Slashdot Mirror
Adult Dating Site Hack Reveals Users' Sexual Preference, Extramarital Affairs
An anonymous reader notes this report from Channel 4 News that Adult FriendFinder, one of the largest dating sites in the world, has suffered a database breach that revealed personal information for 3.9 million of its users. The leaked data includes email addresses, IP addresses, birth dates, postal codes, sexual preferences, and information indicating which of them are seeking extramarital affairs. There even seems to be data from accounts that were supposedly deleted. Channel 4 saw evidence that there were plans for a spam campaign against these users, and others are worried that a blackmail campaign will follow. "Where you've got names, dates of birth, ZIP codes, then that provides an opportunity to actually target specific individuals whether they be in government or healthcare for example, so you can profile that person and send more targeted blackmail-type emails," said cybercrime specialist Charlie McMurdy.
sorry, gotta go.
Given that their list of choices for sexual preferences doesn't include tentacle-on-pregnant furry futanari, I think I'm pretty safe.
You could encrypt all the data in the database, but that would only protect you from somebody able to access the database but not any of the decryption code (somewhat unlikely).
Assuming full access to the database and code, is there any way to protect against being able to link identification with the rest of the personal information.
I can only come up with the obvious client-side encryption, but will the network as a whole still be able to use the data as it's supposed to (in this case; find adult friends)?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
After the last big hack I had to give up my old IP address, 192.168.0.1, which I had used for years. What a pain!
Hopefully some of the users that will be approached will not be good candidates for blackmailing; because they already got out of the relationship they were trying to cheat on or have already come out of the closet with whatever sexual kink they have.
Hopefully those users will contact police when they receive blackmail attempts and will aid in netting whoever is behind this
Our government is out of control anyway, anything that allows blackmail, removal from office, misery in their lives. etc is a good thing
While we're at it let's extend it to programmers, DBAs, sys admins an designers who cause us so much misery because they are too stupid or lazy to build secure systems.
I'm a consultant - I convert gibberish into cash-flow.
Oh no, now everyone will know I'm a white male age 18 to 49!
Most linux users don't know this, but the man pages were named after Chuck Norris. Chuck Norris fsck'ing hates noobs!
I've had a look at the data, there are very many easily identifiable people, for some of those there is date-of-birth data, ZIP code, "preferences", details of any money spent etc. There are a few people using their .gov email addresses for this, some of those can be verified by the IP address, some other email addresses belonging to other corporations. I would suspect that those are the people who are most at risk of blackmail. Remember too that an email addresses can be used to look people up on Facebook, which would make it easier for blackmailers to find potential victims.
Not revealed in the breach (so far) are credit card data, real names (although many are obvious from the email addresses) or passwords. Although I notice that some people were smart enough to sign up with a throwaway email address, if they have actually paid for anything then they would have had to supply real contact details somewhere.
The background story appears to be that a pissed-off affiliate who claims they were owed hundreds of thousands of dollars had a contact hack the database. It seems the hackers are demanding money else they will release the rest of the data.
Never email donotemail@WeAreSpammers.com
And, of course, let's not stop there ... let's move to the managers, executives, and sales/marketing assholes who force this shit out the door.
The poor bastard of a programmer who has been told by the VP or the CEO (or the sales wanker) that the product must ship now, or that security doesn't matter is not always the cause of this. Sometimes they're the ones saying "umm, guys, this could be a problem".
So, if we're assigning blame, let's go with the people who are actually to blame and who make the decisions.
In the military, "just following orders" may not be a defense. But in private industry it's often the management who create these problems.
Which is precisely why I say that corporations should be held to a legal standard for the protection of personal information, and should carry penalties for failure to do so.
As long as corporations just say "oh, bummer dude" and have no penalties, they'll continue to cut as many corners as possible. Because there simply is no consequence for them.
I'm as concerned about the management people who don't give a damn. Because they're the ones who make policy and decide that not sucking at security is too costly.
So, want a secure internet? Kick an MBA or a CEO in the nuts, and tell them you'll keep doing it until they insist on secure code.
Lost at C:>. Found at C.
You're confused, no one cares what they do in their spare time. In fact, the ones I've worked with that use the services of whores like to talk about it.
Oh god yes this please. Fuck all the blackmail stories; there's a sociologic goldmine in this data. Dissertations will be written on this for years to come.
my god, people, if you are going to use a site like that, don't use your real name, work email address, etc.
consider that *everything* is going to get compromised -- if it is not already. use some common sense.
there are 3 kinds of people:
* those who can count
* those who can't
If you're gonna cheat, why do it on the Internet? People who continue to trust the anonymity of the web boggle my mind.
The physical world doesn't offer much anonymity either. At least the Internet offers more choices. Just don't use your real name, or primary email address, and you'll be fine.
Actually, there are some clearly invalid or mis-typed email addresses in the list (e.g hotmial.com). So I am guessing that the addresses were not confirmed by the AFF system.
Never email donotemail@WeAreSpammers.com
This is horrible.
It goes something like this:
Male, male, male, male, male, male, male pretending to be female, male, male, OMG what's that.
Never email donotemail@WeAreSpammers.com
I think I had an account but like all adult sites I sign up for I used a throwaway email, lie about my age and location, and only show my dick and balls in photos.
And no will recognize the dick and balls as I'm a virgin in my 30s.
exactly, I wonder who was dumb enough to create a profile saying "Dave Brown of 22 Acacia Avenue AB1 3CD, wants to meet nice ladyboy for extramartial affair"? It'll be "single male, BigBrownie, of 1 nowhere place, wants to meet nice ladyboy"
And as for the spam emails, I have a couple I use for all kinds of dodgy sites (eg slashdot) and I get loads of spam anyway.
Still... .9 million users... that's a lot of people! I wonder why these dating sites charge so much per month for membership when they could just charge $1 and rake in the cash. Stack 'em high 'cos extramarital affairs are never going to go out of fashion - the only problem is ending up meeting your blind date and finding it's your wife!!
Either that or be open about it. It is hard to blackmail someone over something that is public knowledge.
while(1) attack(People.Sandy);
In the Ars story about this they pointed out a website that tracks beaches that I hadn't heard of before: ';--have i been pwned?
I plugged my email addresses into this and found out that I had been a part of the Adobe breach fro October 2013. And I don't remember Adobe telling me about it
I am Slashdot. Are you Slashdot as well?
Exactly. Be French about it.
You're looking for quotes? See my journal.
Joking aside, the managers, executives, and sales/marketing assholes should be strung up for telling people your data was deleted when in fact it wasn't.
I wonder why these dating sites charge so much per month for membership when they could just charge $1 and rake in the cash.
A higher fee is an effective filter. The "free" sites are garbage, with lots of phoney or dead profiles. I paid $99 for an annual membership to match.com, met several nice girls, married one of them, and I now have a wife, two kids and a dog. Compared to all the other expenses I have incurred, the $99 is negligible.
Your never going too get you're weigh on this. Their are just two many people out they're using there words wrong too get to upset. Sew don't loose you're cool about it. You can sea mini common examples that exist of incorrect usage. People pick the write words two use according too there porpoises. But you'd have two be a fool to begin or end a sentence with the word "but". And only an idiot would begin or end a sentence with "and". And a preposition is a very bad word too end a sentence with.
I'll see your senator, and I'll raise you two judges.
I paid $99 for an annual membership to match.com, met several nice girls, married one of them, and I now have a wife, two kids and a dog.
What kind of weird ass genetics do you have that you + wife = kid + kid + dog?!?!?
That could happen if you both enjoy Piña Coladas and getting caught in the rain.
Where does the school board find them and why do they keep sending them to ME?
And if I do it, it opens me up to getting my throat slit in my sleep.
You are welcome on my lawn.
Agreed. A while ago there was a big stink kicked up locally because a government official's mistress was about to fly in but his wife found out and was going to catch her, so he called the customs officials and had the mistress held at the airport and then deported to keep his affair under wraps (or at least keep the wife and mistress from meeting). The mistress had no idea why she was being held at the time. Officially it just looks like she was held and deported for no good reason at best - or profiling at worst.
Of course in a small community, it's not in the news even though everybody knows it, on paper it's "see no evil, hear no evil, speak no evil."
"When information is power, privacy is freedom" - Jah-Wren Ryel
As though millions of divorce lawyers just orgasmed at once.
you forgot to add the recurring charges ;) in your equation
is "yes, please"
Also implicit is that the only real sin is hypocrisy. Its okay to live an immoral lifestyle; but how dare you hold up morality and yet fall short. So its okay to be a Bill Clinton and dip into the intern pool, but don't be a Larry Craig and be for morality and tap your foot in the bathroom.