A Retrospective on the 2015 Ashley Madison Breach | Hacker News Reader

A Retrospective on the 2015 Ashley Madison Breach

krebsonsecurity.com

84 pointsVaslo77 comments

You have to be in awe of the level of deception necessary to generate $115M in revenue on a site with 84% male users, and only 1% of female users at all active. This gives crypto a run for its money.

I guess it's easier to justify to oneself scamming people acting immorally. Or there's no recourse for people who get milked by the company. Who is going to contest charges linked to cheating?

Do you know what percentage of the male user base was active?

I don't believe the article mentions it, but apparently plenty enough to generate that kind of top line.

That's believable. It's not like most people would be terribly motivated creating an artificially inflated supply of millions of fake dicks online...

...The only group I could imagine being motivated to do it would be a spouse's union, paying a water army to DDOS "watering holes" for affairs with honeypots, which report anyone caught attempting to cheat to a collective database for identification and confrontation.

But I think this would be a waste of resources in today's world - the high profile breach was probably enough to prevent anything as big as Ashley Madison from rising to prominence for a long time yet. And those motivated enough to have an affair would adjust to seek another path. It could definitely have a negative further overall effect on marital trust.

People just use normal dating sites these days.

One-timers who got scammed. I mean there were basing women at all. (They don’t say how many of the “1%” were scam accounts or sex workers.)

As the great poet Ice-T once postulated, pimpin' ain't easy.

According to this it was Big Daddy Kane?

https://m.facebook.com/ComedyCentral/videos/i-know-black-peo...

Did Ashley Madison allow for gay (man with man) matching? If so, the 84% and the revenue don't sound so out of proportion.

Gay/bi men are almost certainly underrepresented on primarily-hetero dating sites, or at the very least are not overrepresented. I'm pretty sure the vast majority of the 84% were heterosexual.

One of many analyses of the data dump:

https://blog.binaryedge.io/2015/08/31/ashley-madison-a-concl...

It’s a site based on deception from the get go. I don’t know much about the site or owners, but I wouldn’t assume that it wasn’t another sort of business including a pure scam.

I have a gut feeling that there are many fake accounts on other dating sites as well. One thing I've noticed with tinder in Israel. you will see profiles of presumambly "jewish" women (i.e. jewish names / hebrew writing) where it says their university is al quds university or al aqsa university.

While its conceptually possible that a jewish woman might have attended them, I find it somewhat implausible (especially in number and combined with the style of pictures). Its as if someone just created profiles randomly that might fit the general geographic area.

The primary Q I would have is if this is generated by Tinder itself or by external scammers who don't know better.

> The primary Q I would have is if this is generated by Tinder itself or by external scammers who don't know better.

I would strongly suspect the latter. The former could get them sued for securities fraud in the US (because everything is securities fraud in the US).

It's much easier to justify a slip up in your spam / scam prevention than to justify actively scamming your users yourself.

The former keeps your hands clean in front of a judge.

Interesting strategy and certainly [legally] safer than Match paying women to string lonely men along.

I saw some of this strategy myself (in much more benign form):

In any job, when we are doing any monitoring of any process (technical or business process), and the numbers look bad we investigate until we either find and fix the root cause which might be a genuine problem or a problem with the monitoring.

If the numbers look dandy and the system ain't obviously on fire, we don't spend sleepless nights looking for the possibility that we are having both an underlying problem and a problem with the measurement at the same time.

You can see that given these incentives, and enough random variations, the system can drift over time, without anyone acting in bad faith or fraudulently.

Considering what shenanigans uber did to fool govts around the world I wouldn't be surprised if some Tinder execs got into a private meeting and agreed to pay some 3rd party to create fake profiles for them. wouldn't exactly require extraordinary opsec to achieve

But why would they, if they don't have to? Why run the risk?

Third parties were already creating fake profiles (for scamming etc). Then all Tinder has to do, is carefully deciding on how exactly they fight those fake profiles, to apply 'evolutionary' pressure in a direction they like.

No need to get their hands dirty.

To me it seems there's very little risk and if you want to break into a new market you gotta do what you gotta do

What do you mean by very little risk? This could get you sued to high heaven.

The idea that people would be too shamed to sue was also part of the scheme for other grifts, but it didn’t always work:

https://www.nbcnews.com/news/amp/wbna6973990

Krebs is really the Cramer of infosec. He's really cheesey and not the Krebs of yester-year. I have a hard time reading or trusting his stuff.

Could you provide a more substantive critique of this article? It seemed to me like novel and worthwhile reporting.

Leaked data should be trusted with a grain of salt. ALM has not confirmed the full authenticity of this customer list. I find the results to be plausible. If motivation to shame was intent, curating the list is a possibility not discussed even though they mention a few radical actors.

Thanks! I agree with that overall point--the possibility of accounts being withheld and/or of false inclusions is an interesting one and worthy of discussion.

That said, while there are doubtlessly many people who read this article and thought something like "why wouldn't you immediately call out the possibility of curation / manipulation of the data released?", and they're right that it's worthy of calling out, I think the more important fact to remember is that Krebs's work got us here.

You know what the strongest form of infosec is, in this domain?

Not having an affair.

It's been said a woman needs a man like a fish needs a bicycle. I say a human being needs an affair like a bug needs a zapper racket.

Their tagline - "life is short, have an affair" - is fairly compelling. You have one life, and romance is one of the great human experiences. Many people don't have the opportunity to experience that in their current relationship, while still having good reason to remain in that relationship.

You have no actually good reason to remain in your relationship if you're a lying adulterer. You only have evil, selfish reasons.

Kids is a popular excuse. See also fucked up divorce laws, etc. See also the good intentions pavement system so well known on roads leading to hell.

Kid's'd be better off with a repressed parent, or an impoverished deserter parent, than a cheater. Cheating kills the trust in both parents, because the cheater becomes a disgusting liar and the one cheated on will likely be seen as too weak or otherwise unfitting, to be a good role model. Either way the child will doubt the value of the parents they even came from. That really leads to hell, for the whole family.

Quite a yarn you're spinning. But can it be even more reductive and clichéd?

I sense a religious undertone... The type that would force the sanctity of marriage at all costs to avoid 'sin' and save face with God. Maybe also with some warped victim blaming and sexism thrown in for good measure, topped with a generous helping of sanctimony.

Maybe...

Yeah, yeah,

"Up yours woke religious moralists. We'll see who condemns who."

there's plenty of couples that are amicably separated and take care of their kids fine, even some who still share a house (though not many tbh). besides it's still their fault for having kids without being sure they can handle the comittment then not being willing to stick with it.

> without being sure they can handle the comittment then not being willing to stick with it.

that bar is so high, I applaud anyone who can even comprehend it.

Everyone's different, and every relationship is different. Sometimes people get trapped, either by money or laws or something else. It's human nature to make judgements about other peoples' relationships, but unless you're in a relationship it can be hard to see the forces at work.That's often true even if it's your own relationship.

Okay, nuance et cetera, but can cheaters have the basic human decency to recognize that they're making a choice which is harmful to their family in order to benefit themselves? Or is that asking too much self-awareness?

Really, it might not be harmful to their families, beyond harm that's already happened. Marriages are complicated. For example, some marriages are essentially financial arrangements, maintained by both parties despite romantic betrayal. Some marriages start as romatic arrangements, but morph into marriages of convenience, or are maintained "for the sake of the kids".

And sticking with a broken marriage "for the sake of the kids" isn't always the wrong thing to do. It depends.

I would then argue that that's not cheating.

Cheating involves deception, the deception is telling your partner that they're your exclusive romantic interest when they're not. If everybody knows and everyone is fine with it, then there is no problem.

I'm not sure GP is arguing for a negotiated open relationship, since this whole comment tree is about affairs.

I figured the idea was more "having an affair can be OK if you really need it because your marriage sucks, divorce and a negotiated open relationship are not viable options, and provided no one finds out"

Lol, I can't even find someone to fall in love with and here's this website :-(

You have the capacity to love and be loved man.

I suggest changing where you are looking for people, hanging out, or just doing new things. If the places you are looking have nothing for you, change where you are looking.

You got this man.

This is sound advice.

theres places u can find ppl. online dating aint that great, heres some that i seen work:

* religious organization

* hobbys

* service (lots of hot young chicks volunteer at animal shelters)

and tbh even if u dont find a girl right away you'll still get smth from all of those. keep ur head up king.

I wonder what the overlap of people is that: 1) are in a tizzy over promiscuity among adults, 2) advocate for organized religion, and 3) target 'hot young chicks'.

You are a unique individual, I think. That said, maybe start thinking of women as human beings.

lmao

1. i'm not. it rly doesn't bother me except for the tiny group that will go sleep with like 5 or 6 ppl in a short period and causes problems. idgaf what ppl do otherwise just saying its a public health problem.

2. i'm not a huge advocate of organized religion im just saying it's a good place to meet potential partners and i seen it work.

3. i'm young so uhh yeah? i like hot ppl like almost everybody else and i like women so uhh there's why i guess. not "targeting" but that's who i like to date lol. just bc there's a public health problem with ppl hooking up with like 5 ppl in a weekend doesn't mean i got anything against dating.

> You are a unique individual

thx bro

> start thinking of women as human beings?

uhh what? idk how i gave the wrong idea about this.

No idea about (1), but years ago I used to work with a pretty attractive and wholesome guy who was prrtty popular in the office who fit (2) and (3) to a T.

I think the best way to summarize what I mean, I once got invited by him to his church, and the only reason he stated was "that's where all the hot girls are". I found it to be a pretty solid reason, and his assertion definitely aligned with my previous experiences with the matter, but I had to politely decline. Mostly because I felt pretty awkward about going as a non-religious person, and I knew he was actually pretty religious.

When people talk about romance being one of the great human experiences, they don't tend to mean online hook-up sites, particularly not one focused on cheating. The 'great human experience' bit isn't just about the physical side of things.

I've heard that a lot of the time men are cheating to get sex, and women are cheating for the emotional romantic side of things.

I think the GP is aimed primarily with sympathy for the vast minority of female users, and perhaps an uncharacteristically more emotional subgroup of male users, implicitly baked in.

More like "life is short have an antibiotic resistant Chlamydia".

I don't get this, there are a lot of other ways to take risks to have fun. Like motorsport or adventure travel. Stuff that you can brag about after, which is way better than the pressure of keeping a secret.

Some people like the pressure of keeping a secret.

Some people also like bragging about affairs.

¯\_(ツ)_/¯

it doesn't matter. if they arent happy then it's their job to go quit the existing one or even if the spouse wants to kinda stay together for kids make it clear they separating as a romantic couple. sneaking behind a spouses back is shitty.

I just yesterday skimmed the documentation for statsmodels weighted generalized linear models and they use data from an affair study there: https://www.statsmodels.org/devel/examples/notebooks/generat...

I have not looked at the original study, but from what I gather from the results basically nobody is having an affair (the median for time spend in an affair is still 0, the 3/4 quantile is still only 0.48 (time units) and the maximum is 57.60 (time units)).

I am not sure what "time units" is ... it is probably in the original paper, but I did not bother to look that up. Even if it is years, that would mean that 75% of the people spend less than half a year in an affair over their lifetime. Once married this drops significantly and reduces further over the years of marriage.

I think my wife has a rather binary view on affairs. Doesn’t need to be long, sustained, or repetitive. I’d wager many wives would be livid just by the presence of an account on AM even if no physical cheating occurs. Just the fact it was sought out or investigate is going to cause a riff in the relationship.

Also if the models show nobody is cheating, the data should be considered suspicious. Maybe the word “affair” is an issue. It insinuates a long term situation when really a lot of this falls under hookups/prostitution.

> Also if the models show nobody is cheating, the data should be considered suspicious.

Possible ... when the cost of getting caught is high, even if it is just a perceived risk, I would expect that people "cheat" on those questionnaires.

Exactly. I wouldn’t trust this data to be truthful to begin. We’re talking about the “worlds oldest profession”, I’d need proof of that. Even a place like Saudi has a known practice and general understanding that sinning goes down in Bahrain. The traffic on the bridge is all the evidence I needed to see in order to believe that.

In some religious circles the mere thought of someone else is adultery. (Like you can get a divorce because they looked at others at the beach too often.) Which seemed extreme to me even when I used to believe.

Oh and if you're single and 'lust' after someone else then you're also eternally damned. That always made ~dating~ [courtship] awkward.

Is someone even in the domain if they aren't seeking or having an affair?

The advice comes off as "best way to avoid being robbed is to never have anything of value".

"Just don't have an affair". Righto, that'll fix it, because nobody who has an affair currently knows it's wrong /sarc

Reply on news.ycombinator.com