AI girlfriend review site's secrets were exposed to the world for three weeks

PWNED Welcome back to PWNED, the weekly column where we explore the frightening and amusing world of foolish infosec errors. This week, it's all about a test site that exposed real information. Have a story about someone leaving a gaping hole in their network? Share it with us at [e-mail]. Anonymity is available upon …

[JLV]

Was hoping for something more titillating.

Like the time El Reg covered a fisting aficionado website that had been backdoored * and the resident Vulture tastefully illustrated it with the scene of the warden looking at the hole in the wall in Shawshank Redemption.

Truly I expected a bit of naughty stuff here given the subject matter :-(

Oh well, still a very good reminder to secure any sensitive data.

* - I don't think it was technically "backdoored", but gosh... couldn't resist.

[The Oncoming Scorn]

Re: Was hoping for something more titillating.

I think that's an all we need to know about your expectations.

[Bebu sa Ware]

Re: Was hoping for something more titillating.

The best you might do here is the title's AI girlfriend review site and the second para.'s a gaping hole — too crude to titillate I would have thought (à chacun son goût.)

Intimeros' site contained people's reviews of their intimate "plastic pals that are fun to be with" so I would have thought slightly above "Bestiality's Best in Show" and on a par with "The Fetishist's Friend" (both monthly between plain covers.)

As noted elsewhere the worst thing about AI is that every fool will use it.

[jdiebdhidbsusbvwbsidnsoskebid]

"a site that rates, reviews, and evaluates AI companions – yes, that means boyfriends and girlfriends"

You mean, just like how Facebook started? Geez, have we learned nothing in the just 20 years or so?

[Anonymous Coward]

At least this one admits it is full of fake, plastic people right from the gecko; the whole thing with the AIs is simply mind bottling.

[Charlie Clark]

If this reminds anyone else of sites like pets.com than can we form a self-help group? Our pension funds are probably handing over wheelbarrows full of cash to these people!

[Anonymous Coward]

Autocorrect at its finest

[Charlie Clark]

Password protection? robots.txt?

Who wrote this crap?

Password protection presumably means someone put an .htaccess file on the server.

And robots.txt offers about as much protection from discovery as a spaghetti cloak… It's not Google you need to worry about, but anyone else who can read DNS records.

[Irongut]

Poorly disguised advert

I expect better from El Reg. Did they even pay you for this obvious advertising?

[IGotOut]

Re: Poorly disguised advert

If it's advertising then they need to fire the marketing manager, as I just see a badly run web site.

[trevorde]

Dodgy Test Data

Worked on some functionality for a travel airline. They supplied us with anonymised customer test data. One of the user stories featured a 'Bob Smith', a very generic name. On a flight of fancy, I put this into google and ... JAYSUS! Was not expecting this:

https://www.theguardian.com/us-news/2015/jul/23/jeffrey-alan-lash-firearms-spy

https://www.independent.co.uk/news/world/americas/bob-smith-the-strange-case-of-the-cia-agent-that-never-was-and-his-hoard-of-1-200-firearms-a02611.html

[IGotOut]

So in summary...

don't trust this company with ANY personal data if they can't even many the very most simple, beginner level security.