You Can Browse FetLife Profiles Without Logging In

The website FetLifeSearcher.com enables people to search the kinky social network FetLife without first logging in. The existence of this site and similar tools expose an enormous and unspoken risk to users of the network, who rely on the illusion of security created by the need to log in before they can access any content.

This is a replay of an incident that occurred two years ago when a FetLife user created a PHP proxy to illustrate the issues with FetLife’s insufficient concern for user privacy. The user, known online as maymay, had been a long-time critic of FetLife’s inconsistent approach to user safety, and was one of the loudest voices rallying for the use of cryptographic protocols at login (which FetLife finally adopted in 2011).

The proxy maymay created in the summer of 2012 accessed FetLife and made the profiles of public individuals in the BDSM community available to people outside the network. It took no time for this proxy to be coded, and even less for it to get to work, illustrating how false people’s sense of security really is on the kinky network. Because this was an activism project, maymay widely publicized what they were doing; unfortunately, FetLife refused to face the underlying issue, choosing instead to launch a campaign accusing maymay of hacking the site and endangering its users.

FetLife founder John Baku assured users at the time that FetLife had “blocked the proxy,” a statement that led many to believe the issue had been addressed. In truth, FetLife only blocked connections originating from maymay’s site where the proxy was installed, meaning that connecting to the network from any other source would have enabled the proxy to continue its business. The proxy hadn’t hacked anything — it was simply operating through FetLife’s security holes.

Despite the fact that FetLife has had two years to quietly address this, the existence of FetLifeSearcher.com shows that the security issues have not changed. FetLife remains unsafe, easily accessible and possibly indexable. Unfortunately for users, its founder and administrators are far more concerned with maintaining the illusion of safety than being transparent about potential issues that people on the site may face after being exposed. This is a gross injustice, as ours is an extremely sex-negative world and being found out as a kinkster can have serious repercussions on a person’s life and, as evidenced by threads relating to the proxy incident, a lot of users on the social network do not have the technical knowledge to understand the gravity of the situation.

“We have a fetish for security. That’s why we’re the first social network to be 100% SSL. The same security banks use,” FetLife tells people signing up. Nothing is said at that point about risks associated with sharing one’s sexual proclivities on a social network that is only as safe as the creation of an account and a general sense of human decency. Unless one is interested in reading a lot and seeks out FetLife’s Privacy Policy, it’s unlikely one would find anything about the risks. On this page, buried under all kinds of other things, FetLife states:

Please be aware that no security measures are perfect or impenetrable. We cannot control the actions of other users with whom you share your information. We cannot ensure that information you share on FetLife will not become publicly available. We can’t be responsible for third party circumvention of any privacy settings or security measures on FetLife. You can reduce these risks by using common sense security practices such as choosing a strong password, using different passwords for different services, and using up to date antivirus software.

Aside from being completely buried in a footer — a place no user will ever go unless they’re media and looking to contact the social network for comment on a developing story — the warning is almost willfully misleading. It segues from saying anyone might be able to access one’s information to suggestions for better passwords and a recommendation for current antivirus software. This suggests that if a user creates a strong enough password and keeps a virus-free computer, they’ll be safe. This is not true: it doesn’t matter how good your password is. Anyone with an account can see your posts and comments on FetLife, which means any one of its 3,010,332 members can write a bit of code to access the site and serve its information to the outside world.

Until recently, deleting one’s images on the network didn’t fully delete them due to some sloppy engineering. FetLife denied this was true when I first wrote about this in 2012, despite the number of engineers who weighed in. The video that I used to test this finally disappeared from Amazon S3 server in 2013, leading me to believe that the issue has been addressed, though I have not had time to verify this (you can try it yourself by following the above link). FetLife continues to deny there was ever any issue with content deletion at all.

It’s unclear why FetLife refuses to do anything other than issue disingenuous warnings and make misleading statements about security issues to its users. While a number of users are not technical, the community does have a number of incredibly competent developers who would be happy to rise to the occasion. It’s possible money is an issue — given that FetLife is very much aligned with adult content, it is undoubtedly difficult for them to find monetization avenues — but here, too, transparency would go a long way. There are many of us who would actually click that “Donate” button if we felt the privacy we so enjoyed was actually on the line.

Last year, I speculated that it was in FetLife’s commercial interest to keep up the pretense of safety among users because the sexy images and videos that users post on FetLife are the network’s bread and butter. FetLife enables users to see some content in the general network stream, but to see everything — to even go back on your own home stream to see friends’ posts — users need to pay up. It’s a great way for the network to make some money.

This might well be why FetLife refuses to admit security issues. An even more cynical line of thinking was presented by maymay, who brought this issue to my attention: that FetLife is leasing user information in exchange for money generated by FetLifeSearcher.

When you run a search on FetLifeSearcher.com, the results show users’ FetLife profile pictures, usernames, ages, genders, kinky orientations, locations and a snippet from their profiles with the option to show more. If you click on “Show More” or a username, you are not shown more or immediately directed to FetLife, but rather, to an adult site served through PornEarn, an adult advertising network and link shortening service. Upon clicking any link on FetLifeSearcher, an ad loads in a PornEarn-branded frame, and five seconds later, you are redirected to the FetLife profile, or a log-in page if you’re not logged in to FetLife.

Basically, your profile information is being used to attempt to fraudulently lead people to porn sites through a money-making link service, and then your FetLife profile is exposed.

There is, however, no evidence indicating that FetLife is any way involved with FetLifeSearcher. But the fact remains that someone out there has coded a way to extract some details from users’ profiles to query them for external searches. There nothing stopping anyone else from making an account or using an existing account to write some code that will make much more than just some profile tidbits available to the world.

Users who wave this off as part of the risks we take when we share online forget that there is a difference between a person targeting another user and making available their profile, and a machine that can indiscriminately copy a number of profiles in minutes. FetLifeSearcher, like the PHP proxy before it, show that FetLife hasn’t implemented even the most rudimentary anti-crawler to prevent a script with log-in credentials from getting on FetLife and beginning the process of copying everything on the social network to one or multiple mirror sites that are indexable, in turn, by Google.

It’s easy to issue a handful of DMCAs — FetLife’s favorite way to deal with its glaring security problems — but what happens when any of these are cached by the search giant? Google is not in the habit of addressing third party disputes. The only way out, in that case, is a court. That’s something that takes far more resources for the network than making some commonsense changes in permissions. And unlike a DMCA takedown, taking a malicious hacker to court over this takes a great deal more time, which a lot users simply can’t afford to give.

UPDATE: FetLifeSearcher.com went dark on June 29, 2014. The PornEarn-shortened links generated by the search are still fully functional, however.

This article originally stated that FetLifeSearcher did not redirect users to profiles. That was incorrect. Following a five-second ad through PornEarn, FetLifeSearcher delivered complete user profiles to anyone using the search engine. Header image by Ater Crudus.