9 ms·
OkCupid's “Removed” Visitor API
- nukeop 8y agoI never get it why people who discover secrets like these make extra sure nobody else can ever enjoy them again. Just use the undocumented feature and don't make a big thing out of it. This way it's ruined for everybody, and they get nothing in return, except for some HN points on their blog post.
- aleontiev 8y agoNot sure if sarcasm or stalker enthusiast
- blattimwind 8y agoWhy come out with an ad hominem? You could just say "data enthusiast" ("I like big datas and I cannot lie").
- reimertz 8y agoDon't know if you're sarcastic, but I prefer privacy related issues like this to be surfaced and would call it morally wrong not doing so.
- nukeop 8y agoThere would be no privacy issues if the users did not give up that private data willingly in the first place. A-ok with random company on the internet having access to it, but suddenly other random parties exploiting it are "creepy"? It was being shared with advertisers and analytics providers anyway.
- saagarjha 8y ago> It was being shared with advertisers and analytics providers anyway. That doesn't make it acceptable in any way.
- josephwegner 8y agoThis is not an unintended feature - it is a gaping privacy gap. That data is not intended to be public, and is in fact dangerous when made public. It's _especially_ creepy that this detailed data is available to someone who has unsuccessfully interacted with you on a dating website. All that aside from this likely being against the terms & conditions provided by OkCupid, meaning their user's data was being used against the contractual limits. There was no real-world case where this data was useful in a non-creepy way.
- UncleEntity 8y ago> ...and they get nothing in return, except for some HN points on their blog post. And, you know, some increased measure of privacy. For some odd reason people seem to be concerned about all the private data they (willingly) give to these corporations leaking outside of the corporation proper as if it's a violation of their (misplaced) trust or something. Lots of that going around recently for...reasons.
- notananthem 8y agoThis sort of comment is in line with their post history so no, likely not sarcasm.
- nukeop 8y agoWho are you?
- saagarjha 8y ago> it's ruined for everybody I'd prefer that it was. This is clearly something that leaks personal information.
- nitwit005 8y agoObviously a hidden feature of OkCupid for matching security researchers.
- CrowderSoup 8y agoThe thing that impresses me most is how quickly OkCupid removed public access to that API.
- rhizome 8y agoEh, comment out a route and deploy.
- _asummers 8y agoThat's only true if there was nothing internally relying on it.
- digitalpacman 8y agoedge route blocking doesn't take a deploy
- Waterluvian 8y agoWhitelist internals and deploy? It may be impressively fast or unimpressively simple. We won't know for sure.
- _asummers 8y agoAbsolutely. But imagine e.g. a mobile app that uses that API. That's a harder change to propagate. That's pure speculation though, as you said. We have no idea.
- nikanj 8y agoComment out and redeploy, fixing the other features is a lot less urgent issue.
- recursive 8y agoThat's all well and good for a tech demo, but things rarely seem to be that simple in systems as big/old as OkCupid. I guess this time, it was.
- throwafk81 8y ago>birthdate is a data point which is considered part of Personally Identifiable Information / Personal Data in many countries. I am far from being a lawyer, but OKCupid should be concerned with regulations like the GDPR approaching soon. >This may not be as appalling as Grindr’s reporting of HIV status to third parties. It might not be as powerful and widespread as the data used in the Cambridge Analytica Debacle. But that’s not the point. It indeed is not the point so I don’t know why you felt compelled to write two loosely related paragraphs about how cool you are because you follow the news.
- zdware 8y agoHey, thanks for reading. The point I was trying to make is that we need to hold everyone to be accountable / secure. Just because no one is actively exploiting the data in a huge fashion (ie. Cambridge Analytica) doesn't mean it we should let go. I'm terrible at following the news by the way :(
- Implicated 8y agoDon't waste your time feeding throwaway trolls.
- zdware 8y agogood point!
- jakobegger 8y agoWhere does the „body type“ data come from? Do they ask you for your weight when you sign up?
- toomuchtodo 8y agoYou specify it as part of your profile. If you pay for A-List (paid plan), you can filter potential matches by body type. Disclosure: Paying OKCupid customer. I don't mind paying to support the service, it's provided ongoing value to us.
- corobo 8y agoI have to wonder how effective paying for a dating site really is. Presumably if you find a partner through the site you stop paying? Aside from a token few they can blog about, what's their incentive to be successful?
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- derefr 8y agoIf you use it for (monogamous, long-term) dating, sure. OKC also supports short-term dating/hookups and polyamorous “looking for secondaries” use-cases, though, and such searches are indefinite—finding someone doesn’t make you any less interested in finding more someones.
- Implicated 8y agoLikely depends on the type of partner you're seeking/find. Those who are seeking committed long term relationships, yes, likely cancel. Those who are seeking short-term/multiple relationships and would like a revolving door of them... subscriptions continue to renew. Probably has a lot to do with the price points between 'casual' dating sites/apps like Tinder and OKCupid compared to something 'more serious' like https://www.itsjustlunch.com/ https://www.itsjustlunch.com/ - where it _starts_ at $2,800.
- Implicated 8y agoHow does this even happen? How can the developers behind an endpoint like this not confirm/test that it requires permissions/authentication to consume? (I mean, look at all that data...) Amateurs I can understand - but OKCupid has been around long enough they shouldn't be employing people of that nature. Is there no code review process? This is just nuts.
- deleted 8y ago[deleted]
- saudioger 8y agoIt's easy to fall into this: It works so no one complains.
- deleted 8y ago[deleted]
- icedchai 8y ago"Visitors" was actually a feature up until a few months back. They probably removed it from the front-end, but left it in the back-end. This is very, very common. There would be not much to "review."
- tytytytytytytyt 8y agoIt's certainly not outlandish that this happened. Have you never been employed as a programmer?
- Implicated 8y agoI am, and have been. That's why it's so outlandish to me - I keep user data in mind all the time. Finding out you're leaking sensitive personal data is a slippery slope I (nor my clients) want to go down. Are you implying that it's not outlanding for professional programmers to not have these things in mind?
- Fifer82 8y agoI can only speak for myself, having never worked for massive clients with deep pockets. I care more than my employers. "does spending time on that make moniez?" "I mean...." "Then no, let's do that cool loading spinner as it is all about user experience".
- odammit 8y agoI dated on okc for a few years. I hate driving (LA) and so I frequently filtered my matches to 5 miles (if I recall that was the smallest radius). 5 miles in LA can be a long drive. So I wrote a chrome plugin to add additional drop down options of 0.1, 0.5 and 1 mile. I was surprised to see it work. It was awesome. There is also a hack to get the infamous “top X% of hottest people” feature unlocked... :)
- swang 8y agoyeah it was easy to modify it in the query string.
- Thriptic 8y agomind elaborating?
- extra88 8y agoI assume they mean the radius was a parameter in the URL so changing it was easy, e.g. replace &search_radius=5 with &search_radius=1.
- Thriptic 8y agoWhat I'm asking is what parameter are they changing to look at the hottest people.
- odammit 8y agoIt wasn’t a parameter but a trick. This is a little fucked up: You go through their rating game where you can rate people 1 to 5 stars. (Optional): You rate everyone you find attractive five stars no matter how attractive because you’re going to need a way to differentiate later... Go through and rate a bunch of ugly people four stars. A shit load. When you get rated four stars or higher you get a notification. Those people usually come back and rate you. Hopefully four stars or higher. So now you’ve crowd sourced ugly people to say you’re good looking but that ugly person is never going to get the feature turned on for them because nobody else is saying they’re good looking. Now you show up to the hottest people and the hottest people show up to you. I’ve done this a few times over the years with burner accounts to test it and new accounts just because I canceled an old one. It takes a few hours of rating unattractive people. I usually just did it flipping through on the toilet for about a week. If you don’t care about keeping track of the five star people you can just write a script to four or five star people at random And let it run overnight.
- waisbrot 8y ago> However, they gave no answer for why unnecessary data was being provided. I mean, it was obviously a bug, right? I imagine the only "explanation" would involve detailing the origin and nature of the bug which would be unwise until they've gone through all their other endpoints to ensure that there's not another instance of this same information leaking.
- notimetorelax 8y agoI don’t think that this was a bug. Most probably, they have those DTO objects for viewing and editing. In that scenario the correct thing to do would be to create a new DTO object that exposes only the necessary information, but this is an extra effort.
- brosner 8y agoAbout seven years ago I met my wife on OkCupid. The only reason why I messaged her back (after had messaging with her several months earlier) was because of the frontend visitor feature. She had visited my profile randomly again. Turns out she said she accidentally clicked on to my profile intended to see someone else. I haven't used OkC since then, but I thought I'd share that in the context of this blog post ;-)
- deleted 8y ago[deleted]
- alexandre_m 8y agoOne day when you have kids, you can tell them "you are the result of a mistaken web click"
- Aaargh20318 8y agoIf, not when. Children are optional. Pet peeve of mine, but too many people don't even think about it and just procreate because it's part of the Standard Life Script™.
- alexandre_m 8y ago"When" can be conditional too :)
- ksk 8y ago> but too many people don't even think about it and just procreate because it's part of the Standard Life Script As is their right, and not to mention biological imperative. Ironically, people not wanting kids, will be marginalized in the gene pool (assuming the trait is genetic). But yeah, overpopulation, unsustainable food needs, etc, etc. To paraphrase Dr. House, M.D. - "There are only two things people get stupid for - Money and Sex" :P
- kahnpro 8y agoWell, the entire application is built with the purpose of guiding users into this choice. It's at the point where the longer you've run the application without procreating, the stronger the manipulation becomes. Even people running the application in Gay Mode or loading other modules using the Gender Extension APIs run into this problem.
- i386 8y ago"stalk_time" makes me feel very uncomfortable. Names matter.
- cbluth 8y agoIf it said "wash_time", then would you feel clean?
- goodside 8y agoThe original name of the feature actually was "stalkers" — that's how it was presented to users before 2010 or so. The site had a lot of dark humor then. The word "stalk" also works as a clarifying synonym for "visit" in the code because "visit" could refer e.g. to the user's visit to the site itself.
- zdware 8y agoThe payload for the visitor API payload was an object containing an array whose key was `stalkers`, so still the same!
- deleted 8y ago[deleted]
- Madmallard 8y agoOkcupid has been going downhill for years. Four years ago you could get matches on there even if you were average looking that werent way below your league and actually interact with a ton of people. in 2018 it is mostly bots and you wont get meaningful interaction really anymore. The tinder looks bias is also literally enforced at this point (only see messages from profiles you look at, only messaging matches). They have totally lost their way.