Risk
1/17/2013
12:13 PM
Connect Directly
RSS
E-Mail
50%
50%

OKCupid Blind Date App: Beware Privacy Flub

OKCupid.com smartphone app promised safe blind date arrangement, but API failed to hide sensitive information about users.

Smartphone users looking for love online may have gotten more than they bargained for.

Online dating site OkCupid.com Tuesday launched a new app, dubbed Crazy Blind Date, that promises to use "math to set singles up on blind dates with only a few hours notice."

"We hide your date's identity," reads the pitch for the service, which is available via both an iPhone and Android app. "Don't worry, their face won't be scrambled in real life."

Unfortunately, OkCupid -- which was bought in 2011 by Match.com owner IAC/InterActiveCorp for $50 million in cash -- failed to scramble the app's data feed. According to a Wall Street Journal investigation, the app's API could also be used by outsiders to expose any user's email address and birthdate, as well as their first name, gender and actual photo.

[ Businesses that rely on Java must now take additional steps to keep employees safe. 10 Facts: Secure Java For Business Use. ]

"It was essentially a typo, and really inadvertent," OkCupid CEO Sam Yagan told a Journal reporter, who Tuesday was apparently the first to inform the company of the vulnerability. Yagan said there was no evidence that anyone had hacked the OkCupid feed -- which would have required only sniffing the app's Web traffic -- before OkCupid put a fix in place later that day. The fix restricts the API to only transmit a user ID, subscriber's first name, gender and profile photo, as well as their desired partner's gender.

In light of the information that still gets transmitted, Ars Technica recommended that Crazy Blind Date users employ a unique email address for the service and also fudge their birthdate by at least a few days to make it difficult for overzealous blind daters -- or anyone else -- to positively identify them via the smartphone app.

In other online dating and privacy-related news, Canadian real estate developer -- and Ferrari lover -- Lorne Leibel last week saw his temporary injunction against his ex-girlfriend, Michelle Vrasic, get dismissed, except for a "no contact" provision remaining in effect between the pair.

Leibel had sued Vrasic for defamation, cyberstalking and violating his privacy after she authored an unflattering website and book about him. According to a Florida District Court of Appeal ruling, "some years after the end of their romantic relationship, Leibel sued Vrasic, alleging that, in the intervening years, [Vrasic] had engaged in a pattern of harassment, i.e., she hacked into his email -- sending offensive letters and a naked photograph of him to those on his contact list -- and created a website, using his name, to pre-sell her book and to post an excerpt that included defamatory statements about him."

"Vrasic didn't challenge the no-contact order, but challenged the injunction, and the court held that the injunction violated the First Amendment," said UCLA law professor Eugene Volokh in a blog post. He said that the ruling "strikes me as quite correct," especially since the injunction had been issued before the trial, and wasn't based on merit.

But for anyone who seeks to publish a tell-all about a former partner online or in book form, beware. "These sorts of restrictions on speech about a person have become more common in trial courts in the last several years," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-4514
Published: 2014-10-21
Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.