Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

blog.azuki.vip

Post reply on HN
Print view View original

111–120 of 134 posts

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#111

Post by vmception »

mellosouls wrote: post #58

Reminder of the classic "Mathematician Hacks OkCupid" story from a few years back: https://www.wired.com/2014/01/how-to-hack-okcupid/

Intriguing! I have a friend that did a web scraper on OK Cupid several years before that article, perhaps 2009, based on the same idea: people can see when you looked at their profile or something. He didn't optimize much beyond that and wasn't meeting people he considered attractive, he just wanted to have an additional pool of meetings and volume of hookups, which was successful.

Both he and the author of this story were able to warp the male experience in order to have many messages from women to sort though.

I find this one interesting as the author here was actually looking to have a relationship, and eventually proposed and removed himself from the pool. I hadn't seen anyone do a data driven approach for that. 88 first dates though, a lot of effort.

I'm somewhat familiar with LA, haha its sad he cut out the women from the east side due to distance because he's normally around UCLA. The east side women sounded pretty fun, younger, unencumbered but having suboptimal living environments. Which sounds about right for Los Angeles. Makes me kind of want to ponder if anyone has done two apartments in LA, westside and downtown.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#112

Post by DoingIsLearning »

xiphias2 wrote: post #49
OminousWeapons wrote: post #16

Earlier quoted context omitted.

People were trying to hide that they actually want to be sexually attracted to their partner?...

To me (a not attractive man) yes. But I'm from Eastern Europe, the culture is different there.

Out of curiousity in terms of attractiveness and dating or choosing a partner, what do you feel is culturally different in Eastern Europe?

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#113

Post by Blankenface »

pseudalopex wrote: post #108
Blankenface wrote: post #97

Earlier quoted context omitted.

The whole top vs bottom 50% attractiveness bit was a gag thing. It's such a common outraged-post topic that the okcupid subreddit has a FAQ about it in the sidebar. OKCupid used to be substantially weirder than it was before it was swallowed up by IAC. I mean really fucking weird. One of many examples: the signout page had a clipart photo of an airport firefighter (ie silver suit head to toe) in a veeeeery suggestive…

The FAQ says it's determined by likes. Not it was a gag.[1] [1] https://www.reddit.com/r/OkCupid/wiki/faq#wiki_1._.22we_just...

Apparently it's been changed, and I guess the mod team is in on the gag, because it's just an anti-churn email.

https://www.businessinsider.com.au/okcupid-hot-or-not-list-o...

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#114

Post by shakna »

EpicEng wrote: post #27
thih9 wrote: post #21

Earlier quoted context omitted.

I guess when an adversary knows about the feature and uses some social engineering against the user?

In order to get access to their... OkCupid account? Not sure that I care.

Certain sexual behaviours are outlawed in certain nations. And may result in death or long incarceration times.

In other nations, it may not be strictly illegal, but is more than enough information that, if publicly released, would result in death threats and other social pressures.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#115

Post by swyx »

purerandomness wrote: post #22
PicassoCTs wrote: post #5

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

The official blog is the cleaned-up version, they removed the most interesting articles when they sold out to match.com Famously, the article "Why You Should Never Pay For Online Dating" got deleted during the acquisition. [1] Mirror: https://www.gwern.net/docs/psychology/okcupid/whyyoushouldne...

i'd love to pay for the substack of whoever wrote that blogpost, they have to be sitting on a mountain of unpublished insights.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#116

Post by konha »

AlchemistCamp wrote: post #69
gbl08ma wrote: post #43

Earlier quoted context omitted.

This sounds like it would break a bunch of email address verification systems, password recovery links and the like. I wonder if indeed it does break them, but since it only affects smaller websites nobody seems to care.

> "This sounds like it would break a bunch of email address verification systems, password recovery links and the like." This is exactly the pain I've experienced with my own site, https://alchemist.camp I've manually tested it and seen the token consumed when clicking the link via gmail but had no issues when copying the link from the password reset email to a gmail account. A second manual tester confirmed the same…

Instead of copy and paste you could have a POST form on your site to trigger the actual reset (with a hidden field pre-populated from the params of the email link). Gmail and others won’t touch it. They assume a GET is free from side effects and that it is safe to load your link because of that.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#117

Post by jsf01 »

lazide wrote: post #92
AlchemistCamp wrote: post #69

Earlier quoted context omitted.

> "This sounds like it would break a bunch of email address verification systems, password recovery links and the like." This is exactly the pain I've experienced with my own site, https://alchemist.camp I've manually tested it and seen the token consumed when clicking the link via gmail but had no issues when copying the link from the password reset email to a gmail account. A second manual tester confirmed the same…

Why not make them 2 use tokens? Not quite as secure, but way better than never expires?

Or after initial token use, set to expire after n seconds rather than immediately

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#118

Post by [deleted] »

lazide wrote: post #92
AlchemistCamp wrote: post #69

Earlier quoted context omitted.

> "This sounds like it would break a bunch of email address verification systems, password recovery links and the like." This is exactly the pain I've experienced with my own site, https://alchemist.camp I've manually tested it and seen the token consumed when clicking the link via gmail but had no issues when copying the link from the password reset email to a gmail account. A second manual tester confirmed the same…

Why not make them 2 use tokens? Not quite as secure, but way better than never expires?

[deleted]

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#119

Post by AlchemistCamp »

jsf01 wrote: post #117
lazide wrote: post #92

Earlier quoted context omitted.

Why not make them 2 use tokens? Not quite as secure, but way better than never expires?

Or after initial token use, set to expire after n seconds rather than immediately

That's exactly the approach I'm leaning towards using.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#120

Post by joshfraser »

Good to raise awareness as this issue has tripped up some of the biggest websites on the internet. I actually reported the exact same issue to amazon.com a few years ago. At one point it was possible to trick visitors into purchasing anything you wanted on amazon.com, including fake products you listed yourself or gift cards that you could send anywhere you wanted!
Post reply on HN