Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

Post reply on HN
Print view View original

71–80 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#71

Post by OJFord »

kbenson wrote: post #65
Decker87 wrote: post #61

Earlier quoted context omitted.

> Something like this could have been valuable to get you into the upper tier. Only valuable until people view my profile picture.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

And then what? You score the date and rely on your awesome personality to make up not only for being physically disappointing, but having to some degree lied about it via a professional portrait photographer's tips and tricks?

And if all that works, you found someone who liked the look of a fake/augmented version of yourself, but whom you persuaded to like the real self anyway... Congratulations?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#72

Post by k__ »

simonw wrote: post #68
hmsimha wrote: post #41

I believe this also requires that OKCupid has not set the 'SameSite=lax' attribute on their cookies, which is good practice as well; the browser won't send the user's cookies on cross-origin POST, PUT, PATCH, or DELETE requests when this attribute is set. So this exploit is really the confluence of failing to follow 2 standard security practices, as well as another unfortunate configuration quirk: - Failing to set Sa…

I thought most modern browsers behave as if SameSite=Lax automatically these days. Were OkCupid deliberately setting SameSite=None on their cookies?

Wasn't lax just for static assets like images that are linked in external HTML?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#73

Post by mastazi »

OJFord wrote: post #71
kbenson wrote: post #65

Earlier quoted context omitted.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

And then what? You score the date and rely on your awesome personality to make up not only for being physically disappointing, but having to some degree lied about it via a professional portrait photographer's tips and tricks? And if all that works, you found someone who liked the look of a fake/augmented version of yourself, but whom you persuaded to like the real self anyway... Congratulations?

I think sometimes having a foot in the door helps anyways. Of course grossly misrepresenting yourself is a bad idea but enhancing a bit, why not? Also, it is indeed possible that your potential partners may value other aspects besides your appearance, not everyone is obsessed with looks. But of course your mileage may vary depending who you met in your life, and also based on where you live / local customs etc.

Then there is the issue of how you perceive yourself, when I was in my 20s and 30s I used to think of myself as not attractive, but now when I look back at my old photos from a more detached point of view, I think I was a fairly attractive young man. Excessive self criticism can be bad and artificially put you down.

After entering a "serious" relationship and then getting married in my 30s I was able to look at myself in a more balanced way. I think my previous self-criticism was fuelled by some vague fear that I would never find a partner and I would live a lonely life. Probably it's a common thought among people of that age.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#74

Post by runbathtime »

Is this a type of inflation or a type of fraud or neither? Popularity is a made up category, or one that is ill defined while being manipulative. Popularity implies those most desired, but since this can be goosed by paying for attention, it is meaningless and hence let the hacking begin.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#75

Post by vmception »

> I found you could use essentially the same vulnerability to get other users to “like” your profile. Obviously you could abuse this in order to match with anyone you could trick into clicking a link, or you could spam the link to a bunch of people to increase your profile’s rankings in whatever mysterious algorithm OkCupid uses to suggest people.

Ha! They should have used this to increase their evolutionary fitness!

Assumptions about matchmaking app algorithms are the crux of my behavior on dating apps. Far far greater influence than other users independent impression of my profile or me trying to put a best foot forward.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#76

Post by kbenson »

OJFord wrote: post #71
kbenson wrote: post #65

Earlier quoted context omitted.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

And then what? You score the date and rely on your awesome personality to make up not only for being physically disappointing, but having to some degree lied about it via a professional portrait photographer's tips and tricks? And if all that works, you found someone who liked the look of a fake/augmented version of yourself, but whom you persuaded to like the real self anyway... Congratulations?

> having to some degree lied about it via a professional portrait photographer's tips and tricks?

Those tips and tricks are no different in kind that what people do themselves, the only difference is knowledge.

> And if all that works, you found someone who liked the look of a fake/augmented version of yourself, but whom you persuaded to like the real self anyway... Congratulations?

Let's not act like first impressions have no meaning, and that getting around them doesn't have benefit and allow other traits or a more accurate impression to come through that wouldn't have gotten a chance otherwise.

Haven't you ever become friends with someone that you disliked or avoided to some degree initially because of some bad first impression?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#77

Post by vmception »

nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

All the dating apps use a derivative of this and you can game that. They deny any particular label like ELO, used in online game lobbies. But knowing how leveled game matchmaking works will allow you to optimize your experience in dating apps far greater than wondering if you need a picture of a dog in your profile to get more matches.

Hope you guys don't mess up my experience with this knowledge! But I’ve been using these tweaks for years, so I’ll probably be on to something else after this gets arbitraged away.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#78

Post by yosito »

vmception wrote: post #77
nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

All the dating apps use a derivative of this and you can game that. They deny any particular label like ELO, used in online game lobbies. But knowing how leveled game matchmaking works will allow you to optimize your experience in dating apps far greater than wondering if you need a picture of a dog in your profile to get more matches. Hope you guys don't mess up my experience with this knowledge! But I’ve been using…

Any recommendations on where to learn how leveled game matchmaking works?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#79

Post by lotsofpulp »

OJFord wrote: post #71
kbenson wrote: post #65

Earlier quoted context omitted.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

And then what? You score the date and rely on your awesome personality to make up not only for being physically disappointing, but having to some degree lied about it via a professional portrait photographer's tips and tricks? And if all that works, you found someone who liked the look of a fake/augmented version of yourself, but whom you persuaded to like the real self anyway... Congratulations?

There a few cognitive biases that can assist. People can become more attracted to someone simply by learning the other person was attracted to them. Also, the more time you spend with someone, the more attractive they will become.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#80

Post by dec0dedab0de »

OJFord wrote: post #71
kbenson wrote: post #65

Earlier quoted context omitted.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

And then what? You score the date and rely on your awesome personality to make up not only for being physically disappointing, but having to some degree lied about it via a professional portrait photographer's tips and tricks? And if all that works, you found someone who liked the look of a fake/augmented version of yourself, but whom you persuaded to like the real self anyway... Congratulations?

Think of it more like ignoring job requirements when submitting your resume. Once you get an interview, that's all that matters.
Post reply on HN