How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#1

Post by flipnotic » Mon, Aug 02, 2021, 5:20 PM UTC

How to boost your popularity on OkCupid using CSRF and a JSON type confusion
blog.azuki.vip

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#2

Post by ctoth » Mon, Aug 02, 2021, 5:24 PM UTC

> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool.

Ouch.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#3

Post by llampx » Mon, Aug 02, 2021, 5:35 PM UTC

ctoth wrote: post #2

> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool. Ouch.

The Data Protection Agency loves this weird trick!

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#4

Post by Teever » Mon, Aug 02, 2021, 5:39 PM UTC

ctoth wrote: post #2

> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool. Ouch.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account.

I contacted OKC about this but they said that it was not an issue.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#5

Post by PicassoCTs » Mon, Aug 02, 2021, 5:46 PM UTC

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating.

https://theblog.okcupid.com/tagged/data

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#6

Post by DJBunnies » Mon, Aug 02, 2021, 5:51 PM UTC

Teever wrote: post #4

ctoth wrote: post #2

> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool. Ouch.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

Lots of sites do this, it’s a feature for the majority of users who prefer convenience over security.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#7

Post by the__alchemist » Mon, Aug 02, 2021, 6:07 PM UTC

Anecdote: OkCupid is the only website or app where I've had an account hijacked. I got it back with a password reset, but the profile and pics were filled with bogus content.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#8

Post by simonw » Mon, Aug 02, 2021, 6:17 PM UTC

Teever wrote: post #4

ctoth wrote: post #2

> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool. Ouch.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

That's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#9

Post by quacked » Mon, Aug 02, 2021, 6:29 PM UTC

PicassoCTs wrote: post #5

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating. https://theblog.okcupid.com/tagged/data

What people say they sort on: personality, values, morals, political views, friendships, etc.

What people sort on when they don't think they're being observed: genes

Re: How to boost your popularity on OkCupid using CSRF and a JSON type confusion

#10

Post by nicoburns » Mon, Aug 02, 2021, 6:35 PM UTC

Teever wrote: post #4

ctoth wrote: post #2

> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool. Ouch.

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.

This isn't ideal, but why would anyone forward this kind of email?