Live data from Hacker News

Not OK Cupid – A story of poor email address validation

fastmail.com

31–40 of 123 posts

Re: Not OK Cupid – A story of poor email address validation

#32

Companies that allowed others to create accounts with my email addresses: PayPal, Apple, Credit Karma, Walmart (I just forwarded the email to legal@ and they took care of that instance very quickly, kudos to that at least). Edit: Forgot to add TD Bank - I actually opened a case with the Office of the Comptroller of the Currency that regulates this bank. Companies that spammed me in the last 24 hours because they don'…

What email are you using that's so popular that dozens of people are (inadvertently?) entering it in all these businesses? Are you "john.smith@gmail.com" or something like that? I'm firstname@firstnamelastname.com, and I have had maybe a half dozen instances in the past decade.

first.last@gmail.

Common-ish English names, uncommon combination, but apparently common enough (did a quick search and there are at least 20 in the U.S.)

The Apple one was a catchall @lastname.com (a different first name than mine, but same last name)

Re: Not OK Cupid – A story of poor email address validation

#33
post #19

Earlier quoted context omitted.

I do in Gmail, but half of them will never go in the spam folder such as from Credit Karma.

Had the same problem with Peacock despite constantly attempting to unsubscribe and mark spam. In the end I just created a filter rule to throw it in spam.

If you're in the US, I've had success by contacting customer service and threatening action under CAN-SPAM. The FTC has never really provided an easy way to file complaints or request enforcement by the public, but it seems to get their attention all the same. Now is a good time to try to exercise your legal rights against corporations before they are all executive order'ed away.

Re: Not OK Cupid – A story of poor email address validation

#34
post #29

Companies that allowed others to create accounts with my email addresses: PayPal, Apple, Credit Karma, Walmart (I just forwarded the email to legal@ and they took care of that instance very quickly, kudos to that at least). Edit: Forgot to add TD Bank - I actually opened a case with the Office of the Comptroller of the Currency that regulates this bank. Companies that spammed me in the last 24 hours because they don'…

Someone signed up to Amazon with an email address of mine, and saved their credit card details. I couldn’t get any attention from Amazon, and just got generic responses telling me I could reset my password, etc. In the end, I signed up to Amazon prime, I think to test some reassurance they had given me - I wasn’t expecting it to work. The email saying I had just accidentally made a purchase with someone else’s credit…

I thought about doing something mildly nefarious with someone's PayPal account that they added my address to, but didn't want to chance legal problems. Instead I just logged into their account and removed my email address and logged out.

Re: Not OK Cupid – A story of poor email address validation

#35
post #27

Earlier quoted context omitted.

It probably started when they sold to The Match Group a while back. I used it a little back in 2014, and again in 2021. The second time around, it was very different. I don't know of any dating companies that focus on matching people versus optimizing for revenue.

Unfortunately most consumers are unwilling to pay what something is worth to them. Businesses are often the same so it isn't just consumer behaviour. Meeting the right person should be worth a lot, and we should be happy to pay thousands for that. Of course the profit depends on the user statistics too: I'm not sure what the economic term for profit thresholds for power law masses versus targeting - where say lots of…

> Meeting the right person should be worth a lot, and we should be happy to pay thousands for that.

We're happy to pay much more than thousands to marry the right person.

Meeting the right person doesn't do anything for you; why would you pay thousands for it?

Re: Not OK Cupid – A story of poor email address validation

#36

Earlier quoted context omitted.

It probably started when they sold to The Match Group a while back. I used it a little back in 2014, and again in 2021. The second time around, it was very different. I don't know of any dating companies that focus on matching people versus optimizing for revenue.

Are you implying there are companies that don't focus on optimizing for revenue?

Perhaps not. But you could still imagine a for-profit matchmaking service that would do a better job of aligning its interests with those of its clients. For example, it could collect only a small fee upfront with an agreement that if you meet Mr. or Ms. Right you'll release a larger fee held in escrow.

I imagine that would need to be quite personalized and high touch, but it would be an appealing contrast to standard dating sites, which have interests diametrically opposed to those of their users: a user who makes a long-term match will stop paying the membership fee, so the site owner has no real incentive to help the user do anything but churn.

Re: Not OK Cupid – A story of poor email address validation

#37
Ugh. Then there's the general stupidity of forcing people to use E-mail addresses as user IDs. It's not just annoying, but also a security blunder. The general public can't be counted on to understand that when they're forced to use their E-mail address as an ID, they don't have to use their E-mail account's password for it.

That makes every one of these sites a gatekeeper to the user's E-mail account. All it takes is one shitty security regime or one disgruntled employee to expose these credentials.

Then there's the fact that everyone's E-mail addresses are on thousands of spammers' lists. When you combine those lists with lists of common passwords and start probing accounts, you have... once again... boatloads of compromised ones.

It's sad to see a company like Apple fall into this dumb behavior and then try to patch it up after some high-profile "hacks." Originally, Apple IDs did not have to be E-mail addresses; when they implemented this dumb policy, they wound up with scads of customers with multiple Apple IDs and purchases scattered across them willy-nilly. And when people rightfully complained, Apple huffily declared that it would NOT consolidate them for anyone. Nice attitude: Create a problem and then refuse to provide a solution.

But back to the perpetrator here: OKCupid took this to a new level when they started insisting that you provide a phone number. I got into some loop where I couldn't log in and I couldn't log out, because they kept hounding me about the phone number that I couldn't access my account settings to provide. Or something stupid like that. And you know what, OKC? You don't need my phone number, so piss off.

It's too bad. OKCupid was the best of the dating sites during its heyday.

Re: Not OK Cupid – A story of poor email address validation

#38
post #19

Earlier quoted context omitted.

Had the same problem with Peacock despite constantly attempting to unsubscribe and mark spam. In the end I just created a filter rule to throw it in spam.

I can't find an opinion in Gmail to create a filter to "Always send it to spam". There's only "Never send it to Spam"

That might be out of concern of bad faith users abusing such a feature, such as folk who actually opt into a newsletter and then feed the results into such a filter.

You can at least "delete" via filter, though.

Re: Not OK Cupid – A story of poor email address validation

#39
OKCupid has another security issue related to email. If you get your hands on a link that they send out to a person's email regarding a match then that link auto logs you into their account and you can do whatever you want with it.

I discovered that when a friend of mine forwarded me a match that they had made and I suddenly found myself able to read their messages.

I contacted OKC about it and they did reply saying that it was a WONTFIX.

Re: Not OK Cupid – A story of poor email address validation

#40

OKCupid went steeply downhill over several years and as far as I can tell is now worthless and untrustworthy in every way.

I wonder if they still (illegally?) discriminate based on sex. They used to give different payment plans to men versus women.

You used to be able to edit the plan number in the URL to get a better rate, then they "fixed" that, but then all you had to do was edit the plan number in the form action.

Post reply on HN