Earlier quoted context omitted.
Maybe, but how much value is there in taking over people's OKCupid account?
If there's no value or downside to someone taking over my OKCupid account, why have a password on it in the first place?
How to boost your popularity on OkCupid using CSRF and a JSON type confusion
51–60 of 134 posts
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#52Earlier quoted context omitted.
Gmail now pretty much breaks single-use tokens in links because it consumes them itself after a user clicks on them, but before redirecting the user to the site. It's an unfortunate change that has made single-use links a worse UX and less popular in the last couple of years.
This isn't the case in my experience. We have a tool that sends me an email with a single use link when it's used. I just now confirmed that I receive the email containing the single-use link, that I can click on it and view the page, and that the single-use link is no longer available after I've viewed the link. Is this perhaps conditional behavior of some sort?
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#53Earlier quoted context omitted.
If there's no value or downside to someone taking over my OKCupid account, why have a password on it in the first place?
This is a horrible take, obviously there’s different levels of security and risk associated with everything.
If there's literally no value in taking it over, then why password protect it in the first place?
I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If there's no value in exposing it, why bother password protecting it?
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#54Earlier quoted context omitted.
This is a horrible take, obviously there’s different levels of security and risk associated with everything.
A horrible take on how much value is there in taking over people's OKCupid account ? If there's literally no value in taking it over, then why password protect it in the first place? I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If ther…
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#55Earlier quoted context omitted.
This isn't the case in my experience. We have a tool that sends me an email with a single use link when it's used. I just now confirmed that I receive the email containing the single-use link, that I can click on it and view the page, and that the single-use link is no longer available after I've viewed the link. Is this perhaps conditional behavior of some sort?
Perhaps it’s 2-use?
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#56Earlier quoted context omitted.
A horrible take on how much value is there in taking over people's OKCupid account ? If there's literally no value in taking it over, then why password protect it in the first place? I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If ther…
It's a bad take because you made it sound like I said it was worthless, when all I implied was that it isn't worth much. There's a difference.
Did you mean that it's valuable enough that someone should protect it, but shouldn't bother protecting it too much (like, anyone with the URL should have access to it) since it has little value? I'm not sure I really understand the nuance, but I'd be awfully surprised if I forwarded an email to someone from OKCupid and it gave them passwordless access to the account.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#57I didn't get many pokes, and I can't tell what part of this story is the saddest. Maybe the part that there probably weren't bounties back then (that I was aware of) and I didn't get any money for this discovery.
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#58Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#59Earlier quoted context omitted.
What people say they sort on: personality, values, morals, political views, friendships, etc. What people sort on when they don't think they're being observed: genes
If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site. But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There we…
Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion
#60Earlier quoted context omitted.
If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site. But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There we…
Interestng, have a link for the study? Can't seem to find it
This talks about a follow-up study 5 years after the first one, searching "okcupid race and attraction" doesn't find me the link to the 2009 article.