Risk
1/17/2013
12:13 PM
50%
50%

OKCupid Blind Date App: Beware Privacy Flub

OKCupid.com smartphone app promised safe blind date arrangement, but API failed to hide sensitive information about users.

Smartphone users looking for love online may have gotten more than they bargained for.

Online dating site OkCupid.com Tuesday launched a new app, dubbed Crazy Blind Date, that promises to use "math to set singles up on blind dates with only a few hours notice."

"We hide your date's identity," reads the pitch for the service, which is available via both an iPhone and Android app. "Don't worry, their face won't be scrambled in real life."

Unfortunately, OkCupid -- which was bought in 2011 by Match.com owner IAC/InterActiveCorp for $50 million in cash -- failed to scramble the app's data feed. According to a Wall Street Journal investigation, the app's API could also be used by outsiders to expose any user's email address and birthdate, as well as their first name, gender and actual photo.

[ Businesses that rely on Java must now take additional steps to keep employees safe. 10 Facts: Secure Java For Business Use. ]

"It was essentially a typo, and really inadvertent," OkCupid CEO Sam Yagan told a Journal reporter, who Tuesday was apparently the first to inform the company of the vulnerability. Yagan said there was no evidence that anyone had hacked the OkCupid feed -- which would have required only sniffing the app's Web traffic -- before OkCupid put a fix in place later that day. The fix restricts the API to only transmit a user ID, subscriber's first name, gender and profile photo, as well as their desired partner's gender.

In light of the information that still gets transmitted, Ars Technica recommended that Crazy Blind Date users employ a unique email address for the service and also fudge their birthdate by at least a few days to make it difficult for overzealous blind daters -- or anyone else -- to positively identify them via the smartphone app.

In other online dating and privacy-related news, Canadian real estate developer -- and Ferrari lover -- Lorne Leibel last week saw his temporary injunction against his ex-girlfriend, Michelle Vrasic, get dismissed, except for a "no contact" provision remaining in effect between the pair.

Leibel had sued Vrasic for defamation, cyberstalking and violating his privacy after she authored an unflattering website and book about him. According to a Florida District Court of Appeal ruling, "some years after the end of their romantic relationship, Leibel sued Vrasic, alleging that, in the intervening years, [Vrasic] had engaged in a pattern of harassment, i.e., she hacked into his email -- sending offensive letters and a naked photograph of him to those on his contact list -- and created a website, using his name, to pre-sell her book and to post an excerpt that included defamatory statements about him."

"Vrasic didn't challenge the no-contact order, but challenged the injunction, and the court held that the injunction violated the First Amendment," said UCLA law professor Eugene Volokh in a blog post. He said that the ruling "strikes me as quite correct," especially since the injunction had been issued before the trial, and wasn't based on merit.

But for anyone who seeks to publish a tell-all about a former partner online or in book form, beware. "These sorts of restrictions on speech about a person have become more common in trial courts in the last several years," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

CVE-2015-0802
Published: 2015-04-01
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a p...

CVE-2015-0803
Published: 2015-04-01
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) ...

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.