OKCupid Blind Date App: Beware Privacy Flub

Smartphone users looking for love online may have gotten more than they bargained for.

Online dating site OkCupid.com Tuesday launched a new app, dubbed Crazy Blind Date, that promises to use "math to set singles up on blind dates with only a few hours notice."

"We hide your date's identity," reads the pitch for the service, which is available via both an iPhone and Android app. "Don't worry, their face won't be scrambled in real life."

Unfortunately, OkCupid -- which was bought in 2011 by Match.com owner IAC/InterActiveCorp for $50 million in cash -- failed to scramble the app's data feed. According to a Wall Street Journal investigation, the app's API could also be used by outsiders to expose any user's email address and birthdate, as well as their first name, gender and actual photo.

[ Businesses that rely on Java must now take additional steps to keep employees safe. 10 Facts: Secure Java For Business Use. ]

"It was essentially a typo, and really inadvertent," OkCupid CEO Sam Yagan told a Journal reporter, who Tuesday was apparently the first to inform the company of the vulnerability. Yagan said there was no evidence that anyone had hacked the OkCupid feed -- which would have required only sniffing the app's Web traffic -- before OkCupid put a fix in place later that day. The fix restricts the API to only transmit a user ID, subscriber's first name, gender and profile photo, as well as their desired partner's gender.

In light of the information that still gets transmitted, Ars Technica recommended that Crazy Blind Date users employ a unique email address for the service and also fudge their birthdate by at least a few days to make it difficult for overzealous blind daters -- or anyone else -- to positively identify them via the smartphone app.

In other online dating and privacy-related news, Canadian real estate developer -- and Ferrari lover -- Lorne Leibel last week saw his temporary injunction against his ex-girlfriend, Michelle Vrasic, get dismissed, except for a "no contact" provision remaining in effect between the pair.

Leibel had sued Vrasic for defamation, cyberstalking and violating his privacy after she authored an unflattering website and book about him. According to a Florida District Court of Appeal ruling, "some years after the end of their romantic relationship, Leibel sued Vrasic, alleging that, in the intervening years, [Vrasic] had engaged in a pattern of harassment, i.e., she hacked into his email -- sending offensive letters and a naked photograph of him to those on his contact list -- and created a website, using his name, to pre-sell her book and to post an excerpt that included defamatory statements about him."

"Vrasic didn't challenge the no-contact order, but challenged the injunction, and the court held that the injunction violated the First Amendment," said UCLA law professor Eugene Volokh in a blog post. He said that the ruling "strikes me as quite correct," especially since the injunction had been issued before the trial, and wasn't based on merit.

But for anyone who seeks to publish a tell-all about a former partner online or in book form, beware. "These sorts of restrictions on speech about a person have become more common in trial courts in the last several years," he said.