Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

Post reply on HN
Print view View original

61–70 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#61

Post by Decker87 »

nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

> Something like this could have been valuable to get you into the upper tier.

Only valuable until people view my profile picture.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#63

Post by srmarm »

AnIdiotOnTheNet wrote: post #12
simonw wrote: post #8

Earlier quoted context omitted.

That's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.

Maybe, but how much value is there in taking over people's OKCupid account?

There is a huge market in romance scams and people lose huge amounts to it, most people are clever enough to spot them but many aren't. Now if you're able to intercept a genuine conversation it'd give you a good advantage.

Even at a lower level, just sending a bunch of messages asking for money for a cab/train/airfare might yield good returns. People let their guard down when there's a possibility of getting laid.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#64

Post by yonran »

> Luckily the W3C deities gave us exactly such a gift in the form (pun intended) of the enctype attribute.

Minor quibble: enctype="text/plain" didn’t come from W3C. HTML 4.0 forms only defines enctype="application/x-www-form-urlencoded" (which pct-encodes the json delimiters {"":}) and enctype="multipart/form-data" (which has a non-json Boundary prefix) so if those were the only enctypes that browsers used, then this exploit would not have worked. https://www.w3.org/TR/html401/interact/forms.html#h-17.13.4

WHATWG HTML5 does define enctype="text/plain" behavior https://html.spec.whatwg.org/multipage/form-control-infrastr.... According to the mozilla docs, it was “Introduced by HTML5 for debugging purposes.” https://developer.mozilla.org/en-US/docs/Web/HTML/Element/fo... But I doubt it was created by WHATWG either; in 2004 the HTML5 editor Ian Hickson said “I agree it is brain-dead (it's IE-compatible)” https://lists.w3.org/Archives/Public/public-whatwg-archive/2... Unfortunately I can’t see history of the spec before 2006 though https://github.com/whatwg/html

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#65

Post by kbenson »

Decker87 wrote: post #61
nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

> Something like this could have been valuable to get you into the upper tier. Only valuable until people view my profile picture.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#66

Post by throwaway0a5e »

nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

It's probably better to be erroneously in the bottom tier than erroneously in the top tier for reasons that should be obvious.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#67

Post by slig »

nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

They had a thing where if you dismissed the top attractive users they would segment you as attractive as well and bump you up to the upper tier.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#68

Post by simonw »

hmsimha wrote: post #41

I believe this also requires that OKCupid has not set the 'SameSite=lax' attribute on their cookies, which is good practice as well; the browser won't send the user's cookies on cross-origin POST, PUT, PATCH, or DELETE requests when this attribute is set. So this exploit is really the confluence of failing to follow 2 standard security practices, as well as another unfortunate configuration quirk: - Failing to set Sa…

I thought most modern browsers behave as if SameSite=Lax automatically these days. Were OkCupid deliberately setting SameSite=None on their cookies?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#69

Post by AlchemistCamp »

gbl08ma wrote: post #43
AlchemistCamp wrote: post #33

Earlier quoted context omitted.

Gmail now pretty much breaks single-use tokens in links because it consumes them itself after a user clicks on them, but before redirecting the user to the site. It's an unfortunate change that has made single-use links a worse UX and less popular in the last couple of years.

This sounds like it would break a bunch of email address verification systems, password recovery links and the like. I wonder if indeed it does break them, but since it only affects smaller websites nobody seems to care.

> "This sounds like it would break a bunch of email address verification systems, password recovery links and the like."

This is exactly the pain I've experienced with my own site, https://alchemist.camp

I've manually tested it and seen the token consumed when clicking the link via gmail but had no issues when copying the link from the password reset email to a gmail account. A second manual tester confirmed the same, as have multiple support cases.

Password recovery links sporadically fail for gmail users. I had to add extra instructions to copy and paste rather than click through the link and am in the process of moving away from single-use tokens because a lot of people still click before reading those instructions and email me for support.

My increased customer support burden isn't something Gmail PMs worry about, but they may whitelist some larger service's emails.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#70

Post by cj »

bellyfullofbac wrote: post #57

Ah, more than a decade ago I found a similar issue on Friendster (anyone remember them?), I could embed an HTML image tag in my profile which loaded a PHP script (under my control) that would redirect the user to something like friendster.com/poke?id=[my user id], so if anyone visited my profile, their browser would GET that URL and I'd get a "poke" (I don't remember the Friendster term for it), notifying me who visi…

A version of this was (maybe still is?) possible with LinkedIn, where you could simply embed a LinkedIn profile in a hidden iframe and then use the “who viewed my profile” feature to see who viewed your site.
Post reply on HN