There was recently a massive personal data leak, and the data seems to be from Ashley Madison - a site providing dating services to married men. The site takes any email and does not verify them while registration.

What could be some ways to genuinely verify that the user registered was a continuous paid member contrary to those who visit the site an normal register and do not pay up?

Edit: I understand that a search query could obtain results which are members which are paid and not - but are there any chances we can obtain these results looking into some special attributes like time spent, etc?

  • dating services to married men sb people in relationships looking for other relationships if you've ever been bombarded by their ads. Aug 19 '15 at 5:16
  • No one can answer to this question because we do not have the source code of the website to see how that can broadly improved.
    – user45139
    Aug 19 '15 at 5:20
  • 1
    Your question is not clear: do you want to find out if a specific email at this data leak is for a user which paid for the service? Or do you want to find out how to verify the email if somebody subscribes to a website. And how do you know that the site did not verify the email address provided by the user? Aug 19 '15 at 6:18
  • No just the general way for such cases. Aug 19 '15 at 7:27
  • sorry Shritam, I have to agree with Steffen. The question is not clear. You first say that the site takes any email without verification. What does that has to be with user paid registration? In my perception those are 2 different things.
    – lepe
    Aug 20 '15 at 1:33

In the specific case of this attack it would appear from reporting on the subject that additional information was included in the data dumped from the site, including physical addresses, GPS Co-Ordinates and partial Credit/Debit card numbers.

A profile with things like Credit card details filled in, could be taken to indicate that the user was more than just a casual browser, although I wouldn't suggest that that is definitive proof.

In the general case are more complete/detailed profile would seem to indicate a more active use of the site than a skeleton profile with just an unvalidated e-mail address.

  • Yes, that been said - we also have 'guest account' purchases and then later if the user wants to - can set-up registration details via a purchase invoice emailed to the consumer (not in this case). That way it'd be more harder to segregate information for other cases alike this one (for future references and research). Aug 19 '15 at 10:31
  • @ShritamBhowmick: are you related to "Ashley Madison" or are you part of a dating service and you are concern that if that happens to you, how can you protect your users from being identified/exposed?
    – lepe
    Aug 20 '15 at 1:37
  • It's really not a personal question howsoever. If you look here: computerworld.com/article/2972986/cloud-computing/… a lot of people have been affected by the same. and yes, in general everyone would like to find new ways how one could prevent such threat attacks to personal consumers given that credit card details are now exposed.. Aug 20 '15 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.