Live data from Hacker News

Show HN: my new project, an anti-snub dating site

secretpoke.com

101–110 of 120 posts

Re: Show HN: my new project, an anti-snub dating site

#101
post #42

Earlier quoted context omitted.

Lol ok nice one we gonna fix that like right now :) Thank to your twisted mind :p Thats why I love HN you always find your way around ;)

Avoiding information leakage, whether in terms of error cases (e.g. incorrect padding on crypto showing a different error, leading to a padding oracle attack) or in terms of user-facing content (e.g. exposing whether or not a username or email exists in the system) can be difficult. That said, you should always err on the side of showing a single message rather than multiple -- in this case, always show success. This…

After an unsuccessful attempt to login, say "Sorry, that login information didn't work."

If someone wants to reset their password, after they enter their email address say "Thanks. If that email address is in our database we will send a reset link."

Re: Show HN: my new project, an anti-snub dating site

#103
I really hate writing this, so if this comes off as needlessly harsh I sincerely apologize, but I see a lot wrong with this site.

The first problem is that it's nothing new. I remember sites like this when I was in high school, and I graduated in 2003. Maybe you've built a better mousetrap, and maybe the world is just ready for this sort of thing now, but I'd bet there's a reason there isn't already a dominant site in this area given how long the idea has been around.

I remember from the high school version of this that it was horribly abused. It's a great attack vector for certain types of bullies and misguided prankster friends, and it will be used as such.

I should also point out that people can have multiple email addresses, and not all of your friends and acquaintances will know you by multiple addresses. What if I send the message from the wrong address, and my crush only knows me by something else? If she does like me, she'll have to send her own "first message" to my other address. If I suddenly receive another "someone's crushin' on you" message, wouldn't I first assume that it's someone else, since if it was my crush was mutual, I would have got a confirmation, not a request, right?

So let's assume that the crush is mutual. The only way the crushee to find out who I am is to put herself out there as well. It's sort of a large jump to ask someone, especially a shy someone, to make. Also, what if the crushee knows you by a couple email addresses? Which should she send a request/confirmation to? She could send it to both, but then she's using at least two out of her three freebies. If she likes two people, and knows both of them by two emails, then one of those two people can't receive a confirmation on both accounts unless the crushee decides to shell out two Euros (Around $2.70 in American/Canadian currencies). I sincerely doubt someone would do that.

One major problem is what I'll call "balls." Do women really want a guy who's too fucking timid to just come right out and say they like them? No.

I'll give you an example:

My hotmail address (used for likely-to-spam signups and as an MSN moniker) was created solely to send a "crush" email to a girl I liked in high school. This was back when hotmail had a directory you could use to email people you didn't have a proper address for.

So, I sent her a message saying basically, "hey, we've got a couple classes together and I noticed you, etc. etc." When I got a response back, is was just "You've piqued my interest. Spill, who are you?" with instructions to just man up and approach her in class. Women tend to like confident men, and men who hide behind internet filters tend not to be the confident type.

Finally, I just want to note that there's also a question of legality here. I can't cite a source off the top of my head, but I know there is legislation in Canada and possibly in the States that classifies "Tell-a-Friend" type email functionality as spam. These emails are therefore subject to fines. I don't know if they enforce it for things like this, but it's definitely something to consider.

Re: Show HN: my new project, an anti-snub dating site

#104
Hasn't this scam already been done?

Years ago there were a flurry of sites like this. They'd send spam to sadfsdfsadfhrtrth@yahoo.com (fake address that I'd only ever used once at some shady ecommerce site) telling me that someone had a crush on me, and all I needed to do was provide my credit card number to find out who.

Ho-ho-ho.

Re: Show HN: my new project, an anti-snub dating site

#105
post #75

Earlier quoted context omitted.

Ew no, don't always show success, there surely has to be a more elegant solution. I have multiple email addresses and sometimes I'll use a different one for a different service, if I enter email@website.com when I used email@anotherwebsite.com and you show success when it's the wrong one, I'll be waiting for an email that will never appear... Maybe HN can work out a good solution collectively? I can only think of a s…

I think the solution is pretty simple... just be transparent and say for security reasons you can't reveal whether or not the user exists.

Yes, just saying this should be sufficient - "If your email address is our database, you would shortly receive an email to reset your password".

Re: Show HN: my new project, an anti-snub dating site

#107
post #52

Earlier quoted context omitted.

Before using it I would want to be reassured on two points: 1. I wouldn't feel very optimistic using such a site because I assume the emails you send will seem like spam and will be deleted by the recipients without much thought. 2. Using this site makes one vulnerable to cruel trolling. Imagine three or four people getting together, "secret poking" people they know, and sharing the results for shits and giggles. If…

You seem to have a general mistrust of others. I've found life is a little better if you don't assume everyone's out to get you from the get-go.

dude, mistrust of others isn't about assuming everyone's out to get you, it's assuming that one person can ruin things for everyone, which is true.

Re: Show HN: my new project, an anti-snub dating site

#109
post #53

Earlier quoted context omitted.

Ew no, don't always show success, there surely has to be a more elegant solution. I have multiple email addresses and sometimes I'll use a different one for a different service, if I enter email@website.com when I used email@anotherwebsite.com and you show success when it's the wrong one, I'll be waiting for an email that will never appear... Maybe HN can work out a good solution collectively? I can only think of a s…

How about show success, but adjust the confirmation e-mail accordingly. For example, if the e-mail address is not registered you could say something like "We received a request to recover your password on our service but see that you are not registered for our service with this e-mail address." ?

[deleted]
Post reply on HN