Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

11–20 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#11

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

One of the founders published an excellent book that is an extension of the blog: https://www.goodreads.com/book/show/21480734-dataclysm

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#12
post #8
post #4

Earlier quoted context omitted.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

That's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.

Maybe, but how much value is there in taking over people's OKCupid account?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#13
post #9

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

I'm pretty sure 99% of people would openly agree that physical attraction is a core element of partner selection.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#14
post #8

Earlier quoted context omitted.

That's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.

Maybe, but how much value is there in taking over people's OKCupid account?

You'd be surprised, alot - but I'd wager it's easier to just save the photos and open up your own honeypot that way.

But the messages could be interesting.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#15
post #9

Earlier quoted context omitted.

What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes

I'm pretty sure 99% of people would openly agree that physical attraction is a core element of partner selection.

Not anymore, but before online dating people were hiding it much more

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#16

Earlier quoted context omitted.

I'm pretty sure 99% of people would openly agree that physical attraction is a core element of partner selection.

Not anymore, but before online dating people were hiding it much more

People were trying to hide that they actually want to be sexually attracted to their partner?...

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#17

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

Sadly a lot of their most interesting posts went away after they were acquired

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#18
As someone who used to be so want active on the site and even tried out their paid subscription, I had the features of the paid subscription for years after I canceled my membership. They finally caught it and disabled them but it was pretty clearly a bug.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#19
post #4

Earlier quoted context omitted.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

Lots of sites do this, it’s a feature for the majority of users who prefer convenience over security.

I find that passwordless links usually expire after 1 use or some amount of time; generating eternal alt-passwords for an OkCupid account in every message notification email seems pretty heinous.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#20
post #8

Earlier quoted context omitted.

That's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.

Maybe, but how much value is there in taking over people's OKCupid account?

Someone I knew once sent me an urgent direct message over Twitter that they were stranded in the City of London and needed me to wire money. Phone gone, computer stolen, they could only communicate by Twitter. Of course it wasn't actually my friend, but a 2-bit hacker. But if they were to collect enough accounts and message enough people, someone might bite. Maybe someone would give up something truly valuable if they really thought it was someone they cared about, a long lost son, or a pined-for ex.
Post reply on HN