6 ms·
> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my websit
by ctoth 5y ago
> It also occurred to me that if I redirected my website to the CSRF link that automatically sent a message to me, I could see the OkCupid profiles of my website visitors who were logged into okcupid.com, which would make for an intense web analytics tool.
Ouch.
- llampx 5y agoThe Data Protection Agency loves this weird trick!
- Teever 5y agoI learned recently that if someone forwards you the email that OKC sends them alerting them to a new message and you click on it you gain passwordless access to their account. I contacted OKC about this but they said that it was not an issue.
- nicoburns 5y agoThis isn't ideal, but why would anyone forward this kind of email?
- thih9 5y agoI guess when an adversary knows about the feature and uses some social engineering against the user?
- EpicEng 5y agoIn order to get access to their... OkCupid account? Not sure that I care.
- kfrzcode 5y agoEveryone's got something to hide somewhere.
- wizzwizz4 5y agoImagine https://www.wired.com/2017/01/grinder-lawsuit-spoofed-accounts/ https://www.wired.com/2017/01/grinder-lawsuit-spoofed-accoun..., without the spoofing.
- Johnny555 5y agoYou might care if you were married and using OKCupid to find a girlfriend. You may say that getting exposed for trying to have an affair is a good thing, but that's a still a reason why someone may care how secure their OKCupid activity is.
- shakna 5y agoCertain sexual behaviours are outlawed in certain nations. And may result in death or long incarceration times. In other nations, it may not be strictly illegal, but is more than enough information that, if publicly released, would result in death threats and other social pressures.
- entropicdrifter 5y agoThe email itself could be intercepted, could it not?
- Johnny555 5y agoI might forward it to a friend to ask if that's the girl he dated last week, without meaning to give him passwordless access to my account.
- jmnicolas 5y agoA good way to know if he is really your friend ;)
- DJBunnies 5y agoLots of sites do this, it’s a feature for the majority of users who prefer convenience over security.
- cmckn 5y agoI find that passwordless links usually expire after 1 use or some amount of time; generating eternal alt-passwords for an OkCupid account in every message notification email seems pretty heinous.
- AlchemistCamp 5y agoGmail now pretty much breaks single-use tokens in links because it consumes them itself after a user clicks on them, but before redirecting the user to the site. It's an unfortunate change that has made single-use links a worse UX and less popular in the last couple of years.
- gbl08ma 5y agoThis sounds like it would break a bunch of email address verification systems, password recovery links and the like. I wonder if indeed it does break them, but since it only affects smaller websites nobody seems to care.
- AlchemistCamp 5y ago> "This sounds like it would break a bunch of email address verification systems, password recovery links and the like." This is exactly the pain I've experienced with my own site, https://alchemist.camp https://alchemist.camp I've manually tested it and seen the token consumed when clicking the link via gmail but had no issues when copying the link from the password reset email to a gmail account. A second manual tester confirmed the same, as have multiple support cases. Password recovery links sporadically fail for gmail users. I had to add extra instructions to copy and paste rather than click through the link and am in the process of moving away from single-use tokens because a lot of people still click before reading those instructions and email me for support. My increased customer support burden isn't something Gmail PMs worry about, but they may whitelist some larger service's emails.
- simonw 5y agoThat's shocking! Really surprised that they don't see this as an issue, I would expect that it's trivial to social engineer someone into forwarding you one of those emails.
- AnIdiotOnTheNet 5y agoMaybe, but how much value is there in taking over people's OKCupid account?
- rootsudo 5y agoYou'd be surprised, alot - but I'd wager it's easier to just save the photos and open up your own honeypot that way. But the messages could be interesting.
- rendall 5y agoSomeone I knew once sent me an urgent direct message over Twitter that they were stranded in the City of London and needed me to wire money. Phone gone, computer stolen, they could only communicate by Twitter. Of course it wasn't actually my friend, but a 2-bit hacker. But if they were to collect enough accounts and message enough people, someone might bite. Maybe someone would give up something truly valuable if they really thought it was someone they cared about, a long lost son, or a pined-for ex.
- kfrzcode 5y agoThe value is relative to motivation, I'd posit
- Johnny555 5y agoIf there's no value or downside to someone taking over my OKCupid account, why have a password on it in the first place?
- yunohn 5y agoThis is a horrible take, obviously there’s different levels of security and risk associated with everything.