How to boost your popularity on OkCupid using CSRF and a JSON type confusion

https://blog.azuki.vip/csrf/

by flipnotic • 5 years ago

295 129 5 years ago

blog.azuki.vip

ctoth• 5 years ago

It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool.

Ouch.

llampx2• 5 years ago

The Data Protection Agency loves this weird trick!

Teever• 5 years ago

I learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account.

I contacted OKC about this but they said that it was not an issue.

DJBunnies• 5 years ago

Lots of sites do this, it’s a feature for the majority of users who prefer convenience over security.

simonw4• 5 years ago

That's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.

nicoburns• 5 years ago

This isn't ideal, but why would anyone forward this kind of email?

PicassoCTs• 5 years ago

They might be security wise rather weak, but their statistics blog is a brutal-beautiful view into what humans search for dating.

https://theblog.okcupid.com/tagged/data

quacked• 5 years ago

What people say they sort on: personality, values, morals, political views, friendships, etc.

What people sort on when they don't think they're being observed: genes

OminousWeapons2• 5 years ago

I'm pretty sure 99% of people would openly agree that physical attraction is a core element of partner selection.

filoleg2• 5 years ago

The way I see it, people sort on both genes (aka looks) and personality/values/morals/etc.

The thing is, by just scrolling through the feed/list of people to swipe on, you don't get to see much personality, mostly looks. To get to personality, you gotta talk to the person.

So when you swipe, you filter mostly by looks. And once you match and start talking, that's when you filter by personality.

Yes, one can say that you can get personality from their bio/profile, but that's such a non-consistent metric with tons of noise and misleading data (cliched/copypasted bio, nothing standing out, outdated bio, etc.). You need to have a conversation with a person to get a gauge of their real personality (of course, exceptions apply; if you see a profile/bio claiming that vaccines give kids autism and that the only valid covid treatment is essential oils, you kinda already have an idea who you are dealing with).

And out of all those people you spend a lot of time intensely reading thru profiles of before swiping, most of them won't even match with you. So imo, it makes sense to initially swipe based purely on looks and a 5-10 second glance at the profile, and then try to gauge their personality only after you match.

rhizome• 5 years ago

OKCupid doesn't allow you to sort on anything anymore. It's all part of their business model of preventing people from creating permanent relationships. Yes, some slip through, don't @ me.

nonameiguess4• 5 years ago

If I'm remembering correctly, it was way more specific than that. The only genetic thing is there were some extreme racial biases. You really don't want to be an Asian man or a Black woman on a dating site.

But plenty of non-genetic things. Back when they let you list an income range, men with higher incomes got much better response rates. Men heavily favor women who are at least ten years younger than them. There were weirdly specific things about your photos that mattered, too, like you'd get a much better response rate if other people weren't in the photo with you, you'd get a better response rate if you weren't looking at the camera. Women were more attractive if they were smiling but men did better if they were not smiling.

Christian Rudder used to publish gold mines for anyone who wanted to just game hot-or-not. Plenty of this was stuff you could control, not genetic. Though I guess you can't exactly control your age even if it isn't genetic. It also let you sift through the lies, like women would always say they were turned off by shirtless pictures, but based purely on response rates, that definitely wasn't true for men who actually had lean bodies.

monkeybutton• 5 years ago

One of the founders published an excellent book that is an extension of the blog: https://www.goodreads.com/book/show/21480734-dataclysm

Rebelgecko• 5 years ago

Sadly a lot of their most interesting posts went away after they were acquired

purerandomness• 5 years ago

The official blog is the cleaned-up version, they removed the most interesting articles when they sold out to match.com

Famously, the article "Why You Should Never Pay For Online Dating" got deleted during the acquisition.

[1] Mirror: https://www.gwern.net/docs/psychology/okcupid/whyyoushouldne...

klodolph• 5 years ago

It's a good article, and one of the key takeaways:

If a dating site makes you pay to send messages, then they have an incentive to make you send messages to inactive accounts rather than active accounts, since people with inactive accounts have to pay in order to reply.

Blankenface7• 5 years ago

There were also articles that ran counter to popular gender theory/politics.

This is off memory but I believe their stats showed that men rated women's photos on what resembled a classic bell curve, shifted to the right slightly. Ie, dudes were generally reasonable if not a wee bit overly kind.

Women were exceptionally brutal in ranking men's looks. Women's ranking of men was a triple-diamond ski hill with damn near most of the userbase falling in (I believe, again, this is from memory) the bottom third. "Women are held to unrealistic beauty standards" seems to be more than a bit of projection.

Funny story: I got banned from OKCupid once for calling out other volunteer flagmods (people suckered into wasting their time policing OKCupid user photos for free) for body shaming and transphobia (the latter almost exclusively toward transfemmes, but both coming almost exclusively from white, straight women.) Hilarious.

swyx• 5 years ago

i'd love to pay for the substack of whoever wrote that blogpost, they have to be sitting on a mountain of unpublished insights.

jokethrowaway• 5 years ago

Wow, the in app questions are pretty politicised to say the least.

Is that something that really matters in dating these days?

the__alchemist• 5 years ago

Anecdote: OkCupid is the only website or app where I've had an account hijacked. I got it back with a password reset, but the profile and pics were filled with bogus content.

jacquesm• 5 years ago

That's what I would say too ;)

spywaregorilla• 5 years ago

Any idea what the intent was?

Blankenface7• 5 years ago

Not the person you're replying to, but: probably to use the account to romance-scam other users with.

m0rti• 5 years ago

I had the same experience. My profile was transformed into a 50-year-old white male wearing a trucker hat without my knowledge. By the time I was able to access my account, it had a bunch of matches and messages from 50-60 year-old American women.

ftio• 5 years ago

So how'd your dates go?

IgorPartola• 5 years ago

As someone who used to be so want active on the site and even tried out their paid subscription, I had the features of the paid subscription for years after I canceled my membership. They finally caught it and disabled them but it was pretty clearly a bug.

filoleg2• 5 years ago

Is it just me, or the images on the post are not loading?

Initially I tried on the most recent FF, and about half the images were not loading. Refreshed the page, no images were loading after that at all.

Then I tried on the most recent Chrome, images were not loading at all either.

If someone has a workaround, please let me know. I have confirmed that adblocker and such were all disabled.

Upon trying to access the images directly, I got this 403 error:

Your client does not have permission to get URL /u/0/d/<rest-of-the-URL> from this server. (Client IP address: <my-ip-address>)
Rate-limit exceeded. That’s all we know.

darknavi• 5 years ago

Not just you. On Edge Chromium and no images are loading.

digitcatphd• 5 years ago

This is so HN lol

matsemann• 5 years ago

Would relying on CORS still work as long as the server checks that the type is actually application/json? Since those headers are impossible to set from a form, and doing it with fetch it would trigger a preflight request.

amenghra2• 5 years ago

Historically, it would have been weak since Java/Flash gave you more control over sockets than what’s available with js. In today’s world, it might be ok. I would personally build defense in depth and not just rely on one weak property.

hmsimha2• 5 years ago

I believe this also requires that OKCupid has not set the 'SameSite=lax' attribute on their cookies, which is good practice as well; the browser won't send the user's cookies on cross-origin POST, PUT, PATCH, or DELETE requests when this attribute is set.

So this exploit is really the confluence of failing to follow 2 standard security practices, as well as another unfortunate configuration quirk:

- Failing to set SameSite=lax on their session cookie attribute - Not using a CSRF token to authenticate on unsafe HTTP actions - Not checking the content-type of API requests (though I'm not sure to what extent this is considered bad practice)

simonw4• 5 years ago

I thought most modern browsers behave as if SameSite=Lax automatically these days. Were OkCupid deliberately setting SameSite=None on their cookies?

k__• 5 years ago

Wasn't lax just for static assets like images that are linked in external HTML?

skohan• 5 years ago

This may be my favorite headline I have ever seen on Hacker News

nonameiguess4• 5 years ago

I have no idea if OkCupid still does this, but they used to segment their users based on attractiveness ratings. At first, I think it was solely just literally your attractiveness rating. They had a feature where you could rate people 1-5 stars and if you were in the top 50% of all rated users, you'd only see other people in the top 50% in your search results. If you were lower 50%, you'd only see people in the lower 50%. I think they eventually made this more sophisticated by augmenting the explicit average star rating with other measures of engagement like how often people saved your profile, how many messages you received, and the rate at which your own messages were answered.

Something like this could have been valuable to get you into the upper tier.

Decker87• 5 years ago

Something like this could have been valuable to get you into the upper tier.

Only valuable until people view my profile picture.

kbenson2• 5 years ago

Oh, someone that knows what they're doing photographically can help quite a bit there. A good professional portrait photographer has probably forgotten more tips and tricks to do with posing and lighting than the average Instagram professional ever knew.

llampx2• 5 years ago

Being popular is a "sexy attribute" on its own, to many people.

throwaway0a5e• 5 years ago

It's probably better to be erroneously in the bottom tier than erroneously in the top tier for reasons that should be obvious.

slig• 5 years ago

They had a thing where if you dismissed the top attractive users they would segment you as attractive as well and bump you up to the upper tier.

vmception4• 5 years ago

All the dating apps use a derivative of this and you can game that. They deny any particular label like ELO, used in online game lobbies. But knowing how leveled game matchmaking works will allow you to optimize your experience in dating apps far greater than wondering if you need a picture of a dog in your profile to get more matches.

Hope you guys don't mess up my experience with this knowledge! But I’ve been using these tweaks for years, so I’ll probably be on to something else after this gets arbitraged away.

yosito• 5 years ago

Any recommendations on where to learn how leveled game matchmaking works?

fortran77• 5 years ago

Something like this could have been valuable to get you into the upper tier.

Maybe not! Perhaps users would have more positive experiences if they "swam in their lanes."

Blankenface7• 5 years ago

The whole top vs bottom 50% attractiveness bit was a gag thing. It's such a common outraged-post topic that the okcupid subreddit has a FAQ about it in the sidebar.

OKCupid used to be substantially weirder than it was before it was swallowed up by IAC. I mean really fucking weird. One of many examples: the signout page had a clipart photo of an airport firefighter (ie silver suit head to toe) in a veeeeery suggestive pose with a firehose.

However, dating sites absolutely engage in the same techniques to hook users and reduce "churn" that free-to-play / cosmetic-sale-funded games do. Tinder is basically ELO applied to matchmaking coupled with the same psychological tricks (like initially showing your profile to much more attractive people / showing you much more attractive people, before dropping the liklihood of your profile appearing in anyone's stacks, and periodically re-boosting your profile just a tad to keep you from deleting your account.)

Edit just to say I forgot: why on earth is okcupid allowing links at all? Seems ripe for abuse. I guess it would encourage people to switch to off-site messaging quicker...

pseudalopex2• 5 years ago

The FAQ says it's determined by likes. Not it was a gag.[1]

[1] https://www.reddit.com/r/OkCupid/wiki/faq#wiki_1._.22we_just...

nonameiguess4• 5 years ago

I have no idea if it's a gag now, but they definitely used to actually do this. If you were around from the beginning, which I was (joined January 2004), you were very likely to end up in the top half when this first began. And you could trivially create a new account with otherwise identical details in the same location and see that your matches and search results were not the same people. After a few years, your new account would not just see different people, but noticeably uglier people.

OkCupid used to have real social features. You got a personal journal and could follow the journals of other users, and this clustered the sort of "power users" into cliques. This was actually how I met my wife, way back in 2007 though we didn't even live in the same state at the time and didn't physically meet until much later after discovering we'd both moved to Texas. Match axed the feature and we all moved to a Facebook group, but I've since quit Facebook, so only keep in touch with a limited number of people I had real contact details for whenever I happen to visit their cities for some reason.

This quite visibly split us. Knowing who in the group was top half and who in the group was bottom half was fodder for a whole lot of flame wars. And, of course, being it was a dating site, mate selection and the question of to what extent attractiveness can be objectively quantified was always a huge topic of contention. It's interesting to see so many years later how the split between the people taking distinct sides of that has evolved. Back then, those on the "objectively attractive" side of the coin were super into evo-psych, Austrian economics, and libertarianism. Those on the other side were quite a bit more varied, but I guess at least universally against the war in Iraq. 16 years later, the same people I still know have now segmented in extremely predictable ways, like anyone who really cared about Austrian school economics back then is now firmly red-pilled, anti-immigrant, super pro western-culture, into scientific racism and "human biodiversity" and somehow all migrated from libertarianism to backing classic right-wing nationalism complete with strong-man dictatorial leadership. The other side used to have a huge diversity of opinions on most things, but now all seem to universally be super into anti-racism, anti-fascism, and trans rights activism.

It's like the entire trajectory of what a person would ever come to believe as guiding principles upon which to base their lives was decided by a single trivial controversy with bad evidence in either direction that they nonetheless decided to take a hardline stance on decades ago.

With respect to the dating site techniques, I think it's important to distinguish between the OkCupid of today owned by IAC and the original OkCupid owned by Humor Rainbow. Match and IAC monetize using the same normal strategies of free to play games. But Humor Rainbow's strategy was to be the first to use fledgling big data techniques to fine-tune algorithmic matchmaking (in contrast to eHarmony's attempt to use conventional wisdom from the existing body of psychology knowledge), and then sell that technology to the highest bidder and cash out. The incentives of the current ownership and the incentives of the founders were quite different.

bellyfullofbac2• 5 years ago

Ah, more than a decade ago I found a similar issue on Friendster (anyone remember them?), I could embed an HTML image tag in my profile which loaded a PHP script (under my control) that would redirect the user to something like friendster.com/poke?id=[my user id], so if anyone visited my profile, their browser would GET that URL and I'd get a "poke" (I don't remember the Friendster term for it), notifying me who visited my profile.

I didn't get many pokes, and I can't tell what part of this story is the saddest. Maybe the part that there probably weren't bounties back then (that I was aware of) and I didn't get any money for this discovery.

cj• 5 years ago

A version of this was (maybe still is?) possible with LinkedIn, where you could simply embed a LinkedIn profile in a hidden iframe and then use the “who viewed my profile” feature to see who viewed your site.

Avamander• 5 years ago

Modern browser security features do not allow such an iframe.

mellosouls• 5 years ago

Reminder of the classic "Mathematician Hacks OkCupid" story from a few years back:

https://www.wired.com/2014/01/how-to-hack-okcupid/

vmception4• 5 years ago

Intriguing! I have a friend that did a web scraper on OK Cupid several years before that article, perhaps 2009, based on the same idea: people can see when you looked at their profile or something. He didn't optimize much beyond that and wasn't meeting people he considered attractive, he just wanted to have an additional pool of meetings and volume of hookups, which was successful.

Both he and the author of this story were able to warp the male experience in order to have many messages from women to sort though.

I find this one interesting as the author here was actually looking to have a relationship, and eventually proposed and removed himself from the pool. I hadn't seen anyone do a data driven approach for that. 88 first dates though, a lot of effort.

I'm somewhat familiar with LA, haha its sad he cut out the women from the east side due to distance because he's normally around UCLA. The east side women sounded pretty fun, younger, unencumbered but having suboptimal living environments. Which sounds about right for Los Angeles. Makes me kind of want to ponder if anyone has done two apartments in LA, westside and downtown.

SahAssar• 5 years ago

As the author mentions, simply validating the content-type would have been enough. CSRF is generally not a problem if you validate content-types and/or use SameSite for cookies, both of which have been recommended for years.

yonran• 5 years ago

Luckily the W3C deities gave us exactly such a gift in the form (pun intended) of the enctype attribute.

Minor quibble: enctype="text/plain" didn’t come from W3C. HTML 4.0 forms only defines enctype="application/x-www-form-urlencoded" (which pct-encodes the json delimiters {"":}) and enctype="multipart/form-data" (which has a non-json Boundary prefix) so if those were the only enctypes that browsers used, then this exploit would not have worked. https://www.w3.org/TR/html401/interact/forms.html#h-17.13.4

WHATWG HTML5 does define enctype="text/plain" behavior https://html.spec.whatwg.org/multipage/form-control-infrastr.... According to the mozilla docs, it was “Introduced by HTML5 for debugging purposes.” https://developer.mozilla.org/en-US/docs/Web/HTML/Element/fo... But I doubt it was created by WHATWG either; in 2004 the HTML5 editor Ian Hickson said “I agree it is brain-dead (it's IE-compatible)” https://lists.w3.org/Archives/Public/public-whatwg-archive/2... Unfortunately I can’t see history of the spec before 2006 though https://github.com/whatwg/html

runbathtime• 5 years ago

Is this a type of inflation or a type of fraud or neither? Popularity is a made up category, or one that is ill defined while being manipulative. Popularity implies those most desired, but since this can be goosed by paying for attention, it is meaningless and hence let the hacking begin.

vmception4• 5 years ago

I found you could use essentially the same vulnerability to get other users to “like” your profile. Obviously you could abuse this in order to match with anyone you could trick into clicking a link, or you could spam the link to a bunch of people to increase your profile’s rankings in whatever mysterious algorithm OkCupid uses to suggest people.

Ha! They should have used this to increase their evolutionary fitness!

Assumptions about matchmaking app algorithms are the crux of my behavior on dating apps. Far far greater influence than other users independent impression of my profile or me trying to put a best foot forward.

NewEntryHN• 5 years ago

Do people use OkCupid on the browser?

LAC-Tech• 5 years ago

Haven't been single for a while - is OK cupid still a thing? I thought everyone used Tinder now.

Blankenface7• 5 years ago

Sort of. The thing is, a truly massive number of dating sites are owned by Match Group, which used to be part of IAC.

Bumble and Coffee Meets Bagel are two examples of major non-Match-Group companies.

Epenthesis• 5 years ago

My impression as a 30 year old het guy in SF is that the big 3 are Tinder/Bumble/Hinge, roughly sorted in order of "casual" to "serious relationship".

According to friends, OkCupid seems to be baaarely limping along in queer/poly circles.

nuker2• 5 years ago

Business model is not letting you find your person, because if you do they lose a paying customer. Thats my thinking and why I’m not using dating websites.

polishdude20• 5 years ago

I was talking about this exact thing with my girlfriend the other day. Tinder and other dating sites want you to stay as long as possible and spend as much money as possible with them. How do you do that?

Number one: You give them hope. Give people hope that they will find the person they are looking for if they stay on longer. Give people hope by helping facilitate a match just as they start to lose interest in the website. Make them think they will find someone.

Number two: Cultivate a culture of attractive people. Keep the attractive people staying. This gives hope for the unattractive people as they sometimes match with them. Keep the attractive people happy and help facilitate lots of meetings or them.

Number three: Provide an easy way to skip the whole attractive/unattractive hierarchy by letting people spend money. Now you too can get in on the action (but not for too long) if you have the money.

I realize this is a pessimistic view of dating sites. Heck, I met my current girlfriend of three years on OkCupid luckily. It's not all doom and gloom.

nuker2• 5 years ago

It's not all doom and gloom.

Yep. They need it to work sometimes to stay competitive vs other websites. I guess it works as lottery draw, give only these 100 a proper match today

joshfraser• 5 years ago

Good to raise awareness as this issue has tripped up some of the biggest websites on the internet. I actually reported the exact same issue to amazon.com a few years ago. At one point it was possible to trick visitors into purchasing anything you wanted on amazon.com, including fake products you listed yourself or gift cards that you could send anywhere you wanted!

SergeAx• 5 years ago

This would be unable if OkCupid stored its credentials in sessionStorage or localStorage instead of cookies, right?

amenghra2• 5 years ago

With modern browsers, there are almost a dozen ways to defend against csrf. You can use sessionStorage and force all requests to be XHR. Set the “new” flag on session cookies to not transmit cross origin. Check the origin header for all POST requests. Set a token in the forms (the “classic” way).

How to boost your popularity on OkCupid using CSRF and a JSON type confusion

Related Stories