3 ms·

Worse still, it seems likely that they were using data that wasn't actually public: Their paper reveals that initially they designed a bot to scrape profile da

Worse still, it seems likely that they were using data that wasn't actually public: Their paper reveals that initially they designed a bot to scrape profile data, but that this first method was dropped because it was “a decidedly non-random approach to find users to scrape because it selected users that were suggested to the profile the bot was using.” This implies that the researchers created an OkCupid profile from which to access the data and run the scraping bot. Since OkCupid users have the option to restrict the visibility of their profiles to logged-in users only, it is likely the researchers collected—and subsequently released—profiles that were intended to not be publicly viewable.

AdmiralAsshat 10y ago
Oh, I'm quite sure it wasn't public. I had an OkCupid profile at one time (thankfully deleted, and even then it had no identifying details and was linked to a dummy email), and the only reason I agreed to sign up was the site's assurance that absolutely NOTHING was publicly visible unless you had a profile. So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.
- deleted 10y ago
  [deleted]
- sinxoveretothex 10y ago
  It seems to me that the problem here is that you were assured that things weren't public. In that sense, I would say that OKCupid should be sued. I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
  - MasterScrat 10y ago
    From https://www.okcupid.com/legal/terms https://www.okcupid.com/legal/terms: "You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."
greeneggs 10y ago
Also, the way OkCupid works, you can answer questions either privately or publicly. Even when you answer a question publicly, it is still only visible to other users who have answered the same question. Privately answered questions are never visible, but are used in calculating the "percent match" between two users. So I would presume that they started their scraping bot with fake answers to every single question. This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)

AdmiralAsshat 10y ago

Oh, I'm quite sure it wasn't public. I had an OkCupid profile at one time (thankfully deleted, and even then it had no identifying details and was linked to a dummy email), and the only reason I agreed to sign up was the site's assurance that absolutely NOTHING was publicly visible unless you had a profile. So, yeah, at the risk of breaking my attempted objectivity, I'd be personally thrilled if the guy got sued.

deleted 10y ago
[deleted]
sinxoveretothex 10y ago
It seems to me that the problem here is that you were assured that things weren't public. In that sense, I would say that OKCupid should be sued. I mean, sure, academics might get stopped by lawsuits. Russian social engineering hackers won't though.
- MasterScrat 10y ago
  From https://www.okcupid.com/legal/terms https://www.okcupid.com/legal/terms: "You should appreciate that all information submitted on the Website might potentially be publicly accessible. Important and private information should be protected by you. We are not responsible for protecting, nor are we liable for failing to protect, the privacy of electronic mail or other information transferred through the Internet or any other network that you may utilize."

greeneggs 10y ago

Also, the way OkCupid works, you can answer questions either privately or publicly. Even when you answer a question publicly, it is still only visible to other users who have answered the same question. Privately answered questions are never visible, but are used in calculating the "percent match" between two users. So I would presume that they started their scraping bot with fake answers to every single question. This is of course a kind of "privacy by obscurity," and it is not at all secure. For example, if you want you can probably figure out people's answers to all questions, even the private ones, by having a separate bot for every question. Then the percent match between the bot and a user reveals the user's answer to that one question. (Possibly OkCupid introduces some noise in the matching algorithm to make this harder, but it can almost certainly be circumvented.)