OkCupid's “Removed” Visitor API

https://zdware.com/2018/okcupid_removed_visitor_api/

by zdware • 8 years ago

185 77 8 years ago

nukeop3• 8 years ago

I never get it why people who discover secrets like these make extra sure nobody else can ever enjoy them again. Just use the undocumented feature and don't make a big thing out of it.

This way it's ruined for everybody, and they get nothing in return, except for some HN points on their blog post.

aleontiev• 8 years ago

Not sure if sarcasm or stalker enthusiast

blattimwind• 8 years ago

Why come out with an ad hominem? You could just say "data enthusiast" ("I like big datas and I cannot lie").

reimertz• 8 years ago

Don't know if you're sarcastic, but I prefer privacy related issues like this to be surfaced and would call it morally wrong not doing so.

nukeop3• 8 years ago

There would be no privacy issues if the users did not give up that private data willingly in the first place. A-ok with random company on the internet having access to it, but suddenly other random parties exploiting it are "creepy"? It was being shared with advertisers and analytics providers anyway.

josephwegner• 8 years ago

This is not an unintended feature - it is a gaping privacy gap. That data is not intended to be public, and is in fact dangerous when made public. It's _especially_ creepy that this detailed data is available to someone who has unsuccessfully interacted with you on a dating website. All that aside from this likely being against the terms & conditions provided by OkCupid, meaning their user's data was being used against the contractual limits.

There was no real-world case where this data was useful in a non-creepy way.

UncleEntity• 8 years ago

...and they get nothing in return, except for some HN points on their blog post.

And, you know, some increased measure of privacy.

For some odd reason people seem to be concerned about all the private data they (willingly) give to these corporations leaking outside of the corporation proper as if it's a violation of their (misplaced) trust or something. Lots of that going around recently for...reasons.

notananthem• 8 years ago

This sort of comment is in line with their post history so no, likely not sarcasm.

nukeop3• 8 years ago

Who are you?

saagarjha2• 8 years ago

it's ruined for everybody

I'd prefer that it was. This is clearly something that leaks personal information.

nitwit005• 8 years ago

Obviously a hidden feature of OkCupid for matching security researchers.

CrowderSoup• 8 years ago

The thing that impresses me most is how quickly OkCupid removed public access to that API.

rhizome• 8 years ago

Eh, comment out a route and deploy.

_asummers2• 8 years ago

That's only true if there was nothing internally relying on it.

recursive• 8 years ago

That's all well and good for a tech demo, but things rarely seem to be that simple in systems as big/old as OkCupid. I guess this time, it was.

jakobegger• 8 years ago

Where does the „body type“ data come from? Do they ask you for your weight when you sign up?

toomuchtodo3• 8 years ago

You specify it as part of your profile. If you pay for A-List (paid plan), you can filter potential matches by body type.

Disclosure: Paying OKCupid customer. I don't mind paying to support the service, it's provided ongoing value to us.

corobo2• 8 years ago

I have to wonder how effective paying for a dating site really is. Presumably if you find a partner through the site you stop paying?

Aside from a token few they can blog about, what's their incentive to be successful?

abledon• 8 years ago

"""it's provided ongoing value to us"""

Is that a multi-user account? Or are you guys swingers or something?

Sohcahtoa82• 8 years ago

How well does that filter work when so many people lie to themselves about their body type?

I've seen too many 300+ lb women describe themselves as "average".

Implicated3• 8 years ago

How does this even happen?

How can the developers behind an endpoint like this not confirm/test that it requires permissions/authentication to consume? (I mean, look at all that data...)

Amateurs I can understand - but OKCupid has been around long enough they shouldn't be employing people of that nature.

Is there no code review process?

This is just nuts.

saudioger• 8 years ago

It's easy to fall into this:

It works so no one complains.

icedchai• 8 years ago

"Visitors" was actually a feature up until a few months back. They probably removed it from the front-end, but left it in the back-end. This is very, very common. There would be not much to "review."

tytytytytytytyt2• 8 years ago

It's certainly not outlandish that this happened. Have you never been employed as a programmer?

Implicated3• 8 years ago

I am, and have been. That's why it's so outlandish to me - I keep user data in mind all the time. Finding out you're leaking sensitive personal data is a slippery slope I (nor my clients) want to go down.

Are you implying that it's not outlanding for professional programmers to not have these things in mind?

616c• 8 years ago

I do appsec for a living now and it is amusing how few people question stuff. I have made a name in a small firm by finding something easy, but usually severe, and coaching coworkers who had no idea. Of them I one of the most junior, and we replaced security people from before and the most senior has been here 2-3 years. Some of the stuff I'm busy writing up has 5-10 precedence in the company and upsets lazy culture and repeat copy pasta.

And I will tell you on sprints where anyone is busy that team introduces something sloppy or nutty when one of us does not watch closely and ask, sometimes both. But when I point things out people are eager to roll it back.

Never attribute to evil that which comes from ... you get the idea!

odammit3• 8 years ago

I dated on okc for a few years. I hate driving (LA) and so I frequently filtered my matches to 5 miles (if I recall that was the smallest radius).

5 miles in LA can be a long drive. So I wrote a chrome plugin to add additional drop down options of 0.1, 0.5 and 1 mile. I was surprised to see it work.

It was awesome.

There is also a hack to get the infamous “top X% of hottest people” feature unlocked... :)

swang• 8 years ago

yeah it was easy to modify it in the query string.

Thriptic2• 8 years ago

mind elaborating?

waisbrot• 8 years ago

However, they gave no answer for why unnecessary data was being provided.

I mean, it was obviously a bug, right? I imagine the only "explanation" would involve detailing the origin and nature of the bug which would be unwise until they've gone through all their other endpoints to ensure that there's not another instance of this same information leaking.

notimetorelax• 8 years ago

I don’t think that this was a bug. Most probably, they have those DTO objects for viewing and editing. In that scenario the correct thing to do would be to create a new DTO object that exposes only the necessary information, but this is an extra effort.

brosner2• 8 years ago

About seven years ago I met my wife on OkCupid. The only reason why I messaged her back (after had messaging with her several months earlier) was because of the frontend visitor feature. She had visited my profile randomly again. Turns out she said she accidentally clicked on to my profile intended to see someone else.

I haven't used OkC since then, but I thought I'd share that in the context of this blog post ;-)

alexandre_m2• 8 years ago

One day when you have kids, you can tell them "you are the result of a mistaken web click"

Aaargh20318• 8 years ago

If, not when. Children are optional.

Pet peeve of mine, but too many people don't even think about it and just procreate because it's part of the Standard Life Script™.

brosner2• 8 years ago

For the record, we have a one and half year old son :D

zdware2• 8 years ago

That's pretty awesome!

The site has changed quite a bit then. Now you would of never been able to message her unless she "liked" you.

inostia• 8 years ago

I have a similar story. My current girlfriend was living in another city about three hours away, I never would have seen her profile in my possible "matches" because I wasn't looking in that city. She did a search query for an author we both like, and my profile came up. If she didn't "visit" my profile and pique my interest I likely never would've met her! I'm sad to think that with the changes OKC have made recently (haven't used it since I met my GF obviously) people will have less luck finding people. They want to turn it into a Tinder clone.

i386• 8 years ago

"stalk_time" makes me feel very uncomfortable. Names matter.

cbluth• 8 years ago

If it said "wash_time", then would you feel clean?

goodside• 8 years ago

The original name of the feature actually was "stalkers" — that's how it was presented to users before 2010 or so. The site had a lot of dark humor then. The word "stalk" also works as a clarifying synonym for "visit" in the code because "visit" could refer e.g. to the user's visit to the site itself.

zdware2• 8 years ago

The payload for the visitor API payload was an object containing an array whose key was `stalkers`, so still the same!

Madmallard• 8 years ago

Okcupid has been going downhill for years. Four years ago you could get matches on there even if you were average looking that werent way below your league and actually interact with a ton of people. in 2018 it is mostly bots and you wont get meaningful interaction really anymore. The tinder looks bias is also literally enforced at this point (only see messages from profiles you look at, only messaging matches). They have totally lost their way.

OkCupid's “Removed” Visitor API

Related Stories