Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
A Retrospective on the 2015 Ashley Madison Breach (krebsonsecurity.com)
84 points by Vaslo on July 27, 2022 | hide | past | favorite | 77 comments


You have to be in awe of the level of deception necessary to generate $115M in revenue on a site with 84% male users, and only 1% of female users at all active. This gives crypto a run for its money.

I guess it's easier to justify to oneself scamming people acting immorally. Or there's no recourse for people who get milked by the company. Who is going to contest charges linked to cheating?


I have a gut feeling that there are many fake accounts on other dating sites as well. One thing I've noticed with tinder in Israel. you will see profiles of presumambly "jewish" women (i.e. jewish names / hebrew writing) where it says their university is al quds university or al aqsa university.

While its conceptually possible that a jewish woman might have attended them, I find it somewhat implausible (especially in number and combined with the style of pictures). Its as if someone just created profiles randomly that might fit the general geographic area.

The primary Q I would have is if this is generated by Tinder itself or by external scammers who don't know better.


> The primary Q I would have is if this is generated by Tinder itself or by external scammers who don't know better.

I would strongly suspect the latter. The former could get them sued for securities fraud in the US (because everything is securities fraud in the US).

It's much easier to justify a slip up in your spam / scam prevention than to justify actively scamming your users yourself.

The former keeps your hands clean in front of a judge.


Considering what shenanigans uber did to fool govts around the world I wouldn't be surprised if some Tinder execs got into a private meeting and agreed to pay some 3rd party to create fake profiles for them. wouldn't exactly require extraordinary opsec to achieve


But why would they, if they don't have to? Why run the risk?

Third parties were already creating fake profiles (for scamming etc). Then all Tinder has to do, is carefully deciding on how exactly they fight those fake profiles, to apply 'evolutionary' pressure in a direction they like.

No need to get their hands dirty.


To me it seems there's very little risk and if you want to break into a new market you gotta do what you gotta do


What do you mean by very little risk? This could get you sued to high heaven.


Interesting strategy and certainly [legally] safer than Match paying women to string lonely men along.


I saw some of this strategy myself (in much more benign form):

In any job, when we are doing any monitoring of any process (technical or business process), and the numbers look bad we investigate until we either find and fix the root cause which might be a genuine problem or a problem with the monitoring.

If the numbers look dandy and the system ain't obviously on fire, we don't spend sleepless nights looking for the possibility that we are having both an underlying problem and a problem with the measurement at the same time.

You can see that given these incentives, and enough random variations, the system can drift over time, without anyone acting in bad faith or fraudulently.


The idea that people would be too shamed to sue was also part of the scheme for other grifts, but it didn’t always work:

https://www.nbcnews.com/news/amp/wbna6973990


Do you know what percentage of the male user base was active?


I don't believe the article mentions it, but apparently plenty enough to generate that kind of top line.


That's believable. It's not like most people would be terribly motivated creating an artificially inflated supply of millions of fake dicks online...

...The only group I could imagine being motivated to do it would be a spouse's union, paying a water army to DDOS "watering holes" for affairs with honeypots, which report anyone caught attempting to cheat to a collective database for identification and confrontation.

But I think this would be a waste of resources in today's world - the high profile breach was probably enough to prevent anything as big as Ashley Madison from rising to prominence for a long time yet. And those motivated enough to have an affair would adjust to seek another path. It could definitely have a negative further overall effect on marital trust.


People just use normal dating sites these days.


One-timers who got scammed. I mean there were basing women at all. (They don’t say how many of the “1%” were scam accounts or sex workers.)


Did Ashley Madison allow for gay (man with man) matching? If so, the 84% and the revenue don't sound so out of proportion.


Gay/bi men are almost certainly underrepresented on primarily-hetero dating sites, or at the very least are not overrepresented. I'm pretty sure the vast majority of the 84% were heterosexual.



It’s a site based on deception from the get go. I don’t know much about the site or owners, but I wouldn’t assume that it wasn’t another sort of business including a pure scam.


As the great poet Ice-T once postulated, pimpin' ain't easy.



Krebs is really the Cramer of infosec. He's really cheesey and not the Krebs of yester-year. I have a hard time reading or trusting his stuff.


Could you provide a more substantive critique of this article? It seemed to me like novel and worthwhile reporting.


Leaked data should be trusted with a grain of salt. ALM has not confirmed the full authenticity of this customer list. I find the results to be plausible. If motivation to shame was intent, curating the list is a possibility not discussed even though they mention a few radical actors.


Thanks! I agree with that overall point--the possibility of accounts being withheld and/or of false inclusions is an interesting one and worthy of discussion.

That said, while there are doubtlessly many people who read this article and thought something like "why wouldn't you immediately call out the possibility of curation / manipulation of the data released?", and they're right that it's worthy of calling out, I think the more important fact to remember is that Krebs's work got us here.


You know what the strongest form of infosec is, in this domain?

Not having an affair.

It's been said a woman needs a man like a fish needs a bicycle. I say a human being needs an affair like a bug needs a zapper racket.


Their tagline - "life is short, have an affair" - is fairly compelling. You have one life, and romance is one of the great human experiences. Many people don't have the opportunity to experience that in their current relationship, while still having good reason to remain in that relationship.


When people talk about romance being one of the great human experiences, they don't tend to mean online hook-up sites, particularly not one focused on cheating. The 'great human experience' bit isn't just about the physical side of things.


I've heard that a lot of the time men are cheating to get sex, and women are cheating for the emotional romantic side of things.

I think the GP is aimed primarily with sympathy for the vast minority of female users, and perhaps an uncharacteristically more emotional subgroup of male users, implicitly baked in.


I don't get this, there are a lot of other ways to take risks to have fun. Like motorsport or adventure travel. Stuff that you can brag about after, which is way better than the pressure of keeping a secret.


Some people like the pressure of keeping a secret.


Some people also like bragging about affairs.

¯\_(ツ)_/¯


it doesn't matter. if they arent happy then it's their job to go quit the existing one or even if the spouse wants to kinda stay together for kids make it clear they separating as a romantic couple. sneaking behind a spouses back is shitty.


More like "life is short have an antibiotic resistant Chlamydia".


[flagged]


Wait, what? What kind of insane suggestion is that? No one actively wants to catch a disease. And the health system should help not dispense moral judgement. Otherwise what I'm going to immediately ask is why provide help for people who smoke? Who drink? Who get into an accident when cycling or paragliding? Surely they were all just asking for it!

>>or at least make them pay for inpatient treatment so they can't do half the course and stop

I don't see how that follows.


[flagged]


>> they deserve some kind of punishment for imposing a fucking massive externality on the rest of us.

Hope you never get to a hospital only for some internet edgelord to say that you deserve a punishment and no treatment for you.

>>see how promiscuous ppl spread aids, now monkeypox.

Ah yes, promiscous people, the bane of human society. Is this coming from a religious angle, or just being judgamental in general?


gee i guess you missed the past months of ppl saying shit like "if you didn't get vaxxed then u shouldn't get hospital treatment". which is fine i don't rly disagree. i'm only after promiscuous ppl here because they're causing antibiotic resistance in some pretty disgusting conditions and spreading new shit like monkeypox. y'all can't argue not wearing a mask should be punished unless u want to argue not wearing a condom also should be.


>>y'all can't argue not wearing a mask should be punished unless u want to argue not wearing a condom also should be.

That some ridiculously dishonest take on the whole issue. Especially monkeypox isn't really prevented by condoms the same way HIV or chlamydia is.

>> i'm only after promiscuous ppl here because they're causing antibiotic resistance in some pretty disgusting conditions and spreading new shit like monkeypox

You just sound like the people from Reagan era(tbh there are people like this nowadays too) who kept on saying that if it only wasn't for those filthy promiscuous gay people having their disgusting gay sex, AIDS wouldn't be a problem! Think about all the money this is going to cost the public taxpayer! In fact there were people suggesting not treating any HIV positive people, to discourage people from being promiscous!

Just....keep your insane moral judgements out of my healthcare please.


[flagged]


You completely missed the point I was making, which is that you are just using a group of people to justify denying healthcare to some - like it was done with gay people and HIV. You're just targeting self defined promiscuous people instead, ignoring the fact that some people get those diseases never having slept with anyone, or having a stable partner. But sure let's deny them care because you feel like some punishment is in order.

I feel like my punishment today is arguing with someone like you on the internet, I don't know why I'm doing it to myself frankly.


shit like monkeypox is spreading mostly from promiscuous ppl rn. im saying ppl who do that and spread it need to be punished. like if ppl can get fined for not wearing a mask and spreading covid why is this any different. literally.

tbh the feeling's mutual.


Smoking is costing us more than aids and monkeypox, I'm sure.


yeah thats why i said we shouldn't be paying for them neither and working on social pressures against that behavior. but some how condemning recklessly promiscuous behavior isn't ok b because it's not pc or whatever.


>>some how condemning recklessly promiscuous behavior isn't ok b because it's not pc or whatever.

It's not about being PC you crumpet, it's about having a shred of human empathy. You can practice safe sex and still get any of those diseases, having them is not a proof you weren't careful or that you were taking unnecessary risks.


> you can practice safe sex and still get any of those diseases

having sex with like 10 ppl in a weekend is never safe sex. i don't care what protections u think are helpful. the reason those diseases get spread into the general population is bc some ppl are stupid promiscuous and not safe. there should be consequences for that. nobody needs to sleep around that much so no i don't have a lot of empathy for it. literally pick 1 person for a while and stick to them that will fix most of it.


I honestly wonder how someone can be such an idiot. How would you go about limiting antibiotics to those with an STI? Would you limit them if it were a case of rape? If not, then how would you prove it?

The most common communicable bacterial STIs can be treated with single dose regimens, so why don't you do some cursory research before disseminating your shit takes.

Use your brain for once, because you're acting like an utter moron. And maybe try to type out normal English. You can't be so lazy as to not be able to type out "you".


Lol, I can't even find someone to fall in love with and here's this website :-(


You have the capacity to love and be loved man.

I suggest changing where you are looking for people, hanging out, or just doing new things. If the places you are looking have nothing for you, change where you are looking.

You got this man.


This is sound advice.


theres places u can find ppl. online dating aint that great, heres some that i seen work:

* religious organization

* hobbys

* service (lots of hot young chicks volunteer at animal shelters)

and tbh even if u dont find a girl right away you'll still get smth from all of those. keep ur head up king.


I wonder what the overlap of people is that: 1) are in a tizzy over promiscuity among adults, 2) advocate for organized religion, and 3) target 'hot young chicks'.

You are a unique individual, I think. That said, maybe start thinking of women as human beings.


No idea about (1), but years ago I used to work with a pretty attractive and wholesome guy who was prrtty popular in the office who fit (2) and (3) to a T.

I think the best way to summarize what I mean, I once got invited by him to his church, and the only reason he stated was "that's where all the hot girls are". I found it to be a pretty solid reason, and his assertion definitely aligned with my previous experiences with the matter, but I had to politely decline. Mostly because I felt pretty awkward about going as a non-religious person, and I knew he was actually pretty religious.


lmao

1. i'm not. it rly doesn't bother me except for the tiny group that will go sleep with like 5 or 6 ppl in a short period and causes problems. idgaf what ppl do otherwise just saying its a public health problem.

2. i'm not a huge advocate of organized religion im just saying it's a good place to meet potential partners and i seen it work.

3. i'm young so uhh yeah? i like hot ppl like almost everybody else and i like women so uhh there's why i guess. not "targeting" but that's who i like to date lol. just bc there's a public health problem with ppl hooking up with like 5 ppl in a weekend doesn't mean i got anything against dating.

> You are a unique individual

thx bro

> start thinking of women as human beings?

uhh what? idk how i gave the wrong idea about this.


You have no actually good reason to remain in your relationship if you're a lying adulterer. You only have evil, selfish reasons.


Everyone's different, and every relationship is different. Sometimes people get trapped, either by money or laws or something else. It's human nature to make judgements about other peoples' relationships, but unless you're in a relationship it can be hard to see the forces at work.That's often true even if it's your own relationship.


Okay, nuance et cetera, but can cheaters have the basic human decency to recognize that they're making a choice which is harmful to their family in order to benefit themselves? Or is that asking too much self-awareness?


Really, it might not be harmful to their families, beyond harm that's already happened. Marriages are complicated. For example, some marriages are essentially financial arrangements, maintained by both parties despite romantic betrayal. Some marriages start as romatic arrangements, but morph into marriages of convenience, or are maintained "for the sake of the kids".

And sticking with a broken marriage "for the sake of the kids" isn't always the wrong thing to do. It depends.


I would then argue that that's not cheating.

Cheating involves deception, the deception is telling your partner that they're your exclusive romantic interest when they're not. If everybody knows and everyone is fine with it, then there is no problem.


I'm not sure GP is arguing for a negotiated open relationship, since this whole comment tree is about affairs.

I figured the idea was more "having an affair can be OK if you really need it because your marriage sucks, divorce and a negotiated open relationship are not viable options, and provided no one finds out"


[flagged]


> that 12 year old was coming into me

Phrasing is wrong here in a bad way.


Go watch some of the police interviews of pedophiles. That’s what they say.

But again, people come up with excuses all the time for things they know are wrong. Doesn’t change the fact that those things are wrong.


I think they were referring to the typo “into” vs “onto” which changes the meaning of the sentence dramatically


Kids is a popular excuse. See also fucked up divorce laws, etc. See also the good intentions pavement system so well known on roads leading to hell.


there's plenty of couples that are amicably separated and take care of their kids fine, even some who still share a house (though not many tbh). besides it's still their fault for having kids without being sure they can handle the comittment then not being willing to stick with it.


> without being sure they can handle the comittment then not being willing to stick with it.

that bar is so high, I applaud anyone who can even comprehend it.


Kid's'd be better off with a repressed parent, or an impoverished deserter parent, than a cheater. Cheating kills the trust in both parents, because the cheater becomes a disgusting liar and the one cheated on will likely be seen as too weak or otherwise unfitting, to be a good role model. Either way the child will doubt the value of the parents they even came from. That really leads to hell, for the whole family.


Quite a yarn you're spinning. But can it be even more reductive and clichéd?


I sense a religious undertone... The type that would force the sanctity of marriage at all costs to avoid 'sin' and save face with God. Maybe also with some warped victim blaming and sexism thrown in for good measure, topped with a generous helping of sanctimony.

Maybe...


Yeah, yeah,

"Up yours woke religious moralists. We'll see who condemns who."


[flagged]


based. cheating on a spouse is shitty and degenerate. if u wanna go hook up have the balls to dump ur wife first and actually pay the alimony n shit involved instead of doing that. shitty behavior from shitty ppl.


Yep. ITT:

Man-hoes mad.


I just yesterday skimmed the documentation for statsmodels weighted generalized linear models and they use data from an affair study there: https://www.statsmodels.org/devel/examples/notebooks/generat...

I have not looked at the original study, but from what I gather from the results basically nobody is having an affair (the median for time spend in an affair is still 0, the 3/4 quantile is still only 0.48 (time units) and the maximum is 57.60 (time units)).

I am not sure what "time units" is ... it is probably in the original paper, but I did not bother to look that up. Even if it is years, that would mean that 75% of the people spend less than half a year in an affair over their lifetime. Once married this drops significantly and reduces further over the years of marriage.


I think my wife has a rather binary view on affairs. Doesn’t need to be long, sustained, or repetitive. I’d wager many wives would be livid just by the presence of an account on AM even if no physical cheating occurs. Just the fact it was sought out or investigate is going to cause a riff in the relationship.

Also if the models show nobody is cheating, the data should be considered suspicious. Maybe the word “affair” is an issue. It insinuates a long term situation when really a lot of this falls under hookups/prostitution.


> Also if the models show nobody is cheating, the data should be considered suspicious.

Possible ... when the cost of getting caught is high, even if it is just a perceived risk, I would expect that people "cheat" on those questionnaires.


Exactly. I wouldn’t trust this data to be truthful to begin. We’re talking about the “worlds oldest profession”, I’d need proof of that. Even a place like Saudi has a known practice and general understanding that sinning goes down in Bahrain. The traffic on the bridge is all the evidence I needed to see in order to believe that.


In some religious circles the mere thought of someone else is adultery. (Like you can get a divorce because they looked at others at the beach too often.) Which seemed extreme to me even when I used to believe.

Oh and if you're single and 'lust' after someone else then you're also eternally damned. That always made ~dating~ [courtship] awkward.


"Just don't have an affair". Righto, that'll fix it, because nobody who has an affair currently knows it's wrong /sarc


Is someone even in the domain if they aren't seeking or having an affair?

The advice comes off as "best way to avoid being robbed is to never have anything of value".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: