This would be unable if OkCupid stored its credentials in sessionStorage or localStorage instead of cookies, right?
How to boost your popularity on OkCupid using CSRF and a JSON type confusion
121–130 of 134 posts
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#122This would be unable if OkCupid stored its credentials in sessionStorage or localStorage instead of cookies, right?
With modern browsers, there are almost a dozen ways to defend against csrf. You can use sessionStorage and force all requests to be XHR. Set the “new” flag on session cookies to not transmit cross origin. Check the origin header for all POST requests. Set a token in the forms (the “classic” way).
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#123Earlier quoted context omitted.
Or after initial token use, set to expire after n seconds rather than immediately
That's exactly the approach I'm leaning towards using.
Or you could trigger an ajax call on the page that actually checks the token validity then redirect the user to a new password or a sorryexpired form.
Gmail may fetch the page but wont run the js on it.
Edit: this works for situations when spam filters fetch the links as soon as the mail arrives.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#124Would relying on CORS still work as long as the server checks that the type is actually application/json? Since those headers are impossible to set from a form, and doing it with fetch it would trigger a preflight request.
Historically, it would have been weak since Java/Flash gave you more control over sockets than what’s available with js. In today’s world, it might be ok. I would personally build defense in depth and not just rely on one weak property.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#125Earlier quoted context omitted.
The official blog is the cleaned-up version, they removed the most interesting articles when they sold out to match.com Famously, the article "Why You Should Never Pay For Online Dating" got deleted during the acquisition. [1] Mirror: https://www.gwern.net/docs/psychology/okcupid/whyyoushouldne...
There were also articles that ran counter to popular gender theory/politics. This is off memory but I believe their stats showed that men rated women's photos on what resembled a classic bell curve, shifted to the right slightly. Ie, dudes were generally reasonable if not a wee bit overly kind. Women were exceptionally brutal in ranking men's looks. Women's ranking of men was a triple-diamond ski hill with damn near…
Some "controversial" blog posts they deleted.
How men and women perceive attractiveness https://archive.is/489UV#selection-282.0-282.1
We finally answer the age-old question: should men keep their shirts on? https://archive.is/9fJQh#selection-282.0-282.1
We Experiment On Human Beings! https://archive.is/QNCbf#selection-278.0-278.1
How Your Race Affects The Messages You Get https://archive.is/kMP32#selection-278.0-278.1
Don’t Be Ugly By Accident! https://www.gwern.net/docs/psychology/okcupid/dontbeuglybyac...
More can be found here:
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#126Earlier quoted context omitted.
That's exactly the approach I'm leaning towards using.
Or you could trigger an ajax call on the page that actually checks the token validity then redirect the user to a new password or a sorryexpired form. Gmail may fetch the page but wont run the js on it. Edit: this works for situations when spam filters fetch the links as soon as the mail arrives.
Yes, please ruin functionality without javascript for the sake of gmail's nosiness.
Comment about a form and PUT/POST is good - it will work by standards in any browser, even when gmail starts executing javascript. Add auto-submit on top javascript if preferred.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#127Earlier quoted context omitted.
To me (a not attractive man) yes. But I'm from Eastern Europe, the culture is different there.
Out of curiousity in terms of attractiveness and dating or choosing a partner, what do you feel is culturally different in Eastern Europe?
Generally non-US countries are lagging behind by a few years in dating culture. In Colombia for example I was already used for a foodie date (and some other girls have tried quite aggressively to go to dinner on the first date), but here in Eastern Europe it's not trendy yet. Younger girls are looking for equality based relationships, 30+ girls are looking for more traditional marriage.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#128Ah, more than a decade ago I found a similar issue on Friendster (anyone remember them?), I could embed an HTML image tag in my profile which loaded a PHP script (under my control) that would redirect the user to something like friendster.com/poke?id=[my user id], so if anyone visited my profile, their browser would GET that URL and I'd get a "poke" (I don't remember the Friendster term for it), notifying me who visi…
A version of this was (maybe still is?) possible with LinkedIn, where you could simply embed a LinkedIn profile in a hidden iframe and then use the “who viewed my profile” feature to see who viewed your site.
Modern browser security features do not allow such an iframe.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#129I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower…
> Something like this could have been valuable to get you into the upper tier. Only valuable until people view my profile picture.
Being popular is a "sexy attribute" on its own, to many people.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#130Earlier quoted context omitted.
The FAQ says it's determined by likes. Not it was a gag.[1] [1] https://www.reddit.com/r/OkCupid/wiki/faq#wiki_1._.22we_just...
Apparently it's been changed, and I guess the mod team is in on the gag, because it's just an anti-churn email. https://www.businessinsider.com.au/okcupid-hot-or-not-list-o...
The FAQ used to say the message was more common than you think.[1] But the message said you're among the most attractive people on OkCupid. Not just above median.
The article implied the message should say interesting not attractive maybe. But it implied the segmentation is real.
[1] http://web.archive.org/web/20130420011526/https://www.reddit...