News for hackers. Stuff that matters.

A comment on How to boost your popularity on OkCupid using CSRF and a JSON type confusion. Parent comment

Re:How to boost your popularity on OkCupid using CSRF and a ... by Johnny555 on Monday August 02, 2021 @05:26PM (#28042887)
A horrible take on how much value is there in taking over people's OKCupid account?

If there's literally no value in taking it over, then why password protect it in the first place?

I have an online photo album and while I could password protect it and share the password with people that I want to share it with, there's very little value (perhaps there's some small social engineering value) in protecting it. If there's no value in exposing it, why bother password protecting it?

[ Parent | on HN ]
Re:How to boost your popularity on OkCupid using CSRF and a ... by AnIdiotOnTheNet on Monday August 02, 2021 @05:29PM (#28042926)
It's a bad take because you made it sound like I said it was worthless, when all I implied was that it isn't worth much. There's a difference.
[ Parent | on HN ]
Re:How to boost your popularity on OkCupid using CSRF and a ... by Johnny555 on Monday August 02, 2021 @05:32PM (#28042958)
I took your reply as meaning it has so little value that there's no reason to or even harm if someone takes it over.

Did you mean that it's valuable enough that someone should protect it, but shouldn't bother protecting it too much (like, anyone with the URL should have access to it) since it has little value? I'm not sure I really understand the nuance, but I'd be awfully surprised if I forwarded an email to someone from OKCupid and it gave them passwordless access to the account.

[ Parent | on HN ]