Download Public User Data with Oink's Export Tool

http://www.cristinajcordova.com/2012/03/oinks-export-tool-data-privacy-breach-download-the-data-of-any-user-5/

103 52 14 years ago

tonyrice2• 14 years ago

I honestly can say I have no clue what Oink is but this seems like something pretty serious.

chime• 14 years ago

Was Oink 100% public or were there private conversation/shares? If everything on Oink was public (like a public blog or Twitter before direct messages), then it doesn't seem like a big deal. It's just making it easier to snoop. Otherwise, wow.

tonyrice2• 14 years ago

I agree, if everything was public then it doesn't seem like a big deal but they still should of made measures to assure that only the user gets their data in exported format.

ErikHuisman• 14 years ago

I can't find any options in the oink app to make stuff private. So yeah, everything is/was public.

rickmb2• 14 years ago

Privacy is not about whether something is public or not. It's about being in control of your data.

This is the fundamental misunderstanding that seems to be rampant especially in countries like the US that lack basic privacy regulations.

Just because information was public, doesn't mean that using it in certain ways without the permission of the person involved is not a breach of privacy.

I seriously doubt this was a type of usages Oink users explicitly agreed to (and no, burying such provisions in the small print doesn't make it legal).

Karunamon3• 14 years ago

  >Privacy is not about whether something is public or not. It's about being in control of your data.

Um.. that's not what the word means. It's possible for you to not be in control of your data but still have it be private, and vice versa.

Google: Define: Privacy

  The state or condition of being free from being observed  or disturbed by other people.

  The state of being free from public attention.

That's what the dictionary says.

  >I seriously doubt this was a type of usages Oink users explicitly agreed to (and no, burying such provisions in the small print doesn't make it legal).

Depends on how the site worked. For instance, look at Twitter - everything is public by default unless you go to your profile and check a box that says "Make my account private", and then nobody can follow you.

Are you saying it would be a breach of privacy for Twitter to provide a zipfile containing all of my tweets I've ever made publicly? Which any person could get anyways by searching @myname site:twitter.com ?

mef• 14 years ago

Site seems to be down. Google cache http://webcache.googleusercontent.com/search?sourceid=chrome...

cristinacordova5• 14 years ago

sorry, trying to get it back up.

cristinacordova5• 14 years ago

It should be back up now.

ZanderEarth32• 14 years ago

I never used Oink, but was there an option when creating an account to make it a private account, limiting access to certain types of data to certain users? If not, isn't everyone's uploads, reviews, pictures, etc. already available for anyone to see? Even if this is true, this still shouldn't be happening.

cageyjames4• 14 years ago

Privacy should always be the number one concern with apps and websites. This is simply just sloppy.

siculars• 14 years ago

Not when everything you put in is Public.

cageyjames4• 14 years ago

Respect your users.

filipmares• 14 years ago

it was public on the site, not browseable. you needed to know the explicit url to your profile. there simply was no structure for it.

Karunamon3• 14 years ago

>Privacy should always be the number one concern with apps and websites.

Yeah! Forget making a good product that fills a societal need that people will love, privacy is more important than all of that!

cageyjames4• 14 years ago

Actually protecting the users should be. Maybe because I'm a Dad makes me lame like my father was before me, but...

harryf• 14 years ago

Filed under "How to make shutting down your service a memorable event"

donohoe• 14 years ago

Relevant piece for those who can't access the page:

  So, curiously, I tried replacing my username 
  with Kevin Rose’s:

http://oink-prod.s3.amazonaws.com/kevinrose-export.zip

  (go ahead, click it). You’ll get a zip file 
  of every item he has ever added, rated or
  reviewed. You’ll also get every photo he has
  ever uploaded to Oink.

samstave• 14 years ago

Looking at all the pics that Kevin has uploaded made me incredibly hungry. He has eaten some nice looking meals.

smackfu• 14 years ago

Ha. I thought the download service was pretty clever and well put together, but didn't notice that the link they gave you wasn't anonymized.

tonywebster• 14 years ago

I noticed this when I did my export as well, but when I saw the data, it was only public information. But makes for a good headline for this blogger it seems.

HectorRamos2• 14 years ago

Twitter's privacy breach: read the timeline of any (non-Protected) user by navigating to http://www.twitter.com/{username}

dolinsky2• 14 years ago

update2 - Apparently some usernames work and others don't

I believe his account is the only one that is made public. Obtaining a list of usernames is as easy as a 'site:oink.com' search in google.

curl -I http://oink-prod.s3.amazonaws.com/kevinrose-export.zip

    HTTP/1.1 200 OK
    x-amz-id-2: 9lLlixkcIypVbEIPzp7lmAT3gqwxFS3h99pdgnipW5aZVmhy422YA06OaMT7KOXd
    x-amz-request-id: E6D61A351A455807
    Date: Fri, 16 Mar 2012 17:23:28 GMT
    Last-Modified: Fri, 16 Mar 2012 17:22:17 GMT
    ETag: "799ee5f116bed2fac2893dda920a987a"
    Accept-Ranges: bytes
    Content-Type: application/zip
    Content-Length: 65492507
    Server: AmazonS3

curl -I http://oink-prod.s3.amazonaws.com/thebucknutz-export.zip

    HTTP/1.1 403 Forbidden
    x-amz-request-id: D3BF734D33B46816
    x-amz-id-2: exsDFYH6AcczbNuZWnlFW86EO9SP8EpwMDSwx9dGjSl9A24f3jXBobTRgOw+XNrC
    Content-Type: application/xml
    Transfer-Encoding: chunked
    Date: Fri, 16 Mar 2012 17:23:37 GMT
    Server: AmazonS3

update - seems that she had some success with links last night. Looks like they've fixed perms in the meantime.

https://twitter.com/#!/cristinacordova/statuses/180708226696...

joliveira• 14 years ago

Maybe that user is not available anymore or something else because if you try to download cristina-export.zip it sure works.

dolinsky2• 14 years ago

Indeed it does.

curl -I http://oink-prod.s3.amazonaws.com/cristina-export.zip

    HTTP/1.1 200 OK
    x-amz-id-2: gIfqnrhzuVR2HJIhT8Msk37Pp96qabi6Amtq6ZG9makBlT/d5z+bYivF27tac16v
    x-amz-request-id: 9A1C02D63152317A
    Date: Fri, 16 Mar 2012 17:47:27 GMT
    Last-Modified: Fri, 16 Mar 2012 06:09:58 GMT
    ETag: "6326a2bc6724b1566530f34f5d96bf26"
    Accept-Ranges: bytes
    Content-Type: application/zip
    Content-Length: 212717
    Server: AmazonS3

Wouldn't take much for someone to whip up a script to parse the search results to build a list of usernames to bounce off of. There's also a fair amount of item-specific data too.

HectorRamos2• 14 years ago

You need to first trigger the export from the website, THEN the zip will be available for download.

benatkin2• 14 years ago

alright this is just sloppy then ಠ_ಠ

joshmattvander• 14 years ago

It definitely still works. The user has to have requested the link for the file to exist.

I requested mine, so as you can guess it is downloadable by anyone.

http://oink-prod.s3.amazonaws.com/joshmattvander-export.zip

kmfrk• 14 years ago

Can you going to a restaurant and see your friends pull out their iPhone to snap photos of everything they eat and drink? I'd want to smack them at the back of their head.

Good riddance to products like Oink, if it fosters habits like Rose's, if his photos are anything to go by.

brown9-2• 14 years ago

Btw, what was Oink about? I'd never heard of it before it was shut down and this Google story, so it's hard to find out anything about what the app actually was. They seem to be getting a lot more attention post-shutdown than pre.

km3k• 14 years ago

According to Oink's twitter account, "All of the data is and was publicly available."

https://twitter.com/#!/oinkapp/status/179981032416755712

kirbysayshi• 14 years ago

I thought some weird cache from Oink's Pink Palace was found! Hadn't heard of this Oink until now.

InclinedPlane• 14 years ago

Well, if there's a silver lining to this it's a good thing the development team behind that product isn't going anywhere where data privacy breaches could be a big deal.

benatkin2• 14 years ago

Whether or not it's public content and the privacy policy says it is, Oink botched it.

If they were going to release all the data they should have said so.

The archives not being generated until a user triggers the export indicates to me that it's just sloppy coding.

icebraining3• 14 years ago

If they were going to release all the data they should have said so.

They didn't release anything new - all the data was already accessible from their website, and users were aware of that. They just made a zip out of it.

stickfigure• 14 years ago

All the data is public. You could probably get it in a less concise form from Google.

There is no story here, other than "Oink allows the public to download public data".

ig12• 14 years ago

Flagged because the title is misleading and unfairly besmirches the Oink team. All the data was public in the first place.

EDIT: The title has been changed to something reasonable so I've unflaged it.

cristinacordova5• 14 years ago

Do you mean you changed the title? I certainly didn't as I'm now blocked from editing the title of my own submission. Also, the post seems to still be flagged.

ig12• 14 years ago

Presumably one of the mods changed it

joshaidan• 14 years ago

I understand most of the data was public anyway, but why not at the very least use a randomly generated string instead of your username?

Download Public User Data with Oink's Export Tool

Related Stories