Online dating services: Risking more than a broken heart

People looking for companionship are trusting online services more than ever. Is that trust misplaced? Michael Kassner looks for the privacy and security gaps in online dating.

I'm single. But I have friends, and depending on which ones I'm with, either they're jealous or consider me to be a lonely guy. As of yet, I haven't figured out who's right.

Perfect storm

The "should Michael date" debate came to a head recently; both sides were represented at a gathering I attended. One well-intentioned friend started the melee, suggesting that I join an online-dating service being that I'm a digital kind of guy. A member in the opposite camp volleyed back -- signing up takes forever. There have to be at least 10 forms to complete.

I was about to ask how the person rebutting knew that. Thankfully, for once I decided keeping my mouth shut should overrule curiosity. It got me thinking though. That's a lot of sensitive information traversing the "wild and woolly" Internet. How safe a trip is it?

Investigative mode

Sensing a way out, I told my helpful friends -- hinting at my sacrifice -- it's my duty to insure all Personally-Identifiable Information (PII) is safe from prying eyes. So, I'll check it out.

I didn't have to look far. The Electronic Frontier Foundation (EFF) is all over this. From their perspective, there's work to be done. In the post "Six Heartbreaking Truths about Online Dating Privacy", Rainey Reitman points out the areas of concern for my pro-online-dating friends.

Here's the scoop. Reitman divided deficiencies into categories. Below is an overview of each:

Your dating profile -- including photos -- can remain visible after cancelling the account. It seems lots of people have a change of heart and decide to reactivate their account. So most dating services hang onto the profile long after the person has left.

Another concern involves photos and how they are stored. Many dating services off-load photo storage to Content Delivery Networks. Joseph Bonneau, Ph.D. candidate at Churchill College at Cambridge UK, explains:

"The main website provides an obfuscated URL for the photo to anyone it deems has permission to view it. But, removing the photo from the main website didn't always remove it from the Content Delivery Network. This means that Content Delivery Networks can maintain caches of sensitive photos even after users "delete" them, leaving photos vulnerable to being rediscovered or even hacked in the future."

Vulnerabilities exist, particularly among mobile dating sites. One example was a security flaw that allows an attacker to locate dating-service members -- using GPS technology -- without them knowing. Profiles can be  indexed by search engines. Apparently some -- not all -- sites publicize profiles, meaning they can be indexed by search engines. Reitman mentions that WikiLeaks' Julian Assange fell victim to this because of his Okcupid profile. Pictures can foil attempts at anonymity. Until reading this article, I haven't paid much attention to how good photo-identification services have become. You can try all you want to anonymize your profile, but if there's identifying information associated with a picture you upload, it's all over.

Reitman suggests using either TinEye or Google Image Search to see what information is provided with the photos you intend to upload to the site.

Your data is helping online marketers. This is a sticky subject. I've tackled it numerous times. Depending on which side of the fence you land, targeted advertising is either good or bad.

There is one area you should be concerned about -- that is the selling of supposedly sanitized databases to third-party marketing firms. Regardless of the anonymized claim, when multiple databases are melded together, it is possible to isolate individuals. Dr. Arvind Narayanan a privacy expert at the University of Texas convinced me of this when I was working on "Electronic databases: What's new with privacy concerns."

Online dating sites do not use HTTPS. The EFF examined eight popular online-dating sites with regards to HTTPS. Here are the results (courtesy of EFF).

Only one, Zoosk, uses HTTPS by default. EFF mentioned some of the sites use HTTPS for logging in, then shut it off. That's not good as sensitive traffic is still exchanged after the login.

The chart also shows which sites serve portions of their content unencrypted. That's not good, images or profiles could be transmitted in the clear. Again, only Zoosk used a secure connection for all traffic.

Also of concern, not one of the tested sites used secure cookies. Blog author Marcia Hofmann explains why that's bad:

"If the cookies are not "secure," an attacker can trick your browser into going to a fake non-HTTPS page (or just wait for you to go to a real non-HTTPS part of the site, like its homepage). Then when your browser sends the cookies, the eavesdropper can record and then use them to take over your session with the site."

Hofmann also mentions that stealing information stored on cookies is easier than ever with the advent of Firesheep, a Firefox extension designed to capture unencrypted cookies and display the information in the web browser.

Things to check

First and foremost, EFF suggests reading the site's privacy policy before you sign up. Look specifically for:

  • How the data involved with deleted profiles is treated.
  • How the site informs members of changes to the privacy policy.
  • How to limit access to site members if profiles are made public.

I personally don't read privacy policies, they're cryptic by design. If I have a question -- no matter how slight -- I call and get clarification. How the service provider handles my inquiry in itself is an indicator.

If you have concern or are dissatisfied, Reitman suggests filing a complaint with the Privacy Rights Clearinghouse's Online Complaint Center.

Final thoughts

I just emailed the research for this article to my friends advocating online dating. It will be interesting to see what their next step will be.