Risk
1/17/2013
12:13 PM
Connect Directly
RSS
E-Mail
50%
50%

OKCupid Blind Date App: Beware Privacy Flub

OKCupid.com smartphone app promised safe blind date arrangement, but API failed to hide sensitive information about users.

Smartphone users looking for love online may have gotten more than they bargained for.

Online dating site OkCupid.com Tuesday launched a new app, dubbed Crazy Blind Date, that promises to use "math to set singles up on blind dates with only a few hours notice."

"We hide your date's identity," reads the pitch for the service, which is available via both an iPhone and Android app. "Don't worry, their face won't be scrambled in real life."

Unfortunately, OkCupid -- which was bought in 2011 by Match.com owner IAC/InterActiveCorp for $50 million in cash -- failed to scramble the app's data feed. According to a Wall Street Journal investigation, the app's API could also be used by outsiders to expose any user's email address and birthdate, as well as their first name, gender and actual photo.

[ Businesses that rely on Java must now take additional steps to keep employees safe. 10 Facts: Secure Java For Business Use. ]

"It was essentially a typo, and really inadvertent," OkCupid CEO Sam Yagan told a Journal reporter, who Tuesday was apparently the first to inform the company of the vulnerability. Yagan said there was no evidence that anyone had hacked the OkCupid feed -- which would have required only sniffing the app's Web traffic -- before OkCupid put a fix in place later that day. The fix restricts the API to only transmit a user ID, subscriber's first name, gender and profile photo, as well as their desired partner's gender.

In light of the information that still gets transmitted, Ars Technica recommended that Crazy Blind Date users employ a unique email address for the service and also fudge their birthdate by at least a few days to make it difficult for overzealous blind daters -- or anyone else -- to positively identify them via the smartphone app.

In other online dating and privacy-related news, Canadian real estate developer -- and Ferrari lover -- Lorne Leibel last week saw his temporary injunction against his ex-girlfriend, Michelle Vrasic, get dismissed, except for a "no contact" provision remaining in effect between the pair.

Leibel had sued Vrasic for defamation, cyberstalking and violating his privacy after she authored an unflattering website and book about him. According to a Florida District Court of Appeal ruling, "some years after the end of their romantic relationship, Leibel sued Vrasic, alleging that, in the intervening years, [Vrasic] had engaged in a pattern of harassment, i.e., she hacked into his email -- sending offensive letters and a naked photograph of him to those on his contact list -- and created a website, using his name, to pre-sell her book and to post an excerpt that included defamatory statements about him."

"Vrasic didn't challenge the no-contact order, but challenged the injunction, and the court held that the injunction violated the First Amendment," said UCLA law professor Eugene Volokh in a blog post. He said that the ruling "strikes me as quite correct," especially since the injunction had been issued before the trial, and wasn't based on merit.

But for anyone who seeks to publish a tell-all about a former partner online or in book form, beware. "These sorts of restrictions on speech about a person have become more common in trial courts in the last several years," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Listen Now Botnet Takedowns: Who's Winning, Who's Losing
Sara Peters hosts a conversation on Botnets and those who fight them.