Adult Dating Site Hack Reveals Users' Sexual Preference, Extramarital Affairs

An anonymous reader notes this report from Channel 4 News that Adult FriendFinder, one of the largest dating sites in the world, has suffered a database breach that revealed personal information for 3.9 million of its users. The leaked data includes email addresses, IP addresses, birth dates, postal codes, sexual preferences, and information indicating which of them are seeking extramarital affairs. There even seems to be data from accounts that were supposedly deleted. Channel 4 saw evidence that there were plans for a spam campaign against these users, and others are worried that a blackmail campaign will follow. "Where you've got names, dates of birth, ZIP codes, then that provides an opportunity to actually target specific individuals whether they be in government or healthcare for example, so you can profile that person and send more targeted blackmail-type emails," said cybercrime specialist Charlie McMurdy.

Comments

oh no

[turkeydance]

sorry, gotta go.

Re:oh no

[antdude]

Go to do a turkey dance? :P

Not really

[Anonymous Coward]

The leaked data includes email addresses, IP addresses, birth dates, postal codes, sexual preferences...

Given that their list of choices for sexual preferences doesn't include tentacle-on-pregnant furry futanari, I think I'm pretty safe.

Re:Not really

[Githyanki]

Yeah, I spent so much time on my profile just to have to go and delete it.

How could you protect against this?

[mwvdlee]

You could encrypt all the data in the database, but that would only protect you from somebody able to access the database but not any of the decryption code (somewhat unlikely).

Assuming full access to the database and code, is there any way to protect against being able to link identification with the rest of the personal information.

I can only come up with the obvious client-side encryption, but will the network as a whole still be able to use the data as it's supposed to (in this case; find adult friends)?

Re:How could you protect against this?

[3.5 stripes]

Why do you assume the hackers got everything, instead of just pulling a little jimmy droptables, hell all they really needed to get that info is read only access and a select all statement..

Re:How could you protect against this?

[AmiMoJo]

You could do things like splitting email addresses off into a different database on a different server and just keeping a hash in the main one, but it's only mm marginally better. Basically you can't be both secure and provide this kind of service.

As well as the terrible male to female ratio (16:1) the other big issue here is that deleted accounts were not really deleted. The European Right to be Forgotten is designed to force companies operating in the EU to really delete accounts, and this illustrates why it is needed.

Re:How could you protect against this?

[Anonymous Brave Guy]

The European Right to be Forgotten is designed to force companies operating in the EU to really delete accounts, and this illustrates why it is needed.

I think you're confusing two different things here. The "right to be forgotten", as much discussed recently with regard to Google and the like, is primarily about search engines digging up old information that would otherwise naturally fade into obscurity, and in particular the danger of finding old information that looks plausible but may in fact be misleading without context or now incorrect/outdated.

Sadly, most of us even in Europe still have rather limited rights to compel businesses not to store personal data about us or to delete that data on demand, if the data is correct, they register the fact that they are doing it with the appropriate national privacy regulator, and they can come up with some vaguely plausible argument for why they want to have the data.

I guess a few million people are about to find out the hard way why some of us have been arguing for a long time that we should have stronger privacy safeguards in the Internet/big data/data mining age. I wish they didn't have to find out this way, though.

Re:How could you protect against this?

[gbjbaanb]

How about:

a) not putting any kind of direct DB access in your website, using a middle tier layer (webservice?) to act as the DB access
b) not letting the middle tier server access the DB directly, instead having to go through stored procedures
c) basically not letting anyone run "select * from users" at all.

Security can be done, but as long as we have websites that think "webserver" means all the back-end processing has to be running in the web server whether its IIS or Apache, and frameworks that assume all development must be done in 1 web-server hosted language.... then we will continue to see security breaches like this.

You want to secure your site, split the web handling/presentation from the data processing, and the processing from the data extraction. Then slap as much security on the interfaces between these layers. Do not trust the webserver one bit. Assume the webserver is already hacked. Hell, do not trust the middle tier either - allow it only the limited data it needs for each part of the processing.

I've done the above, its not nearly as difficult as the webdevs will say.

Re:How could you protect against this?

[AmiMoJo]

The search results thing is not the right to be forgotten. Some stupid journalists got confused and called it that, but that was actually just existing data protection rules dating back to the mid 90s.

The right to be forgotten is still being looked at, but basically will allow EU citizens to require companies to delete data supplied by them (accounts, uploaded photos etc.) on request. The data must really be deleted, not just marked as dormant or whatever.

Re:How could you protect against this?

[Kjella]

I can only come up with the obvious client-side encryption, but will the network as a whole still be able to use the data as it's supposed to (in this case; find adult friends)?

This. It seems sexual preferences, age and location is rather essential for the service they provide and email, well how else are they going to notify you that someone has taken an interest in you or that you got a reply? You can't ask a doctor to not work with medical data, there's of course good and poor security but at the end of the day if there's a total system compromise you're screwed.

How could you protect against this?

Best practice seems to be as follows:
1. Public facing server makes web service call to locked down proxy server.
2. Proxy server validates every request thoroughly, everything that looks even remotely funny is rejected.
3. Proxy server queries stored procedure in locked down database, no SELECT * for you.
4. The results are serialized back to XML and sent to the public facing server for display.

A lot of work if you want to do it right, but you get a fairly good barrier to a total breach from the outside. Of course they could compromise your web server and start harvesting data, but you should have some sort of tripwire system for that with audits and logs checking for abnormal activity.

The other way in is of course from your network, if they can compromise someone on the inside with database access or developers to plant vulnerabilities that'll go into the production system. But that's usually a much tougher route and really no different from breaking into any other secure network.

Re:How could you protect against this?

[noxay]

Its not always the difficulty standing in the way, sometimes its the money. The set up you are talking about is significantly more costly than a shared host with attached database. Granted a site like "Adult Friend Finder" probably has the cash to cover this, but not all sites that deal with eCommerce or saving user data have the funds for this.

Re:How could you protect against this?

[Anonymous Coward]

Just protect yourself. When you sign up for one of those sites, you use a separate email address from your normal one. For your credit card, you can use a prepaid VISA. It probably won't make you untrackable to folks like the gub'ment, but it will make it so you don't get any of your Personal Info disclosed.
As a person posting as an Anonymous coward since it's birth on slashdot, I should know ;-)

Re:How could you protect against this?

[Anonymous Brave Guy]

The search results thing is not the right to be forgotten. Some stupid journalists got confused and called it that

Those "stupid journalists" appear to be in good company, starting with official press releases from both the European Commission and indeed the European Court of Justice itself about the 2010 Spanish newspaper case.

I would be the first to agree that moves towards a more powerful right to be forgotten such as you describe would be a good idea, but as of today, these are mostly just proposals. For example, while there is already a right under some limited circumstances to request deletion of personal data, the UK's data protection regulator has written guidance for data controllers that makes clear that the right is quite tightly constrained for the time being.

NO! Not my IP address!!!

[Anonymous Coward]

After the last big hack I had to give up my old IP address, 192.168.0.1, which I had used for years. What a pain!

Hopefully

[Anonymous Coward]

Hopefully some of the users that will be approached will not be good candidates for blackmailing; because they already got out of the relationship they were trying to cheat on or have already come out of the closet with whatever sexual kink they have.

Hopefully those users will contact police when they receive blackmail attempts and will aid in netting whoever is behind this

Re:Hopefully

[PPH]

I get a kick out of how many people posting here assume that anyone using FriendFinder is a blackmail target due to this leaked information. There are singles who just might not care if others know they are out looking for f*buddies. And there are married people who might have open relationships.

Some years ago, at an interview for a security clearance, these issues came up. "What would you do, Mr PPH, if someone threatened to publish pictures of you with some stripper?" Being single at the time I just said I'd order copies to be sent out as Christmas cards.

Things have gotten quite a bit more sane since those days. The DoD is quite willing to work with people involved in alternative lifestyles from a security perspective. And many companies would just as likely remove an intolerant supervisor as an employee that didn't live up to some ideal of a Christian lifestyle.

Re:Hopefully

[AmiMoJo]

Or maybe the police will use it to blackmail/persecute people they don't like: http://www.theguardian.com/com...

I wouldn't trust the police to investigate any kind of sex related crime: http://www.bbc.com/news/uk-328...

Re:useful

[Registered Coward v2]

Our government is out of control anyway, anything that allows blackmail, removal from office, misery in their lives. etc is a good thing

While we're at it let's extend it to programmers, DBAs, sys admins an designers who cause us so much misery because they are too stupid or lazy to build secure systems.

Nuts and %$@)

[tehlinux]

Oh no, now everyone will know I'm a white male age 18 to 49!

Re:Nuts and %$@)

[tehlinux]

Dammit, *straight* white male.

Re:Nuts and %$@)

[Githyanki]

You realize that putting quotes around it usually indicates that there is a nudge and wink going on at the same time. Reminds me of the joke: Guy sits and drinks at the bar till closing. Bartender tells him "Hey buddy, time to go, your the last one here." Guy pulls a gun on the bartender and forces him to give him a blow job. Partway through, the guy looses concentration and the gun slips down. Bartender picks it up and hands it back to the guy. "Dont want anyone to come in and catch me doing this and think I'm gay!!"

Re:Nuts and %$@)

[Anonymous Coward]

You must be young. Asterisks around a word indicate emphasis (bold or italic text), not quotation marks.

Re:Nuts and %$@)

[gstoddart]

You realize that putting quotes around it usually indicates that there is a nudge and wink going on at the same time

And you realize that *straight*, as written by the poster, would produce bolded text in many editors, right?

So, maybe you're not as "clever" as you think?

Re:Nuts and %$@)

[Anonymous Coward]

Or possibly too old to see that they were asterisks and not quotation marks.

Re:Nuts and %$@)

[DickBreath]

Or not using a large enough font or large enough monitor. Or using a font where the asterisk glyph is visually similar to a quote glyph.

Re:Nuts and %$@)

[OhSoLaMeow]

That reminds me of a joke. Guy goes into a bar and orders a scotch. He downs that quickly and goes through three more in the same fashion. The bartender asks him if he's celebrating anything. The guy says "Yeah, just had my first blowjob." Bartender says "Congratulations! Here's another one, on the house." The guy says "No thanks. If four scotches won't get the taste out of my mouth, another one isn't going to help."

The data

[Dynamoo]

The data is a apparently a subset of 60 million records that the hackers are threatening to release.

I've had a look at the data, there are very many easily identifiable people, for some of those there is date-of-birth data, ZIP code, "preferences", details of any money spent etc. There are a few people using their .gov email addresses for this, some of those can be verified by the IP address, some other email addresses belonging to other corporations. I would suspect that those are the people who are most at risk of blackmail. Remember too that an email addresses can be used to look people up on Facebook, which would make it easier for blackmailers to find potential victims.

Not revealed in the breach (so far) are credit card data, real names (although many are obvious from the email addresses) or passwords. Although I notice that some people were smart enough to sign up with a throwaway email address, if they have actually paid for anything then they would have had to supply real contact details somewhere.

The background story appears to be that a pissed-off affiliate who claims they were owed hundreds of thousands of dollars had a contact hack the database. It seems the hackers are demanding money else they will release the rest of the data.

Re:The data

[QuasiSteve]

While I agree with what you're trying to say here, I think GP actually meant that they could confirm that the IP address belongs to a range assigned to government institutions - i.e. it's not just people using their .gov e-mail address from home, but they're using it from what should be their public servant workplace - and not so much tying it to a specific individual.

Re:The data

[jittles]

There are a few people using their .gov email addresses for this, some of those can be verified by the IP address

No, you can't. Remember, several different court cases have stated, and people on here have wholeheartedly agreed, you can't tie an IP address to a person, even if there is only one person at a residence.

So either you can use an IP address to tie it to someone or you can't. Which is it?

You can verify that someone with a .gov email address accessed a website with an IP address that corresponds to a government entity in the US. That's about all you can safely do.

Re:The data

[QuasiSteve]

some other email addresses belonging to other corporations. I would suspect that those are the people who are most at risk of blackmail

Why even bother with blackmail, which could land you in your own legal hell?

Instead of racistsgettingfired.tumblr.com, somebody could try setting up cheatersgettingfired.tumblr.com and get people fired for their infidelity (plans).

Re:The data

[mtrachtenberg]

This is a disgrace. In America, only the NSA, other secret police type organizations, and J. Edgar Hoover are entitled to this data. I'll bet this is Snowden's fault. SCHULTZ!!!

Re:The data

[DickBreath]

> It seems the hackers are demanding money else they will release the rest of the data.

Would the hackers instead release the data in exchange for money?

Re:The data

[joe_frisch]

How does this work?
Hackers claim they have a huge database of embarrassing information. How do they prove that they didn't simply invent the information?

I have a "database" showing that Senator XYX has as thing for furries and garden implements. See - here I have a text file with Senator XYZ's name and a list of preferences......

You could take any list of names and add arbitrary kinks, then threaten to release them. How do you show that this is the *real* database and not one you made up?

Re:The data

[Bing Tsher E]

Also Google. But not for any evil purposes.

Right.

Churches

[Anonymous Coward]

Suddenly many ministers are all going to 3 week long camps to be cured.

Re:useful

[gstoddart]

And, of course, let's not stop there ... let's move to the managers, executives, and sales/marketing assholes who force this shit out the door.

The poor bastard of a programmer who has been told by the VP or the CEO (or the sales wanker) that the product must ship now, or that security doesn't matter is not always the cause of this. Sometimes they're the ones saying "umm, guys, this could be a problem".

So, if we're assigning blame, let's go with the people who are actually to blame and who make the decisions.

In the military, "just following orders" may not be a defense. But in private industry it's often the management who create these problems.

Which is precisely why I say that corporations should be held to a legal standard for the protection of personal information, and should carry penalties for failure to do so.

As long as corporations just say "oh, bummer dude" and have no penalties, they'll continue to cut as many corners as possible. Because there simply is no consequence for them.

I'm as concerned about the management people who don't give a damn. Because they're the ones who make policy and decide that not sucking at security is too costly.

So, want a secure internet? Kick an MBA or a CEO in the nuts, and tell them you'll keep doing it until they insist on secure code.

Filter

[Anonymous Coward]

How did they ever filter out all the fake accounts? Hot horny locals, my ass.

Re:Filter

[Dynamoo]

Actually, there are some clearly invalid or mis-typed email addresses in the list (e.g hotmial.com). So I am guessing that the addresses were not confirmed by the AFF system.

Re:Filter

[PPH]

No problem

Re:Filter

[Bob the Super Hamste]

I think I have found a e-mail address to use for disposable accounts. Now I wonder if there are lists of spammers e-mail that I can use for creating some perverse circular spam linkage.

Re:useful

[rubycodez]

You're confused, no one cares what they do in their spare time. In fact, the ones I've worked with that use the services of whores like to talk about it.

Some visualization

[Anonymous Coward]

How about some neat diagrams visualizing these data? Like relations between age, gender, residence, preferences, etc...

Re: Some visualization

[Anonymous Coward]

Oh god yes this please. Fuck all the blackmail stories; there's a sociologic goldmine in this data. Dissertations will be written on this for years to come.

Re: Some visualization

[Dynamoo]

It goes something like this:
Male, male, male, male, male, male, male pretending to be female, male, male, OMG what's that.

Re:Some visualization

[LewekLeonek]

How about some neat diagrams visualizing these data? Like relations between age, gender, residence, preferences, etc...

You're absolutely right. This data could be great to use for big data tutorials.

Delete you're email account...

[kiphat]

You can't send SPAM to an email that doesn't exist. Close the email account associated with the compromised account. Problem solved.

Let's Be Honest

[tiberus]

Adult FriendFinder, one of the largest dating sites in the world

Dating site of F^@( Buddy site.

Trivial

[puddingebola]

I'm sure the information release was trivial and... oh my God. I didn't realize she still had those photos.

OPSEC

[lophophore]

my god, people, if you are going to use a site like that, don't use your real name, work email address, etc.

consider that *everything* is going to get compromised -- if it is not already. use some common sense.

Re:OPSEC

[antiperimetaparalogo]

use some common sense.

there are 3 kinds of people:
* those who can use some common sense
* those who can't

Re:OPSEC

[tlhIngan]

my god, people, if you are going to use a site like that, don't use your real name, work email address, etc.

Well, you're making an assumption that people who use those sites are smart.

I mean, I see ads for Ashley Madison, a site that gears itself for having affairs. Since they're TV ads, I can't imagine the people who log into it looking to have an affair are too bright to not use their real names or anything. Especially since the information contained on that site would be particularly interesting to a lot of people (suspicious partners, for example).

As for those wanting people to pay so they can track them - I don't see the point. If the hackers were threatened with exposure, the best course of action is to release the entire list online. Sure it screws up future chances to make money, but those wanting to find them will suddenly get exposed (while the hackers take their money and run).

Re:OPSEC

[Mr. Shotgun]

my god, people, if you are going to use a site like that, don't use your real name, work email address

Exactly, instead use your boss's. That was if nothing happens no harm done, and if something does happen a new promotion may be in your future.

Re:Lol

[ShanghaiBill]

If you're gonna cheat, why do it on the Internet? People who continue to trust the anonymity of the web boggle my mind.

The physical world doesn't offer much anonymity either. At least the Internet offers more choices. Just don't use your real name, or primary email address, and you'll be fine.

Re:I have 0 sympathy

[phayes]

I have zero sympathy for Anonymous Cowards. I think that if people have something that they really need to say on /. that they should use their normal account. Who cares if they lose mod points. The people like you posting using AC accounts should be outed!

Oh, shit.

[happily_married]

This is horrible.

Meh

[Anonymous Coward]

I think I had an account but like all adult sites I sign up for I used a throwaway email, lie about my age and location, and only show my dick and balls in photos.

And no will recognize the dick and balls as I'm a virgin in my 30s.

Re:Meh

[antdude]

30s? Oh, please. Try 40s like The 40 Year Old Virgin. :P

Re:NO! Not my IP address!!!

[Anonymous Coward]

Nice porn collection!

Re:That raises the question

[YrWrstNtmr]

How many Republicans? :-)

Probably around 49%. Add in 49% Democrat, and 2% other.
Or were you trying to make a hyuckhyuck statement?

Re:Delete YOUR email account...

[kiphat]

Thanks. ;)

Re:Lol

[gbjbaanb]

exactly, I wonder who was dumb enough to create a profile saying "Dave Brown of 22 Acacia Avenue AB1 3CD, wants to meet nice ladyboy for extramartial affair"? It'll be "single male, BigBrownie, of 1 nowhere place, wants to meet nice ladyboy"

And as for the spam emails, I have a couple I use for all kinds of dodgy sites (eg slashdot) and I get loads of spam anyway.

Still... .9 million users... that's a lot of people! I wonder why these dating sites charge so much per month for membership when they could just charge $1 and rake in the cash. Stack 'em high 'cos extramarital affairs are never going to go out of fashion - the only problem is ending up meeting your blind date and finding it's your wife!!

Re:This is why adultery is wrong

[O('_')O_Bush]

Either that or be open about it. It is hard to blackmail someone over something that is public knowledge.

Which of them are seeking extramarital affairs?

[Pascoea]

...and information indicating which of them are seeking extramarital affairs

Good. Fuck em. Let's see some good old fashioned public shaming. Cheating fucks.

Re:Which of them are seeking extramarital affairs?

[Whiteox]

Cheating fucks if your wife is doing it. It's OK if you're doing it.

Look up your email address

[OzPeter]

In the Ars story about this they pointed out a website that tracks beaches that I hadn't heard of before: ';--have i been pwned?

I plugged my email addresses into this and found out that I had been a part of the Adobe breach fro October 2013. And I don't remember Adobe telling me about it

Re:Look up your email address

[tlambert]

In the Ars story about this they pointed out a website that tracks beaches that I hadn't heard of before: ';--have i been pwned?

Isn't that site just an alias for the "pleasepownmeheresmyemailaddress.com"?

Re:Look up your email address

[skegg]

Hey bud, you would have been better-off using this:

LastPass Adobe email hack check

LastPass got a hold of the database and offers a checking service.

Re:This is why adultery is wrong

[disposable60]

Exactly. Be French about it.

Re:useful

[Krojack]

Joking aside, the managers, executives, and sales/marketing assholes should be strung up for telling people your data was deleted when in fact it wasn't.

Re:I have 0 sympathy

[Feral Nerd]

I have zero sympathy for Anonymous Cowards. I think that if people have something that they really need to say on /. that they should use their normal account. Who cares if they lose mod points. The people like you posting using AC accounts should be outed!

That the AC was certainly extreme, I don't think anybody deserves to be blackmailed. He did have a point though, if you are cheating on your wife/husband you won't get much sympathy from me if you get found out and there is plenty of people who agree with me. The world is full of people who claim they are saving/improving their marriages/relationships and doing their spouse some sort of favour by cheating behind their backs instead of drumming up the courage to talk to their spouse and working out their relationship problems honestly. These individuals are all delusional and they all deserve to be found out because they are making their spouse's unknowingly waste their lives on a deceitful and untrustworthy excuse for a human being.

Status update from AFF

[Anonymous Coward]

As the protection of our customers is our utmost concern and in abundance of caution we have temporarily disabled the username search function and have begun to mask usernames of any users we believe were affected by the security issue. Users will still be able to log-in using their username and password but the username search functionality will be disabled until further notice. We are also creating a streamlined and easy process for users to change their usernames and passwords that will be live this weekend.

If you have any questions or concerns, please do not hesitate to contact customer service. For further information please visit http://www.ffn.com/security-up...

-------

FriendFinder Networks Inc. has just been made aware of a potential data security issue and understands and fully appreciates the seriousness of the issue. We have already begun working closely with law enforcement and have launched a comprehensive investigation with the help of leading third-party forensics expert, Mandiant, a FireEye Company.

Until the investigation is completed, it will be difficult to determine with certainty the full scope of the incident, but we will continue to work vigilantly to address this potential issue and will provide updates as we learn more from our investigation.

We cannot speculate further about this issue, but rest assured, we pledge to take the appropriate steps needed to protect our customers if they are affected.

Oh no!

[DickBreath]

I made such an effort to conceal my sexual orientation!

Re:Lol

[ShanghaiBill]

I wonder why these dating sites charge so much per month for membership when they could just charge $1 and rake in the cash.

A higher fee is an effective filter. The "free" sites are garbage, with lots of phoney or dead profiles. I paid $99 for an annual membership to match.com, met several nice girls, married one of them, and I now have a wife, two kids and a dog. Compared to all the other expenses I have incurred, the $99 is negligible.

Re:Delete YOUR email account...

[DickBreath]

Your never going too get you're weigh on this. Their are just two many people out they're using there words wrong too get to upset. Sew don't loose you're cool about it. You can sea mini common examples that exist of incorrect usage. People pick the write words two use according too there porpoises. But you'd have two be a fool to begin or end a sentence with the word "but". And only an idiot would begin or end a sentence with "and". And a preposition is a very bad word too end a sentence with.

Re:You insensitive clods

[Feral Nerd]

GayWAD was right, if yo've used Slashdot beta to find a sex partner, you now have no problems.

Actually, if you have managed to find a sex partner using Slashdot beta all you will have achieved is finding another person who needs to read several Wikipedia articles and closely study the diagrams before they can successfully have sex with another human being since both of your previous sexual experience will have been limited to a computer monitor and one or both of the prehensile, multi-fingered extremities attached to the upper limbs of your body.

Re:Lol

[nuckfuts]

Sites like AFF require payment. Unless you have a credit card setup under a fake identity, you're going to have to provide real data to use the site.

...you may be sure that your sin will find you out

[Smoodo]

What my parents told me growing up comes to mind:
http://biblehub.com/numbers/32... - "...you may be sure that your sin will find you out."
At least anyone with fear of finally being exposed as dishonest has a warning sign to make amends with their partner.
No one can fault you for the truth, although there may be consequences for the truth.

Re:That raises the question

[Anonymous Coward]

How many Republicans? :-)

Probably around 49%. Add in 49% Democrat, and 2% other.
Or were you trying to make a hyuckhyuck statement?

I suspect the implication was that Republicans, especially with Bible-thumping ones, tend to be hypocrites.

I don't want to get drawn into the political aspect, but my experience has been that in general the louder the 'Christian' the worse the person. [Quiet Christians tend to be nicer.]

Re:Lol

[jmcwork]

And that she likes pina coladas

I can understand the wife and kids...

[Anonymous Coward]

I paid $99 for an annual membership to match.com, met several nice girls, married one of them, and I now have a wife, two kids and a dog.

What kind of weird ass genetics do you have that you + wife = kid + kid + dog?!?!?

Re:I can understand the wife and kids...

[Anonymous Coward]

They're each half-dog with recessive genes, two human kids and one dog are the result.

Re: Lol

[dr_dank]

That could happen if you both enjoy Piña Coladas and getting caught in the rain.

Re:This is why adultery is wrong

[PopeRatzo]

This is why people with substantial power — such as, first of all, government officials — must not engage in adultery or anything similarly reprehensible even if it is not illegal for the rest of us. Not because of some wicked "puritanism", but because it opens them up to blackmail, that corrupts government thus affecting all of us.

And if I do it, it opens me up to getting my throat slit in my sleep.

AFF was real???

[Anonymous Coward]

All along I just figured it was a scam harvesting money from lonely guys. People actually used it for dating??? There were actually women on it???

Re:Lol

[ShanghaiBill]

Sites like AFF require payment. Unless you have a credit card setup under a fake identity, you're going to have to provide real data to use the site.

You can use Paypal instead of a credit card. But even if you use a CC, few sites require that the profile name/address and CC billing information match. This is especially true if their marginal cost is $0, as it is for dating sites.

Re:This is why adultery is wrong

[GameboyRMH]

Agreed. A while ago there was a big stink kicked up locally because a government official's mistress was about to fly in but his wife found out and was going to catch her, so he called the customs officials and had the mistress held at the airport and then deported to keep his affair under wraps (or at least keep the wife and mistress from meeting). The mistress had no idea why she was being held at the time. Officially it just looks like she was held and deported for no good reason at best - or profiling at worst.

Of course in a small community, it's not in the news even though everybody knows it, on paper it's "see no evil, hear no evil, speak no evil."

I felt a tremor in the force

[DoofusOfDeath]

As though millions of divorce lawyers just orgasmed at once.

Re:Lol

[zlives]

you forgot to add the recurring charges ;) in your equation

My sexual preference

[Snotnose]

is "yes, please"

Re:useful

[CauseBy]

All computers are vulnerable. The most secure systems in the world can be hacked. This one might have been insecure, but that isn't demonstrated just because it got hacked.

To avoid blackmail

[snizzitch]

... Let's all just go read all of the data for anyone we know, right now. Then there will be no potential for blackmail.

I've seen the popups for AdultFriendFinder.

[baenpb]

But I honestly never realized that it's a site people go to on purpose. I mentally categorized it alongside any sort of "Click here and we'll install adware for you!" ads. Has anyone here had success using this service? Is it "cragslist-y"? I don't intend to start using it, just curious.

Re:I've seen the popups for AdultFriendFinder.

[Anonymous Coward]

My wife and I have used it for years, but we are swingers and that seems to be the main target audience for this kind of site. We've met people over the years, had great experiences and a few bad ones, but we're still very active on AFF and continue to use it as paying members. There aren't many alternatives unfortunately, and while it definitely has that "cheap site that installs adware" feel based on the advertisements, the actual site is fairly decent and not that much different from Facebook.

The only other real alternative to AFF is swinglifestyle, which is probably about the same size and has most of the same members. We're paying members to both sites, but swinglifestyle is definitely more low key and doesn't really advertise much.

Re:That raises the question

[random coward]

Also implicit is that the only real sin is hypocrisy. Its okay to live an immoral lifestyle; but how dare you hold up morality and yet fall short. So its okay to be a Bill Clinton and dip into the intern pool, but don't be a Larry Craig and be for morality and tap your foot in the bathroom.

Re:useful

[gstoddart]

What joking? I wasn't joking.

I totally think delivering ass-whoopings to MBAs and CEOs for corporate malfeasance would solve a lot of problems.

Because it would be better than this "non est mea culpa" shit we have now where CEOs issue some drivel apology and have no consequences.

I'm not joking at all.

Re:Lol

[Anonymous Coward]

and a dog

So you couldn't have gotten a dog without match.com?

Re:This is why adultery is wrong

[Curunir_wolf]

Either that or be open about it. It is hard to blackmail someone over something that is public knowledge.

Huh. Apparently, you're right. You can be a 50-something politician and have an affair with the 17-year-old daughter of one of your law clients, get a plea deal to misdemeanors instead of a felony, and it's okay as long as you come out with it a couple of years later, present your new baby, and talk about your ambitions to be a leader in the state senate. Truth is stranger than fiction.

Re:useful

[pr0fessor]

Are those public ass-whoopings, like getting spanked with a paddle in the town square?

Re:useful

[Billly Gates]

How about about a nice bonus for those in charge for firing those horrrible cost centers who provide no value and caused the leak. So smart. Not all scarce talent can be so gifted.

Re:useful

[ksheff]

caning and flogging them would be ok.

You don't say...

[Anonymous Coward]

Direclty from the article:

The front page of Adult FriendFinder, which is based in California, features photos of dozens of attractive young women. Yet the hacked data, contained in 15 spreadsheets, reveals how few females appear to use Adult FriendFinder.

Among the 26,939 users with a UK email address, for example, there are just 1,596 who identified as female: a ratio of one woman to every 16 men.

This right there is why when I was single I gave on regular dating sites and completely avoided the adult dating sites. Much easier to meet people in person and significantly less competition.

Not to mention the unrealistic expectations of not just a woman, but a woman that has 10k guys sending her emails. The poor girls end up randomly clicking emails because most of them are the same anyway and there are way to many of them. Good luck.

Re:useful

[ATMAvatar]

Sure. Of course, you're going to prove that it was a management directive, and not just plain old IT incompetence or malice that led to "deleted" profiles being left around in the system, right?

If the IT guys are partly to blame, they should be lined up right alongside their managers for those whippings. And I'm pretty sure that you'll find more often than not that the IT guys are just as clueless and incompetent as their clueless and incompetent bosses.

Irrelevant.

Obviously, if it was a management directive, it's management's fault. However, if the lack of security is due to ignorance/incompetence on the part of IT, it's still management's fault, as it's their job to hire and/or train IT for security (and fire if necessary).

Internally, management is free to assign blame and take action against IT, be it through improvement plants, pink slips, or (in the case of malice) lawsuits. But make no mistake - management holds final responsibility - that's part of being in leadership.

Re:Lol

[ATMAvatar]

you forgot to add the recurring charges

He mentioned the wife and kids, and then stated the $99 is negligible in comparison. What did he forget?

Re:This is why adultery is wrong

[rubycodez]

remember the politician not wanting to be caught in bed with either dead 17 year old girl or live 17 year old boy

blackmailing cheaters

[HughJazz]

Those that would blackmail cheaters of course should be treated as criminals as their motives are greed. However, if they happened to put that information all over the Internet I would applaud it. Cheating on a spouse isn't a crime but as close as you can get to one without actually being one. The emotional suffering, that can last for years, that unethical knuckleheads cause their spouses hurts their own children as well. People that are married and cheat not only deserve to be exposed but it's a moral imperative that they are exposed. .

Re:NO! Not my IP address!!!

[antdude]

Me too, but with 127.0.0.1! D: