No matches on LVS

[ciphergoth]

Anyone get a match on the LiveJournal Valentines System? I didn't get a match from any of my five nominations, but that's not unexpected, I chose only people who I wouldn't feel comfortable just sending an email saying "hey, I fancy you, fancy a shag" and that's pretty rare. I don't know if any of the people I nominated even took part...

I got three nominations from people I didn't name. Thanks to those people! I'm guessing at least some of you are people who already know very well I have the hots for you :-)

I'm interested in helping skx redesign the system for next year. One issue that's come up is authentication. At the moment you can't take part unless you have an un-munged email address in your profile; the authentication token is mailed to that address. This limits the system somewhat.

I thought of an alternative, but it might have evil consequences. When you sign up, the system gives you a token (eg "951m2oGBiqW") which you must include in a public journal entry. It checks for that token in the journal entry, and accepts that the person to whom it gave the token is the legitimate holder of the account if they find it. This is the potentially evil bit: you then offer the choice of just pasting the token in, or copying-and-pasting some HTML including the token, and an image which links to the LVS saying effectively "sign up, I have!".

Does that sound bad and wrong?

Note that the cookie itself won't be visible in your journal no matter which option you choose - it'll be inside an HTML comment, so it'll only show up in the nohtml view of the journal.

Update: this isn't secure. Supposing the system becomes widely used, and I want to pretend to be you to Steve. I set up my own site and encourage you to sign on; the token I give you is the one you need to paste into your journal to convince Steve that I'm you...

One fix would be to include a sitename in the token, and make sure people know not to paste in tokens that they got from sites that aren't named in the token, but I suspect that there are many ways to persuade people to do it anyway, eg include it in a quiz result.

On to Plan B: persuade LJ to accept a patch that directly allows people to authenticate themselves as particular LJ users to third party websites.

Comments

[gnomatron.livejournal.com]

Random thought; does this have to be just a valentine's day thing? Is there a good reason to not run it all year? (y'see, I missed it, cos I ummed and awwed about who to name).

Actually, one problem that occurs to me is abuse; people could potentially put people they aren't interested in on their lists purely to find out if said people were interested in them. It's open to this sort of abuse anyway, but people are less likely to abuse it if they only have one opportunity a year to name a limited number of people. You could place a limit on usage, I suppose, to discourage use in anything other than cases where people are genuinely interested, and also to ease the load on the system.

[skx.livejournal.com]

A few thoughts ..

If it was all year round when would you discover a match, as soon as it was made? Then what - you drop out? or you login and change your choices?

As for the speculatively naming thing, this was mentioned right at the start, and this was the reason for only allowing three nominations. (Although in the end I did give in to pressure and up this limit to five).

[gnomatron.livejournal.com]

You just send out an e-mail as soon as a match was made, or alternatively you could delay for a few days or a week in case someone changes their mind. Also, you could limit people to X many uses a month, that would limit speculative naming.