Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

Post reply on HN
Print view View original

101–110 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#101

Post by Blankenface »

cmckn wrote: post #19
DJBunnies wrote: post #6

Earlier quoted context omitted.

Lots of sites do this, it’s a feature for the majority of users who prefer convenience over security.

I find that passwordless links usually expire after 1 use or some amount of time; generating eternal alt-passwords for an OkCupid account in every message notification email seems pretty heinous.

They never expire. Source: am OKCupid user.

As mentioned in another comment: this is one of the reasons I laughed when they made a grab for everyone's phone numbers, claiming it was to prevent people from haxxoring your account.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#102

Post by hellbannedguy »

kbenson wrote: post #65
Decker87 wrote: post #61

Earlier quoted context omitted.

> Something like this could have been valuable to get you into the upper tier. Only valuable until people view my profile picture.

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

Some people just take good pictures.

My sister was voted best looking at Redwood High School. The same school our governor graduated from. It was a hugh graduating class.

When she was younger, people used to tell her she should be a model. Well after watching Brook Shields endlessly she decided to give it a try.

She got my dad to fund a professional photo shoot. Something my cheapskate dad never forgot about.

Anyway, I always thought my sister was ascetically very pretty.

I thought she was a shoe in.

Well we got the photos, and it was a huge no.

While being literally breathtaking in person, so didn't photograph well.

Years later, I was with her husband while he went to a modeling addition. Every applicant's picture was taken at the door with a Polaroid.

I asked a photographer why. He stated some people just don't photograph well, and without that picture we would be wasting time.

Anyhoo--Personally I have never liked being photographed. Why--because I'm homely in life, and pictures just confirm it.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#103

Post by Blankenface »

spywaregorilla wrote: post #32
the__alchemist wrote: post #7

Anecdote: OkCupid is the only website or app where I've had an account hijacked. I got it back with a password reset, but the profile and pics were filled with bogus content.

Any idea what the intent was?

Not the person you're replying to, but: probably to use the account to romance-scam other users with.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#104

Post by swaggyBoatswain »

acmecorps wrote: post #81
mastazi wrote: post #73

Earlier quoted context omitted.

I think sometimes having a foot in the door helps anyways. Of course grossly misrepresenting yourself is a bad idea but enhancing a bit, why not? Also, it is indeed possible that your potential partners may value other aspects besides your appearance, not everyone is obsessed with looks. But of course your mileage may vary depending who you met in your life, and also based on where you live / local customs etc. Then…

I'd like to underpromise, but overdeliver - that's my motto!

Ditto

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#106

Post by hmsimha »

simonw wrote: post #95
simonw wrote: post #89

Earlier quoted context omitted.

Yes it was - "... are sent when a user is navigating to the origin site" https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

... but in my experiments now I can't find a way to cause a SafeSite=Lax cookie to be sent from a POST request starting on another site: https://simonw.github.io/samesite-lax-demo/

Defaulting to SameSite=lax is a (relatively) recent development, as per the doc you linked.

Yes, I don't think cookies with SameSite=Lax will be sent to a cross-domain host when the request type is a POST, even when the navigation is top-level. Though they will for GET and HEAD.

Defaulting to SameSite=Lax has only been in Chrome since Feb of last year, and in Edge since October of last year. It has yet to land in Firefox or Safari.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#107

Post by polishdude20 »

nuker wrote: post #105

Business model is not letting you find your person, because if you do they lose a paying customer. Thats my thinking and why I’m not using dating websites.

I was talking about this exact thing with my girlfriend the other day. Tinder and other dating sites want you to stay as long as possible and spend as much money as possible with them. How do you do that?

Number one: You give them hope. Give people hope that they will find the person they are looking for if they stay on longer. Give people hope by helping facilitate a match just as they start to lose interest in the website. Make them think they will find someone.

Number two: Cultivate a culture of attractive people. Keep the attractive people staying. This gives hope for the unattractive people as they sometimes match with them. Keep the attractive people happy and help facilitate lots of meetings or them.

Number three: Provide an easy way to skip the whole attractive/unattractive hierarchy by letting people spend money. Now you too can get in on the action (but not for too long) if you have the money.

I realize this is a pessimistic view of dating sites. Heck, I met my current girlfriend of three years on OkCupid luckily. It's not all doom and gloom.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#108

Post by pseudalopex »

Blankenface wrote: post #97
nonameiguess wrote: post #48

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…

The whole top vs bottom 50% attractiveness bit was a gag thing. It's such a common outraged-post topic that the okcupid subreddit has a FAQ about it in the sidebar. OKCupid used to be substantially weirder than it was before it was swallowed up by IAC. I mean really fucking weird. One of many examples: the signout page had a clipart photo of an airport firefighter (ie silver suit head to toe) in a veeeeery suggestive…

The FAQ says it's determined by likes. Not it was a gag.[1]

[1] https://www.reddit.com/r/OkCupid/wiki/faq#wiki_1._.22we_just...

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#109

Post by nuker »

polishdude20 wrote: post #107
nuker wrote: post #105

Business model is not letting you find your person, because if you do they lose a paying customer. Thats my thinking and why I’m not using dating websites.

I was talking about this exact thing with my girlfriend the other day. Tinder and other dating sites want you to stay as long as possible and spend as much money as possible with them. How do you do that? Number one: You give them hope. Give people hope that they will find the person they are looking for if they stay on longer. Give people hope by helping facilitate a match just as they start to lose interest in the…

> It's not all doom and gloom.

Yep. They need it to work sometimes to stay competitive vs other websites. I guess it works as lottery draw, give only these 100 a proper match today

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#110

Post by xvector »

vmception wrote: post #83
yosito wrote: post #78

Earlier quoted context omitted.

Any recommendations on where to learn how leveled game matchmaking works?

Not sure. Basically you start as a baseline or perhaps an average, and your own behavior influences who you get matched with. So in dating apps, matching indiscriminately in frustration to getting few matches will ensure you get thrown into the less attractive bucket. As you match with mostly other people already in that bucket. You can delay or prevent this from happening by being more discerning, not dissimilar fro…

Why is this downvoted?
Post reply on HN