, and that the single-use link is no longer available after I've viewed the link. Is this perhaps conditional behavior of some sort?

Perhaps it’s 2-use?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#53
post #51

Earlier quoted context omitted.

If there's no value or downside to someone taking over my OKCupid account, why have a password on it in the first place?

This is a horrible take, obviously there’s different levels of security and risk associated with everything.

A horrible take on how much value is there in taking over people's OKCupid account?

If there's literally no value in taking it over, then why password protect it in the first place?

I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If there's no value in exposing it, why bother password protecting it?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#54
post #51

Earlier quoted context omitted.

This is a horrible take, obviously there’s different levels of security and risk associated with everything.

A horrible take on how much value is there in taking over people's OKCupid account ? If there's literally no value in taking it over, then why password protect it in the first place? I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If ther…

It's a bad take because you made it sound like I said it was worthless, when all I implied was that it isn't worth much. There's a difference.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#55
post #52

Earlier quoted context omitted.

This isn't the case in my experience. We have a tool that sends me an email with a single use link when it's used. I just now confirmed that I receive the email containing the single-use link, that I can click on it and view the page, and that the single-use link is no longer available after I've viewed the link. Is this perhaps conditional behavior of some sort?

Perhaps it’s 2-use?

It's not. It's a tool we developed, and I've confirmed that the resource at the link is fully destroyed after the first access.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#56

Earlier quoted context omitted.

A horrible take on how much value is there in taking over people's OKCupid account ? If there's literally no value in taking it over, then why password protect it in the first place? I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If ther…

It's a bad take because you made it sound like I said it was worthless, when all I implied was that it isn't worth much. There's a difference.

I took your reply as meaning it has so little value that there's no reason to or even harm if someone takes it over.

Did you mean that it's valuable enough that someone should protect it, but shouldn't bother protecting it too much (like, anyone with the URL should have access to it) since it has little value? I'm not sure I really understand the nuance, but I'd be awfully surprised if I forwarded an email to someone from OKCupid and it gave them passwordless access to the account.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#57
Ah, more than a decade ago I found a similar issue on Friendster (anyone remember them?), I could embed an HTML image tag in my profile which loaded a PHP script (under my control) that would redirect the user to something like friendster.com/poke?id=[my user id], so if anyone visited my profile, their browser would GET that URL and I'd get a "poke" (I don't remember the Friendster term for it), notifying me who visited my profile.

I didn't get many pokes, and I can't tell what part of this story is the saddest. Maybe the part that there probably weren't bounties back then (that I was aware of) and I didn't get any money for this discovery.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#59
post #9

Earlier quoted context omitted.

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site. But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There we…

[deleted]

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#60

Earlier quoted context omitted.

If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site. But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There we…

Interestng, have a link for the study? Can't seem to find it

Not OP, but https://www.gwern.net/docs/psychology/okcupid/raceandattract...

This talks about a follow-up study 5 years after the first one, searching "okcupid race and attraction" doesn't find me the link to the 2009 article.

Post reply on HN