4 ms·

When asked whether the researchers attempted to anonymize the dataset, Aarhus University graduate student Emil O. W. Kirkegaard, who was lead on the work, repli

When asked whether the researchers attempted to anonymize the dataset, Aarhus University graduate student Emil O. W. Kirkegaard, who was lead on the work, replied bluntly: “No. Data is already public.” The guy seems completely unrepentant to even the idea that he might be violating people's privacy.

oarsinsync 11y ago
Worse still, it seems likely that they were using data that wasn't actually public: Their paper reveals that initially they designed a bot to scrape profile data, but that this first method was dropped because it was “a decidedly non-random approach to find users to scrape because it selected users that were suggested to the profile the bot was using.” This implies that the researchers created an OkCupid profile from which to access the data and run the scraping bot. Since OkCupid users have the option to restrict the visibility of their profiles to logged-in users only, it is likely the researchers collected—and subsequently released—profiles that were intended to not be publicly viewable.
- AdmiralAsshat 11y ago
  Oh, I'm quite sure it wasn't public. I had an OkCupid profile at one time (thankfully deleted, and even then it had no identifying details and was linked to a dummy email), and the only reason I agreed to sign up was the site's assurance that absolutely NOTHING was publicly visible unless you had a profile. So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.
  - deleted 11y ago
    [deleted]
  - sinxoveretothex 11y ago
    It seems to me that the problem here is that you were assured that things weren't public. In that sense, I would say that OKCupid should be sued. I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
    - MasterScrat 11y ago
      From https://www.okcupid.com/legal/terms https://www.okcupid.com/legal/terms: "You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."
- greeneggs 11y ago
  Also, the way OkCupid works, you can answer questions either privately or publicly. Even when you answer a question publicly, it is still only visible to other users who have answered the same question. Privately answered questions are never visible, but are used in calculating the "percent match" between two users. So I would presume that they started their scraping bot with fake answers to every single question. This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)
brudgers 11y ago
I am not sanctioning the behavior. However, the exposure of the data is no more [or less] a violation of privacy than what is typically reserved for operators under the terms and conditions of large websites. Neither is it more [or less] a violation of privacy than what is allowed by right when data is treated as a corporate asset [under US law] when ownership of the asset is transfered via sale or bankruptcy. To put it another way, it is only to the degree that it is in OkCupid's business interest to limit disclosure of the same data points that OkCupid [insert other any other corporation here] refrains from releasing that data. The only reason our visceral reactions are different is that we hold biologic people to a different standard of "doing the right thing" than the fictitious persons that are corporations. Legally, a person owned that data. That's why a breach was possible. It's the reification that creates the privacy problem.
- deleted 11y ago
  [deleted]
peatmoss 11y ago
> When contacted by Motherboard for comment, Kirkegaard was dismissive, stating he “would like to wait until the heat has declined a bit before doing any interviews. Not to fan the flames on the social justice warriors.” Yeah, this is a grad student who fails the maturity test in a big way. I could perhaps kind of understand the position that repackaging publicly available sensitive data was just a lapse in taste (assuming, likely erroneously, that it was truly public and not harvested by posing as a mate-seeker). Now he's equating blowback from this lapse with "social justice warriors"? This person sounds like an absolute peach.
oneloop 11y ago
This guy is the Martin Shkrelin of scraping: just as much of an asshole but less successful.

oarsinsync 11y ago

Worse still, it seems likely that they were using data that wasn't actually public: Their paper reveals that initially they designed a bot to scrape profile data, but that this first method was dropped because it was “a decidedly non-random approach to find users to scrape because it selected users that were suggested to the profile the bot was using.” This implies that the researchers created an OkCupid profile from which to access the data and run the scraping bot. Since OkCupid users have the option to restrict the visibility of their profiles to logged-in users only, it is likely the researchers collected—and subsequently released—profiles that were intended to not be publicly viewable.

AdmiralAsshat 11y ago
Oh, I'm quite sure it wasn't public. I had an OkCupid profile at one time (thankfully deleted, and even then it had no identifying details and was linked to a dummy email), and the only reason I agreed to sign up was the site's assurance that absolutely NOTHING was publicly visible unless you had a profile. So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.
- deleted 11y ago
  [deleted]
- sinxoveretothex 11y ago
  It seems to me that the problem here is that you were assured that things weren't public. In that sense, I would say that OKCupid should be sued. I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
  - MasterScrat 11y ago
    From https://www.okcupid.com/legal/terms https://www.okcupid.com/legal/terms: "You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."
greeneggs 11y ago
Also, the way OkCupid works, you can answer questions either privately or publicly. Even when you answer a question publicly, it is still only visible to other users who have answered the same question. Privately answered questions are never visible, but are used in calculating the "percent match" between two users. So I would presume that they started their scraping bot with fake answers to every single question. This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)

brudgers 11y ago

I am not sanctioning the behavior. However, the exposure of the data is no more [or less] a violation of privacy than what is typically reserved for operators under the terms and conditions of large websites. Neither is it more [or less] a violation of privacy than what is allowed by right when data is treated as a corporate asset [under US law] when ownership of the asset is transfered via sale or bankruptcy. To put it another way, it is only to the degree that it is in OkCupid's business interest to limit disclosure of the same data points that OkCupid [insert other any other corporation here] refrains from releasing that data. The only reason our visceral reactions are different is that we hold biologic people to a different standard of "doing the right thing" than the fictitious persons that are corporations. Legally, a person owned that data. That's why a breach was possible. It's the reification that creates the privacy problem.

deleted 11y ago
[deleted]

peatmoss 11y ago

> When contacted by Motherboard for comment, Kirkegaard was dismissive, stating he “would like to wait until the heat has declined a bit before doing any interviews. Not to fan the flames on the social justice warriors.” Yeah, this is a grad student who fails the maturity test in a big way. I could perhaps kind of understand the position that repackaging publicly available sensitive data was just a lapse in taste (assuming, likely erroneously, that it was truly public and not harvested by posing as a mate-seeker). Now he's equating blowback from this lapse with "social justice warriors"? This person sounds like an absolute peach.

oneloop 11y ago

This guy is the Martin Shkrelin of scraping: just as much of an asshole but less successful.