Adult Dating Site Hack Reveals Users' Sexual Preference, Extramarital Affairs 173
An anonymous reader notes this report from Channel 4 News that Adult FriendFinder, one of the largest dating sites in the world, has suffered a database breach that revealed personal information for 3.9 million of its users. The leaked data includes email addresses, IP addresses, birth dates, postal codes, sexual preferences, and information indicating which of them are seeking extramarital affairs. There even seems to be data from accounts that were supposedly deleted. Channel 4 saw evidence that there were plans for a spam campaign against these users, and others are worried that a blackmail campaign will follow. "Where you've got names, dates of birth, ZIP codes, then that provides an opportunity to actually target specific individuals whether they be in government or healthcare for example, so you can profile that person and send more targeted blackmail-type emails," said cybercrime specialist Charlie McMurdy.
oh no (Score:5, Funny)
Re: (Score:2)
Go to do a turkey dance? :P
Not really (Score:5, Funny)
Given that their list of choices for sexual preferences doesn't include tentacle-on-pregnant furry futanari, I think I'm pretty safe.
Re: (Score:1)
How could you protect against this? (Score:3)
You could encrypt all the data in the database, but that would only protect you from somebody able to access the database but not any of the decryption code (somewhat unlikely).
Assuming full access to the database and code, is there any way to protect against being able to link identification with the rest of the personal information.
I can only come up with the obvious client-side encryption, but will the network as a whole still be able to use the data as it's supposed to (in this case; find adult friends)?
Re:How could you protect against this? (Score:4, Interesting)
Why do you assume the hackers got everything, instead of just pulling a little jimmy droptables, hell all they really needed to get that info is read only access and a select all statement..
Re: (Score:1, Flamebait)
Re:How could you protect against this? (Score:4, Insightful)
How about:
a) not putting any kind of direct DB access in your website, using a middle tier layer (webservice?) to act as the DB access
b) not letting the middle tier server access the DB directly, instead having to go through stored procedures
c) basically not letting anyone run "select * from users" at all.
Security can be done, but as long as we have websites that think "webserver" means all the back-end processing has to be running in the web server whether its IIS or Apache, and frameworks that assume all development must be done in 1 web-server hosted language.... then we will continue to see security breaches like this.
You want to secure your site, split the web handling/presentation from the data processing, and the processing from the data extraction. Then slap as much security on the interfaces between these layers. Do not trust the webserver one bit. Assume the webserver is already hacked. Hell, do not trust the middle tier either - allow it only the limited data it needs for each part of the processing.
I've done the above, its not nearly as difficult as the webdevs will say.
Re: (Score:1)
Re: (Score:3)
You could do things like splitting email addresses off into a different database on a different server and just keeping a hash in the main one, but it's only mm marginally better. Basically you can't be both secure and provide this kind of service.
As well as the terrible male to female ratio (16:1) the other big issue here is that deleted accounts were not really deleted. The European Right to be Forgotten is designed to force companies operating in the EU to really delete accounts, and this illustrates why
Re: (Score:3)
The European Right to be Forgotten is designed to force companies operating in the EU to really delete accounts, and this illustrates why it is needed.
I think you're confusing two different things here. The "right to be forgotten", as much discussed recently with regard to Google and the like, is primarily about search engines digging up old information that would otherwise naturally fade into obscurity, and in particular the danger of finding old information that looks plausible but may in fact be misleading without context or now incorrect/outdated.
Sadly, most of us even in Europe still have rather limited rights to compel businesses not to store person
Re: (Score:3)
The search results thing is not the right to be forgotten. Some stupid journalists got confused and called it that, but that was actually just existing data protection rules dating back to the mid 90s.
The right to be forgotten is still being looked at, but basically will allow EU citizens to require companies to delete data supplied by them (accounts, uploaded photos etc.) on request. The data must really be deleted, not just marked as dormant or whatever.
Re: (Score:2)
The search results thing is not the right to be forgotten. Some stupid journalists got confused and called it that
Those "stupid journalists" appear to be in good company, starting with official press releases from both the European Commission and indeed the European Court of Justice itself about the 2010 Spanish newspaper case.
I would be the first to agree that moves towards a more powerful right to be forgotten such as you describe would be a good idea, but as of today, these are mostly just proposals. For example, while there is already a right under some limited circumstances to request deletion of personal data, th
Re: (Score:2)
I can only come up with the obvious client-side encryption, but will the network as a whole still be able to use the data as it's supposed to (in this case; find adult friends)?
This. It seems sexual preferences, age and location is rather essential for the service they provide and email, well how else are they going to notify you that someone has taken an interest in you or that you got a reply? You can't ask a doctor to not work with medical data, there's of course good and poor security but at the end of the day if there's a total system compromise you're screwed.
How could you protect against this?
Best practice seems to be as follows:
1. Public facing server makes web service call to locked down proxy server.
2. Pr
NO! Not my IP address!!! (Score:5, Funny)
After the last big hack I had to give up my old IP address, 192.168.0.1, which I had used for years. What a pain!
Re: (Score:2)
Me too, but with 127.0.0.1! D:
Re: (Score:1)
Nice porn collection!
Hopefully (Score:5, Interesting)
Hopefully some of the users that will be approached will not be good candidates for blackmailing; because they already got out of the relationship they were trying to cheat on or have already come out of the closet with whatever sexual kink they have.
Hopefully those users will contact police when they receive blackmail attempts and will aid in netting whoever is behind this
Re: (Score:3)
I get a kick out of how many people posting here assume that anyone using FriendFinder is a blackmail target due to this leaked information. There are singles who just might not care if others know they are out looking for f*buddies. And there are married people who might have open relationships.
Some years ago, at an interview for a security clearance, these issues came up. "What would you do, Mr PPH, if someone threatened to publish pictures of you with some stripper?" Being single at the time I just said
Re: (Score:2)
Or maybe the police will use it to blackmail/persecute people they don't like: http://www.theguardian.com/com... [theguardian.com]
I wouldn't trust the police to investigate any kind of sex related crime: http://www.bbc.com/news/uk-328... [bbc.com]
Nuts and %$@) (Score:4, Funny)
Oh no, now everyone will know I'm a white male age 18 to 49!
Re: (Score:1)
Dammit, *straight* white male.
Re:Nuts and %$@) (Score:5, Funny)
Re:Nuts and %$@) (Score:4, Informative)
You must be young. Asterisks around a word indicate emphasis (bold or italic text), not quotation marks.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
And you realize that *straight*, as written by the poster, would produce bolded text in many editors, right?
So, maybe you're not as "clever" as you think?
Re:Nuts and %$@) (Score:5, Funny)
The data (Score:5, Informative)
I've had a look at the data, there are very many easily identifiable people, for some of those there is date-of-birth data, ZIP code, "preferences", details of any money spent etc. There are a few people using their .gov email addresses for this, some of those can be verified by the IP address, some other email addresses belonging to other corporations. I would suspect that those are the people who are most at risk of blackmail. Remember too that an email addresses can be used to look people up on Facebook, which would make it easier for blackmailers to find potential victims.
Not revealed in the breach (so far) are credit card data, real names (although many are obvious from the email addresses) or passwords. Although I notice that some people were smart enough to sign up with a throwaway email address, if they have actually paid for anything then they would have had to supply real contact details somewhere.
The background story appears to be that a pissed-off affiliate who claims they were owed hundreds of thousands of dollars had a contact hack the database. It seems the hackers are demanding money else they will release the rest of the data.
Re: (Score:2)
Why even bother with blackmail, which could land you in your own legal hell?
Instead of racistsgettingfired.tumblr.com, somebody could try setting up cheatersgettingfired.tumblr.com and get people fired for their infidelity (plans).
Re: (Score:2)
This is a disgrace. In America, only the NSA, other secret police type organizations, and J. Edgar Hoover are entitled to this data. I'll bet this is Snowden's fault. SCHULTZ!!!
Re: (Score:2)
Would the hackers instead release the data in exchange for money?
Re: (Score:2)
How does this work?
Hackers claim they have a huge database of embarrassing information. How do they prove that they didn't simply invent the information?
I have a "database" showing that Senator XYX has as thing for furries and garden implements. See - here I have a text file with Senator XYZ's name and a list of preferences......
You could take any list of names and add arbitrary kinks, then threaten to release them. How do you show that this is the *real* database and not one you made up?
Re:The data (Score:4, Informative)
While I agree with what you're trying to say here, I think GP actually meant that they could confirm that the IP address belongs to a range assigned to government institutions - i.e. it's not just people using their .gov e-mail address from home, but they're using it from what should be their public servant workplace - and not so much tying it to a specific individual.
Re: (Score:2)
There are a few people using their .gov email addresses for this, some of those can be verified by the IP address
No, you can't. Remember, several different court cases have stated, and people on here have wholeheartedly agreed, you can't tie an IP address to a person, even if there is only one person at a residence.
So either you can use an IP address to tie it to someone or you can't. Which is it?
You can verify that someone with a .gov email address accessed a website with an IP address that corresponds to a government entity in the US. That's about all you can safely do.
Churches (Score:1)
Suddenly many ministers are all going to 3 week long camps to be cured.
Filter (Score:1)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Some visualization (Score:1)
How about some neat diagrams visualizing these data? Like relations between age, gender, residence, preferences, etc...
Re: Some visualization (Score:2, Interesting)
Oh god yes this please. Fuck all the blackmail stories; there's a sociologic goldmine in this data. Dissertations will be written on this for years to come.
Re: Some visualization (Score:4, Informative)
Male, male, male, male, male, male, male pretending to be female, male, male, OMG what's that.
Delete you're email account... (Score:1)
Re: (Score:1)
Re: (Score:3, Funny)
Let's Be Honest (Score:2)
Dating site of F^@( Buddy site.
Trivial (Score:2)
OPSEC (Score:5, Insightful)
my god, people, if you are going to use a site like that, don't use your real name, work email address, etc.
consider that *everything* is going to get compromised -- if it is not already. use some common sense.
Re: (Score:3)
use some common sense.
there are 3 kinds of people:
* those who can use some common sense
* those who can't
Re: (Score:2)
Well, you're making an assumption that people who use those sites are smart.
I mean, I see ads for Ashley Madison, a site that gears itself for having affairs. Since they're TV ads, I can't imagine the people who log into it looking to have an affair are too bright to not use their real names or anything. Especially since the information contained on that site would be particularly interesting to a lo
Re: (Score:2)
my god, people, if you are going to use a site like that, don't use your real name, work email address
Exactly, instead use your boss's. That was if nothing happens no harm done, and if something does happen a new promotion may be in your future.
Oh, shit. (Score:5, Funny)
Meh (Score:5, Funny)
I think I had an account but like all adult sites I sign up for I used a throwaway email, lie about my age and location, and only show my dick and balls in photos.
And no will recognize the dick and balls as I'm a virgin in my 30s.
Re: (Score:2)
30s? Oh, please. Try 40s like The 40 Year Old Virgin [imdb.com]. :P
Which of them are seeking extramarital affairs? (Score:2)
...and information indicating which of them are seeking extramarital affairs
Good. Fuck em. Let's see some good old fashioned public shaming. Cheating fucks.
Look up your email address (Score:4, Interesting)
In the Ars story about this they pointed out a website that tracks beaches that I hadn't heard of before: ';--have i been pwned? [haveibeenpwned.com]
I plugged my email addresses into this and found out that I had been a part of the Adobe breach fro October 2013. And I don't remember Adobe telling me about it
Re: (Score:3)
In the Ars story about this they pointed out a website that tracks beaches that I hadn't heard of before: ';--have i been pwned? [haveibeenpwned.com]
Isn't that site just an alias for the "pleasepownmeheresmyemailaddress.com"?
Re: (Score:2)
Hey bud, you would have been better-off using this:
LastPass Adobe email hack check [lastpass.com]
LastPass got a hold of the database and offers a checking service.
Status update from AFF (Score:1)
As the protection of our customers is our utmost concern and in abundance of caution we have temporarily disabled the username search function and have begun to mask usernames of any users we believe were affected by the security issue. Users will still be able to log-in using their username and password but the username search functionality will be disabled until further notice. We are also creating a streamlined and easy process for users to change their usernames and passwords that will be live this weekend.
If you have any questions or concerns, please do not hesitate to contact customer service. For further information please visit http://www.ffn.com/security-up... [ffn.com]
-------
FriendFinder Networks Inc. has just been made aware of a potential data security issue and understands and fully appreciates the seriousness of the issue. We have already begun working closely with law enforcement and have launched a comprehensive investigation with the help of leading third-party forensics expert, Mandiant, a FireEye Company.
Until the investigation is completed, it will be difficult to determine with certainty the full scope of the incident, but we will continue to work vigilantly to address this potential issue and will provide updates as we learn more from our investigation.
We cannot speculate further about this issue, but rest assured, we pledge to take the appropriate steps needed to protect our customers if they are affected.
Oh no! (Score:2)
...you may be sure that your sin will find you out (Score:1)
What my parents told me growing up comes to mind:
http://biblehub.com/numbers/32... [biblehub.com] - "...you may be sure that your sin will find you out."
At least anyone with fear of finally being exposed as dishonest has a warning sign to make amends with their partner.
No one can fault you for the truth, although there may be consequences for the truth.
AFF was real??? (Score:1)
All along I just figured it was a scam harvesting money from lonely guys. People actually used it for dating??? There were actually women on it???
I felt a tremor in the force (Score:5, Funny)
As though millions of divorce lawyers just orgasmed at once.
My sexual preference (Score:4, Funny)
Re: (Score:3)
Our government is out of control anyway, anything that allows blackmail, removal from office, misery in their lives. etc is a good thing
While we're at it let's extend it to programmers, DBAs, sys admins an designers who cause us so much misery because they are too stupid or lazy to build secure systems.
Re:useful (Score:5, Insightful)
And, of course, let's not stop there ... let's move to the managers, executives, and sales/marketing assholes who force this shit out the door.
The poor bastard of a programmer who has been told by the VP or the CEO (or the sales wanker) that the product must ship now, or that security doesn't matter is not always the cause of this. Sometimes they're the ones saying "umm, guys, this could be a problem".
So, if we're assigning blame, let's go with the people who are actually to blame and who make the decisions.
In the military, "just following orders" may not be a defense. But in private industry it's often the management who create these problems.
Which is precisely why I say that corporations should be held to a legal standard for the protection of personal information, and should carry penalties for failure to do so.
As long as corporations just say "oh, bummer dude" and have no penalties, they'll continue to cut as many corners as possible. Because there simply is no consequence for them.
I'm as concerned about the management people who don't give a damn. Because they're the ones who make policy and decide that not sucking at security is too costly.
So, want a secure internet? Kick an MBA or a CEO in the nuts, and tell them you'll keep doing it until they insist on secure code.
Re:useful (Score:5, Insightful)
Joking aside, the managers, executives, and sales/marketing assholes should be strung up for telling people your data was deleted when in fact it wasn't.
Re: (Score:2)
What joking? I wasn't joking.
I totally think delivering ass-whoopings to MBAs and CEOs for corporate malfeasance would solve a lot of problems.
Because it would be better than this "non est mea culpa" shit we have now where CEOs issue some drivel apology and have no consequences.
I'm not joking at all.
Re: (Score:2)
Are those public ass-whoopings, like getting spanked with a paddle in the town square?
Re: (Score:2)
Re: (Score:2)
Sure. Of course, you're going to prove that it was a management directive, and not just plain old IT incompetence or malice that led to "deleted" profiles being left around in the system, right?
If the IT guys are partly to blame, they should be lined up right alongside their managers for those whippings. And I'm pretty sure that you'll find more often than not that the IT guys are just as clueless and incompetent as their clueless and incompetent bosses.
Irrelevant.
Obviously, if it was a management directive, it's management's fault. However, if the lack of security is due to ignorance/incompetence on the part of IT, it's still management's fault, as it's their job to hire and/or train IT for security (and fire if necessary).
Internally, management is free to assign blame and take action against IT, be it through improvement plants, pink slips, or (in the case of malice) lawsuits. But make no mistake - management holds final responsibility - that's part of
Re: (Score:1)
This, precisely this.
The solution is a class action suit against the company on behalf of the customers.
Re: (Score:2)
How about about a nice bonus for those in charge for firing those horrrible cost centers who provide no value and caused the leak. So smart. Not all scarce talent can be so gifted.
Re:useful (Score:4)
You're confused, no one cares what they do in their spare time. In fact, the ones I've worked with that use the services of whores like to talk about it.
Re: (Score:2)
All computers are vulnerable. The most secure systems in the world can be hacked. This one might have been insecure, but that isn't demonstrated just because it got hacked.
This is why adultery is wrong (Score:1)
This is why people with substantial power — such as, first of all, government officials — must not engage in adultery or anything similarly reprehensible even if it is not illegal for the rest of us. Not because of some wicked "puritanism", but because it opens them up to blackmail, that corrupts government thus affecting all of us.
Government officials — be they lawmakers, judges, or executives — must be squeaky fucking clean. (Same may apply to CEOs, b
Re:This is why adultery is wrong (Score:5, Interesting)
Re:This is why adultery is wrong (Score:5, Funny)
Exactly. Be French about it.
Re: (Score:2)
Either that or be open about it. It is hard to blackmail someone over something that is public knowledge.
Huh. Apparently, you're right. You can be a 50-something politician and have an affair with the 17-year-old daughter of one of your law clients, get a plea deal to misdemeanors instead of a felony, and it's okay as long as you come out with it a couple of years later, present your new baby, and talk about your ambitions to be a leader in the state senate. Truth is stranger than fiction [dailyprogress.com].
Re: (Score:2)
remember the politician not wanting to be caught in bed with either dead 17 year old girl or live 17 year old boy
Re: (Score:2)
And if I do it, it opens me up to getting my throat slit in my sleep.
Re: (Score:3)
Agreed. A while ago there was a big stink kicked up locally because a government official's mistress was about to fly in but his wife found out and was going to catch her, so he called the customs officials and had the mistress held at the airport and then deported to keep his affair under wraps (or at least keep the wife and mistress from meeting). The mistress had no idea why she was being held at the time. Officially it just looks like she was held and deported for no good reason at best - or profiling a
Re:Lol (Score:5, Insightful)
If you're gonna cheat, why do it on the Internet? People who continue to trust the anonymity of the web boggle my mind.
The physical world doesn't offer much anonymity either. At least the Internet offers more choices. Just don't use your real name, or primary email address, and you'll be fine.
Re:Lol (Score:4, Funny)
exactly, I wonder who was dumb enough to create a profile saying "Dave Brown of 22 Acacia Avenue AB1 3CD, wants to meet nice ladyboy for extramartial affair"? It'll be "single male, BigBrownie, of 1 nowhere place, wants to meet nice ladyboy"
And as for the spam emails, I have a couple I use for all kinds of dodgy sites (eg slashdot) and I get loads of spam anyway.
Still... .9 million users... that's a lot of people! I wonder why these dating sites charge so much per month for membership when they could just charge $1 and rake in the cash. Stack 'em high 'cos extramarital affairs are never going to go out of fashion - the only problem is ending up meeting your blind date and finding it's your wife!!
Re:Lol (Score:5, Informative)
I wonder why these dating sites charge so much per month for membership when they could just charge $1 and rake in the cash.
A higher fee is an effective filter. The "free" sites are garbage, with lots of phoney or dead profiles. I paid $99 for an annual membership to match.com, met several nice girls, married one of them, and I now have a wife, two kids and a dog. Compared to all the other expenses I have incurred, the $99 is negligible.
I can understand the wife and kids... (Score:3, Funny)
I paid $99 for an annual membership to match.com, met several nice girls, married one of them, and I now have a wife, two kids and a dog.
What kind of weird ass genetics do you have that you + wife = kid + kid + dog?!?!?
Re: (Score:3, Insightful)
They're each half-dog with recessive genes, two human kids and one dog are the result.
Re:Lol (Score:5, Funny)
you forgot to add the recurring charges ;) in your equation
Re: (Score:2)
you forgot to add the recurring charges
He mentioned the wife and kids, and then stated the $99 is negligible in comparison. What did he forget?
Re: (Score:1)
Re: Lol (Score:3)
That could happen if you both enjoy Piña Coladas and getting caught in the rain.
Re: (Score:2)
Re: (Score:2)
Sites like AFF require payment. Unless you have a credit card setup under a fake identity, you're going to have to provide real data to use the site.
You can use Paypal instead of a credit card. But even if you use a CC, few sites require that the profile name/address and CC billing information match. This is especially true if their marginal cost is $0, as it is for dating sites.
Re: (Score:2)
I have zero sympathy for Anonymous Cowards. I think that if people have something that they really need to say on /. that they should use their normal account. Who cares if they lose mod points. The people like you posting using AC accounts should be outed!
Re: (Score:2)
I have zero sympathy for Anonymous Cowards. I think that if people have something that they really need to say on /. that they should use their normal account. Who cares if they lose mod points. The people like you posting using AC accounts should be outed!
That the AC was certainly extreme, I don't think anybody deserves to be blackmailed. He did have a point though, if you are cheating on your wife/husband you won't get much sympathy from me if you get found out and there is plenty of people who agree with me. The world is full of people who claim they are saving/improving their marriages/relationships and doing their spouse some sort of favour by cheating behind their backs instead of drumming up the courage to talk to their spouse and working out their rel
Re: (Score:2)
Probably around 49%. Add in 49% Democrat, and 2% other.
Or were you trying to make a hyuckhyuck statement?
Re: (Score:1)
How many Republicans? :-)
Probably around 49%. Add in 49% Democrat, and 2% other.
Or were you trying to make a hyuckhyuck statement?
I suspect the implication was that Republicans, especially with Bible-thumping ones, tend to be hypocrites.
I don't want to get drawn into the political aspect, but my experience has been that in general the louder the 'Christian' the worse the person. [Quiet Christians tend to be nicer.]
Re: (Score:3)
Re: (Score:2)
GayWAD was right, if yo've used Slashdot beta to find a sex partner, you now have no problems.
Actually, if you have managed to find a sex partner using Slashdot beta all you will have achieved is finding another person who needs to read several Wikipedia articles and closely study the diagrams before they can successfully have sex with another human being since both of your previous sexual experience will have been limited to a computer monitor and one or both of the prehensile, multi-fingered extremities attached to the upper limbs of your body.