Tuesday, November 18, 2008

eHarmony.com potential issue

I believe I found a potential issue on eHarmony.com's site. It does not filter out or allow the subscriber to filter out people (s)he does not want to date such as relatives, exes (that would be funny, if the service matched you with your ex), etc. I looked at their website closely and did not see a filter of any kind. Since I don't use their service I cannot say for sure they don't have filters, but just reading the description of their service I did not see any.

The tricky part is to create a filter. One possible way is to have the subscriber create a "block list" of people who (s)he never wants to be a potential mate. This list could contain at the very least the person's first and last name. Maybe a middle name or initial. To rule out people with the same name you want to date, a birthday field could also be included so you don't get false positives.

Is this really a problem? It could be if you have a lot of friends or relatives who use the service. It is interesting to note that eHarmony does not do background checks. So, you could potentially be dating someone who is secretly stalking you.

Monday, November 17, 2008

Good Code, Bad Computations: A Computer Security Gray Area

ScienceDaily (2008-11-03) -- If you want to make sure your computer or server is not tricked into undertaking malicious or undesirable behavior, it's not enough to keep bad code out of the system. New research shows that the process of building bad programs from good code using "return-oriented programming" can be automated and that this vulnerability applies to multiple computer architectures. [more]
Basically, a hacker hacks a website for example and rewrites some of the existing code instead of injecting his own outside code on the website to do some potentially malicious behavior. Good job for the researchers for imagining the unimaginable.