Risk
1/17/2013
12:13 PM
50%
50%

OKCupid Blind Date App: Beware Privacy Flub

OKCupid.com smartphone app promised safe blind date arrangement, but API failed to hide sensitive information about users.

Smartphone users looking for love online may have gotten more than they bargained for.

Online dating site OkCupid.com Tuesday launched a new app, dubbed Crazy Blind Date, that promises to use "math to set singles up on blind dates with only a few hours notice."

"We hide your date's identity," reads the pitch for the service, which is available via both an iPhone and Android app. "Don't worry, their face won't be scrambled in real life."

Unfortunately, OkCupid -- which was bought in 2011 by Match.com owner IAC/InterActiveCorp for $50 million in cash -- failed to scramble the app's data feed. According to a Wall Street Journal investigation, the app's API could also be used by outsiders to expose any user's email address and birthdate, as well as their first name, gender and actual photo.

[ Businesses that rely on Java must now take additional steps to keep employees safe. 10 Facts: Secure Java For Business Use. ]

"It was essentially a typo, and really inadvertent," OkCupid CEO Sam Yagan told a Journal reporter, who Tuesday was apparently the first to inform the company of the vulnerability. Yagan said there was no evidence that anyone had hacked the OkCupid feed -- which would have required only sniffing the app's Web traffic -- before OkCupid put a fix in place later that day. The fix restricts the API to only transmit a user ID, subscriber's first name, gender and profile photo, as well as their desired partner's gender.

In light of the information that still gets transmitted, Ars Technica recommended that Crazy Blind Date users employ a unique email address for the service and also fudge their birthdate by at least a few days to make it difficult for overzealous blind daters -- or anyone else -- to positively identify them via the smartphone app.

In other online dating and privacy-related news, Canadian real estate developer -- and Ferrari lover -- Lorne Leibel last week saw his temporary injunction against his ex-girlfriend, Michelle Vrasic, get dismissed, except for a "no contact" provision remaining in effect between the pair.

Leibel had sued Vrasic for defamation, cyberstalking and violating his privacy after she authored an unflattering website and book about him. According to a Florida District Court of Appeal ruling, "some years after the end of their romantic relationship, Leibel sued Vrasic, alleging that, in the intervening years, [Vrasic] had engaged in a pattern of harassment, i.e., she hacked into his email -- sending offensive letters and a naked photograph of him to those on his contact list -- and created a website, using his name, to pre-sell her book and to post an excerpt that included defamatory statements about him."

"Vrasic didn't challenge the no-contact order, but challenged the injunction, and the court held that the injunction violated the First Amendment," said UCLA law professor Eugene Volokh in a blog post. He said that the ruling "strikes me as quite correct," especially since the injunction had been issued before the trial, and wasn't based on merit.

But for anyone who seeks to publish a tell-all about a former partner online or in book form, beware. "These sorts of restrictions on speech about a person have become more common in trial courts in the last several years," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.