OkCupid has no love for user privacy

OkCupid, a free online dating site (and a great place to meet weirdos of all proclivities), is putting user data at risk with its current data encryption practices, according to The Electronic Frontier Foundation (EFF).

An EFF report states, “Every OkCupid email, chat session, search, clicked link, page viewed, and username is transmitted over the Internet in unencrypted plaintext, where it can be intercepted and read by anyone on the network.” Which means that you might have blocked that trans-gender admirer Denise, but if she has any hacking abilities, she will could potentially read your sensitive internet interactions. Or, in a more Orwellian twist, OkCupid’s vulnerabilities could be used as an asset by governments to compile information on its citizens.

EFF states that OkCupid, which already offers a good deal of privacy controls, should offer the dating service in HTTPS, which provides encrypted communication and secure connections. In other words, HTTPS would help hide an Evangelical Christian woman’s searches for bondage enthusiasts, or a married couple’s quest for orgy fanatics.

As stated by EFF:

The failure to encrypt your communications exposes sensitive data in online profiles to eavesdroppers, who could snoop on the content of your profile to learn about sensitive topics like religious and political beliefs, drug use, and sexual practices. The failure to encrypt also exposes the HTTP cookie that’s used to authenticate you to the site, which means that the eavesdropper can actually take over your account and impersonate you, even without knowing your password.

The report cites a newly-released tool called Firesheep, which can be used on shared wi-fi networks to “take over web-based accounts on non-HTTPS sites”—something that can be done with basic eavesdropping skills. Firesheep is free, open-source and available now for Mac OS X and Windows; which means that it is very easy to acquire and use to exploit internet users.

To send a message to OkCupid asking the site to tighten its privacy controls and switch to HTTPS, head over to the EFF OkCupid petition page.