26 ms·
Women dating safety app 'Tea' breached, users' IDs posted to 4chan
Also: https://www.reddit.com/r/4chan/comments/1m8z2w4/4chan_the_hacker_does_it_again_tea_app/ https://www.reddit.com/r/4chan/comments/1m8z2w4/4chan_the_ha...
https://www.cnet.com/tech/services-and-software/tea-app-breach-exposes-72000-selfies-id-photos-and-other-user-images/ https://www.cnet.com/tech/services-and-software/tea-app-brea...
- duxup 1y agoA flash in the pan gossip app that when it functions normally is not worried about anyone's privacy / accuracy ... also doesn't care about good policies or their user's privacy. That seems about right.
- darth_avocado 1y agoYou could say that the *Tea has been spilt*
- JohnMakin 1y agoPainting this as a "gossip" app seems extraordinarily reductive. Women have a good incentive to share info about and to one another for safety beyond "gossip."
- duxup 1y agoGo checkout the website, the first image is just two people gossiping. This app operates just like an app some creep online would use, people post pictures (permission or not) and gossip about them.
- jahewson 1y agoThere’s also a ton of bad incentives for those women who lie, manipulate and abuse beyond “gossip”.
- ryandv 1y agoYeah? What are they?
- chneu 1y agoAttention. Revenge. Blackmail. Victimhood personality types. There are plenty of examples of people making things up about other people who they thought wronged them. Mob justice is really disgusting, and that's all this site is. People justify horribly vindictive behavior when they think they're righting a perceived wrong.
- darkwizard42 1y agoIs it reductive? It also has good incentive for someone jilted or misinterpreting something to suddenly tarnish someone's reputation with little recourse for the other party. It is a one-sided review app for people in a way that people affected may never even know!
- BizarroLand 1y agoIf guys had an app that women couldn't access where we shit talked all of our exes with photo evidence women would riot at the company HQ. But then again, can't convince people as a whole that men are, on average, good and decent people with normal flaws just like women, and therefore deserve to be protected, loved, and appreciated equally.
- tamimio 1y ago[flagged]
- fake-acc-420 1y ago[flagged]
- tamimio 1y ago[flagged]
- jabjq 1y ago[flagged]
- nixosbestos 1y ago[flagged]
- tomhow 1y agoWe banned that account. But that comment and others like it are being heavily downvoted and flagged, more than enough to be killed and to alert us to users who need to be banned. You've been running this rage-filled campaign against HN for months, the most extreme comments of which I've listed below. It all seems very pointless; all the comments you were raging against were downvoted and flagged/killed by other users. The comment of yours that you complained was being downvoted actually ended up receiving enough upvotes to return to a positive score. If you don't want to use HN as intended we'll ban the account, which it seems perhaps is what you want us to do. However you've also posted some good comments that have received solid numbers of upvotes and good replies, so if you wanted to lean more into the positive contributions, we'd be pleased to see that. We're well aware there are plenty of objectionable comments on HN; we have to read almost all of them. But the guidelines are clear, and the feedback mechanisms work well when people use them. Plenty of users play a positive role in keeping HN running well by quietly flagging bad comments and alerting us to bad users via email. We'd appreciate you doing the same. https://news.ycombinator.com/item?id=44370495 https://news.ycombinator.com/item?id=44370495 https://news.ycombinator.com/item?id=44045701 https://news.ycombinator.com/item?id=44045701 https://news.ycombinator.com/item?id=44024525 https://news.ycombinator.com/item?id=44024525 https://news.ycombinator.com/item?id=42877363 https://news.ycombinator.com/item?id=42877363
- fake-acc-420 1y ago[flagged]
- bigfishrunning 1y agoBut they gave firebase money! and that money spends!
- nis0s 1y agoHow is this user data even reliable or useful when someone can make fake personas and populate their activity with LLMs? Drivers licenses can be faked. Moreover, someone can just pretend to be someone else on this app with real drivers licenses. The whole premise, implementation and process of Tea as a social media app is flawed, and a legal liability for the devs.
- fake-acc-420 1y ago[flagged]
- chuckadams 1y agoI don't disagree, but there are most certainly other perpetrators of identity theft out there. Not sure any of them would bother using it to sign up for something as niche and unprofitable as an account on Tea.
- furgot 1y agoIt's concern trolling, they don't sincerely believe it, they're trying to make the people they don't like stupid.
- tamimio 1y agoI hope it served as a good lesson to the average person to be more cautious while submitting sensitive information like a government ID. Just because it's an app with a nice UI doesn't mean it's secure, let alone trustworthy regarding who owns it. Last week I was contacting a government agency here in Canada and the support team requested a government ID to be shared over email, which is anything but a secure communication. I tried to share it as a link to my vault, but they refused, so now either I will have to go in person or they will find another way in the meantime. The internet went from 'YouTube asking users to never use your real name' to 'you have to submit your ID to some random app' in 10 years. Crazy!
- deleted 1y ago[deleted]
- jabjq 1y ago[flagged]
- tgv 1y agoThey say no press is bad press, but for a privacy-sensitive app, no press seems preferable.
- some_random 1y agoWhat seems fabricated about the outrage?
- jabjq 1y agoI’ve seen multiple posts online posted by guys showing screenshots. The screenshots would show texts sent to those guys by girls saying that they’ve seen the guys on Tea and that they won’t have any more dates because of what they’ve seen. It all stinks to high heaven.
- subjectsigma 1y agoIsn’t that… exactly what the app is advertising? I don’t understand why you think those screenshots are fake.
- jabjq 1y agoI think the screenshots are fake because I’ve been using the internet for very long and I know how publicity campaigns work. For starters, men with hundreds of thousands of followers have no reason to post a screenshot that shows that women have used an app to report them as creeps. That the kind of thing that belongs in a police report, not in a public social network where you’re trying to build your brand.
- bobsmooth 1y agoWith all this talk about age verification, I have to wonder if the complete lack of security was intentional.
- pavel_lishin 1y agoHow do you mean?
- bobsmooth 1y agoThe UK and some US states are instituting age verification for adult content. Doxxing thousands of women is a great way to get people talking about privacy and security.
- pavel_lishin 1y agoThat feels like a hell of a risk to take just to get a conversation started. Not just the obvious implications of endangering all the users, but the cloud that's going to hang over everyone associated with Tea, now.
- fidotron 1y agohttps://www.teaforwomen.com/about https://www.teaforwomen.com/about Two people, in public.
- bravetraveler 1y agohttp://archive.today/U5Tah http://archive.today/U5Tah Freewalled
- more_corn 1y agoFreewalled I like that
- neonate 1y agoIs that site down? I'm just getting the default nginx page.
- bravetraveler 1y agoStrange! Doesn't seem to be down, at least at time of writing (either my original post or this one) I linked the plain HTTP version... which seems to rely on a series of redirects; potentially TOR: ~ $ curl -vLsq http://archive.today/U5Tah |& grep -Ei 'location:|title' < Location: https://archive.today/U5Tah < onion-location: http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/U5Tah < location: https://archive.ph/U5Tah <title>archive.ph</title> Tough to say :) Vaguely reminiscent of SNI troubles on the web server... which can depend on the client. I thought that was becoming exceedingly irrelevant, though.
- dpedu 1y agoI've seen this issue with certain dns providers. I don't have issues with google dns (8.8.8.8).
- edgineer 1y agoThere is a long-standing conflict between archive and cloudflare https://jarv.is/notes/cloudflare-dns-archive-is-blocked https://jarv.is/notes/cloudflare-dns-archive-is-blocked
- pavel_lishin 1y agoGood lord, why would they store those drivers' license images for an instant longer than it took to verify their users?
- duxup 1y agoThey shouldn't, but it appears to be a gossip app where by design they're also storing photos taken of other people (permission or not) and gossip about them... They don't seem to value privacy.
- Mountain_Skies 1y agoAccording to another media report, the approval queue for new account verification was seventeen hours long. It's possible what the 4channers got was that approval queue.
- IlikeKitties 1y agoNo they got more, 23gb of files.
- AlanYx 1y agoThat's only a partial archive. There's another one with 55gb.
- jsrozner 1y agoThis. Appropriate regulation should make this an offense punishable by a large fine. There is almost no consequence to companies for bad practices. Ideally you'd see fines in the 10%s of revenue. In egregious cases (gross negligence) like this, you should be able to go outside the LLC and recoup from equity holders' personal assets. Alas, if only we had consumer protections.
- hdgvhicv 1y agoCompanies, especially American ones, see data as an asset, rather than a liability. The GDPR in Europe attempts to reset this but it’s still an uphill battle
- Ancapistani 1y agoI thought 4chan died a year or so ago? Ugh. I’m clearly getting old. I don’t even remember the last time I went to 4chan.
- tokai 1y agoIt was knocked offline and a lot of journalists and bloggers spun a history about it not coming back. But it did.
- morkalork 1y agoAll the mods were doxxed too, but life uh finds a way?
- Ancapistani 1y agoThanks - this is context I was missing :)
- linkage 1y agoIt's unironically a stronger case for network effects than Facebook
- jabroni_salad 1y agothat thing is a cockroach. It will survive every tech company you can care to name.
- raverbashing 1y ago"Security breach" more likely a vibe coded slop app But yeah please tell me how "we care about your privacy"
- pavel_lishin 1y ago> more likely a vibe coded slop app I mean, it's fun to throw baseless accusations around, but do you have any actual reason to suspect this?
- raverbashing 1y agoDo you think if that was disproved that would be better somehow?
- therein 1y agoIf you look at the API, it is a slop app. The IDs were being uploaded to a public Firebase bucket. Chats are also public now. The full API keys are leaked because they were in the shipped app.
- Vvector 1y agoNone of that ever happened before AI. Right...
- bigfishrunning 1y agoIt had to learn from somewhere!
- jasonvorhe 1y agoUnlikely considering it allegedly launched 2 years ago: https://www.distractify.com/p/what-is-the-tea-dating-app https://www.distractify.com/p/what-is-the-tea-dating-app
- raverbashing 1y ago
- aaron695 1y ago4chan thread with details of the hack - https://boards.4chan.org/pol/thread/511317913 https://boards.4chan.org/pol/thread/511317913 They have geo-mapped all the users - https://imgur.com/bRAJ2nU https://imgur.com/bRAJ2nU Some of the users photo's are AI, which is interesting. They got all the chat logs - https://x.com/NEElimit/status/1948766332503130562 https://x.com/NEElimit/status/1948766332503130562 60 Gig torrent said to be out with all the data - https://x.com/cremieuxrecueil/status/1948787086493901097 https://x.com/cremieuxrecueil/status/1948787086493901097 data structure - https://files.catbox.moe/c6ej81.json https://files.catbox.moe/c6ej81.json For those who wish for the old days - "Vibe Coding" - shonky websites with shonky security, doxxing on all sides, 4chan pops back into relevance. You get your early internet redo. HN 'Tea' thread discussing the ethics of the doxxing app - https://news.ycombinator.com/item?id=44682914 https://news.ycombinator.com/item?id=44682914
- deleted 1y ago[deleted]
- ridiculous_leke 1y agoYou can get Apple Legal involved if your face is on the app and they should get the related posts removed.
- deleted 1y ago[deleted]
- cherryteastain 1y agoIt's on a torrent. Good luck getting that removed.
- schroeding 1y agoI think they mean the actual posts on tea itself, not the leaked ID photos.
- goku12 1y agoEven if only a few women are abusive and gossiping, they will doxx a lot of innocent men. At that stage, that entire app should be treated as illegal and shut down, instead of hoping that Apple legal will find the time to settle each complaint. The entire app is a toxically bigoted concept that gets a pass because the term 'women's safety' is attached to it.
- chneu 1y agoI'm failing to see how this app is legal. States like Arizona have recently passed anti doxxing laws. Posting any information on this app with the intent of social pressure, harassment, etc is illegal in those states. At the very least, the app itself might be legal using the "public forum" argument but the content posted on there definitely leaves the users in a legal gray area. I can see the argument on both sides but this is asking for a case to be brought just so the law can be fleshed out.
- goku12 1y ago
- smnthermes 1y agoYou can report it to Google Play. The category is Restricted Content -> User Generated Content, and the app ID is "com.tea.tea". https://support.google.com/googleplay/android-developer/contact/policy_violation_report https://support.google.com/googleplay/android-developer/cont...
- gruez 1y agoWhat's the actual violation though? If you click through the "User Generated Content" link, it shows that it's allowed, just that they have to moderate it. https://support.google.com/googleplay/android-developer/answer/9876937?hl=en&ref_topic=9877466&sjid=2764586596652719578-NA#zippy=%2Cexamples-of-common-violations https://support.google.com/googleplay/android-developer/answ...
- ronsor 1y agoThe actual violation would be a privacy violation
- EcommerceFlow 1y agoHow is an app that allows users to post unverified and doxxing information about random men allowed on the IOS app store? Apple had no issue mass censoring Parlor and others, how is an app like this able to reach #1 under all?
- StanislavPetrov 1y agoIf big tech didn't have double standards they'd have no standards at all.
- bitpush 1y agoThere's only one guiding principle for Apple - and that's money. Dont let their privacy marketing ("Privacy is a human right") fool you otherwise.
- mikestew 1y agoOne could say that about any company (because "fiduciary duty", amirite?). "Don't let Toyota's 'reliable car at a reasonable price' marketing fool you, they're all about money." Yeah, but does that preclude them from selling me an actually reliable car at a reasonable price?
- bitpush 1y agoBut when a company makes moral arguments ("We're better than others because of X") the bar goes up. If Toyota says that we're the car company that cares about you, we want to keep you safe from the bad actors, and trust us on making right choices for you - and when you discover Toyota has been secretly building out an ad network, in bed with Chinese government, you have to call them out. And that's what Apple is doing. Privacy is a human right, except in China where they are happy to go along with what the government wants. Google atleast had the balls to pack up and leave the country.
- baobabKoodaa 1y agoWhy don't you try uploading an app where men doxx & "review" women that they date on dating apps? See if Apple suddenly finds morals.
- koakuma-chan 1y agoFirebase again lol
- batmaniam 1y agoIsn't this basically Peeple except gender locked to women? Peeple failed because they couldn't eliminate bias and gossip against anyone. If someone was jealous of another, for example, that person could just write false slander and claim it was real with no evidence. That would have affected the victim for jobs, dates, etc. So it was laughed at by VCs and everyone online and it shut down. How is Tea even legal? Isn't this just a legal libel timebomb waiting to happen?
- webstrand 1y agoNot only that, I think they're forfeit their Section 230 protections since they're exercising editorial control by excluding males from the platform. So they'd be directly liable for any defamation they publish on their platform.
- mikeyouse 1y agoThat's not how 230 works - why do people keep parroting this misinformation? https://www.techdirt.com/2020/06/23/hello-youve-been-referred-here-because-youre-wrong-about-section-230-communications-decency-act/ https://www.techdirt.com/2020/06/23/hello-youve-been-referre...
- webstrand 1y agoBecause it's really good misinformation, thanks for the link. I had no idea that it was effectively unconditional protection.
- magicalist 1y ago> I had no idea that it was effectively unconditional protection. Defamation is still not protected, it's just the person who posted it who is liable. Meanwhile the site's "editorial control" is protected by the first amendment, not section 230.
- JoshTriplett 1y agoHuge credit for actually updating in response to evidence.
- jjangkke 1y agoSome observations: - The fact that this app exists solidifies the data that a small group of men/women do most of the dating on tinder etc while the vast majority land dates far less if none at all. - This creates distorted market supply and demand where those small group of men/women become sought after and its only human nature in that they value their supply less than the rest. - Toxic behavior is expected from that small group of highly attractive people that do all the dating. - It was only a matter of time before such app would run into legal issues or attract angry individuals. Now the damage to the leaked identities will be prolonged. With the AI tech today, the extent to which a damage can be doned with the information from the leaks is unknown. - As for the company behind Tea, they are done. They face a monumental class action lawsuit as well as ongoing individual civil/criminal cases that will arise from the leaked identities, in particular the photo of driver licenses as well as selfies, usernames, emails drastically increase the surface area for damages. - The users of this site and those that have directly posted images, details have opened themselves up to significant liability from not only the men they have targeted but from law enforcement. - We'll see some new laws being formed from this case. Once again, we see the hidden dangers of blindly trusting large popular platforms with sensitive data but the twist with Tea here is the defamation activity that opens up its users to both civil and criminal liability.
- pavel_lishin 1y ago> The fact that this app exists solidifies that a small group of men/women do most of the dating on the quick fleeting connections on tinder etc while the vast majority on a few if not none at all. I don't follow. > This creates distorted market supply and demand where those small group of men/women become sought after Isn't that true in the real world as well? I'm not exactly a hunk; people weren't tripping over themselves to ask me out, whereas some of my friends and acquaintances did have to figuratively beat people off with a stick.
- arrowsmith 1y agoIt’s true in the real world, but dating apps make it much more exaggerated.
- 1y ago
- throw838384 1y agoIs there a way, to verify if potential partner uses this app? Or if they are in "are we dating the same guy" type of group? I take doxing, stalking, revenge porn and cyber bullying very seriously! And I would pay good money for a background check, to stay away from such people.
- cindyllm 1y ago[dead]
- more_corn 1y agoEasy post negative information about yourself on there.
- jeroenhd 1y agoYou need to verify you're a woman with some form of ID before you can get into the app. Faking an ID and a picture can't be that difficult in the age of AI (especially not when the company that's supposed to verify you is this callous with their users' PII), but it's not as quick and easy as you suggest.
- SrslyJosh 1y ago[flagged]
- generalizations 1y agoThere is now.
- codedokode 1y agoAsk her?
- goku12 1y agoDo you expect abusive people to answer honestly? The perceived anonymity on the app is a double edged sword.
- 1y ago
- jjangkke 1y ago- The fact that this app exists solidifies the data that a small group of men/women do most of the dating on tinder etc while the vast majority land dates far less if none at all. - This creates distorted market supply and demand where those small group of men/women become sought after and its only human nature in that they value their supply less than the rest. - Toxic behavior is expected from that small group of highly attractive people that do all the dating. - It was only a matter of time before such app would run into legal issues or attract angry individuals. Now the damage to the leaked identities will be prolonged. With the AI tech today, the extent to which a damage can be done is unknown (ex. deepfake, impersonations, further doxxing). - Tea user's driver licenses as well as selfies, usernames, emails, posts about their dates will drastically increase the surface area for lawsuits, fraud and exploitation by malicious agents. - The users of this site and those that have directly posted images, details have opened themselves up to significant legal and criminal liability. Given these apps were probably popular in large city centers like California, NY have heavy punishment for digital harassment and privacy violations on top of the damages that can be claimed against them by the men who's information and details were posted. - Tea is largely insulated from what the users post which means that their biggest exposure might be just neglect and failure to secure data which comes with a slap on the wrist. Which will make it harder for Tea's userbase to claim large damages against it. I read more details about this case and its beyond egregious. Unencrypted firebase and full public buckets. There is no hacking involved, the tokens were being used to pull data from roughly all 30,000 users of Tea and were only blocked short while ago. Allegedly, 60GB of photos, user personal information, driver license, gps data being shared on torrent. A map of all 30,000 users tied to GPS data is being posted as well. Given the extreme neglect to secure their data, I now believe Tea will be open to even bigger legal liability possibly criminal even.
- wosined 1y agoLet's be real you wrote men/women only to be PC. You really meant small group of men.
- packetlost 1y agoNo, it really does apply to both. Women who are not dating or are in a stable relationship won't use that app.
- cmxch 1y agoA case for ironclad data privacy laws that allow people to pierce the veil and request deletion.
- 8f2ab37a-ed6c 1y agoSad that a common response to "we might not want this app to exist" is "well, if you weren't cheating, you wouldn't have a problem with it". Why do people want to live in a panopticon of their own creation, with random anonymous strangers morally policing, judging each other with zero consequence to them? Don't think we'll ever learn our lesson when it comes to privacy, it will be Eternal September forever.
- ryandv 1y ago[flagged]
- duxup 1y agoI don't think that's a progressive feature. Say something about a federal government policy and Trump super fans will be all over you. Same goes for conversations about Tesla and so on ... It's a human thing.
- duxup 1y agoI think for many people see <cause> and any criticism of something that claims to be relate to that cause is seen as criticism of the cause and that's a full stop when it comes to thinking much further. The irony in this case being that this app operates like a lot of creep subreddits and forums out there with people posting photos of other people without their permission and gossiping / telling stories about them...
- ryandv 1y ago[flagged]
- 8f2ab37a-ed6c 1y agoI agree that you could make a Tea app for every faction's favorite cause, and use "safety" as the justification: report your local communist, report your local infidel, report your local secret white supremacist, report your local secret Western imperialism agent, report your local suspected jihadi, report a homosexual, report a suspected illegal immigrant, report a local adulterer, report an apostate, report a kulak.. etc. chefkiss Witch Hunt as a Service, with a delightful UX, a little gamification, and soon integration with your favorite apps. Coming to an App Store near you.
- tonymet 1y agoMaybe this is a good time to think about what policy could help discourage these horrific practices (it sounds like their storage was unprotected) * App Store review requires a lightweight security audit / checklist on the backend protections. * App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached. * Publisher is required to include their own sensitive records ( access to a high-value bank account) within their backend . Apple audits that these secrets are in the same storage as the consumer records.
- tonymet 1y ago* Mandate 3rd party auditing once an app reaches > 10k users * App publishing process includes signatures that the publisher must embed in their database. When those signatures end up on the dark web, App Store is notified and the App is revoked
- fn-mote 1y ago> * Mandate 3rd party auditing once an app exceeds 10k users You have a lot of interesting suggestions. I would love to see some kind of forced transparency. Too bad back-end code doesn’t run under any App/Play Store control, so it’s harder to force an (accurate) audit.
- tonymet 1y agothanks. Yeah I think there are a lot of ways to decouple App store from publisher and auditor . That way the publisher can retain autonomy / control , while still developing trust with the consumer. We could do better in our trade at encouraging best practices in this space. Every time there's a breach , the community shames the publisher . But the real shame is on us for not establishing better auditing protocols. Security best practices are just the start. You have to have transparent, ongoing auditing and pen-testing to sustain it.
- tonymet 1y agoalso i remember maybe Facebook trying to do this when they acquired Parse. For a while they were promoting developers host their backends on Parse / FB . The idea has merit. You have to relinquish some control to establish security. Look at App Store, Microsoft Store , MacOS App store -- they all sandbox and reduce API scope in order to improve security for consumers. I'm more on the side of autonomy and trust, but then we have reckless developers doing stuff like this, putting the whole industry on watch.
- deleted 1y ago[deleted]
- dang 1y agoRelated ongoing thread; others? Women are anonymously spilling tea about men in their cities on viral app - https://news.ycombinator.com/item?id=44682914 https://news.ycombinator.com/item?id=44682914 - July 2025 (17 comments)
- honeybadger1 1y agoit should have never been allowed to be published anyway. not trying to justify what is happening, but these kind of apps are historically abused and create more problems than they intentionally try to solve.
- trallnag 1y agoDamn, this app is going down quicker than coalfax Edit: Nevermind, looks like Tea has been around for quite some time already. But it kinda flew under the radar with a fairly small user base.
- exiguus 1y agoKind of meta toxic behaviour to download the data from a App that has the goal to prevent woman from men toxic behaviour.
- deleted 1y ago[deleted]
- az226 1y agoDoxxers getting doxxed is peak irony.
- jahewson 1y agoLet’s not kid ourselves, the goal is to shame men in an attempt to control them.
- archagon 1y agoMaybe if all these creepy men just dated each other and left women alone, the problem would solve itself.
- lupusreal 1y agoGreat suggestion, very practical and well intentioned. On that note, I had another idea; toxic women should stop associating with men. They should take themselves off the dating apps and stop ruining the lives of any men that might be unfortunate enough to pair up with them. My suggestion is just as practical as your suggestion I think. The toxic women can self-identify and voluntarily exclude themselves just as well as the creepy men.
- chneu 1y ago>They should take themselves off the dating apps Then they can't complain about how horrible people are. Unfortunately, being a victim is a large part of many people's personalities. This is especially true for the "chronically single" people on dating apps. It's never their fault people don't want to date them! It's everyone else who is horrible. Years ago when I was on the apps and went on dates it was obvious who these people were. They rarely actually go on dates because every person they match with is a predator to them. Then, if an actual date happened, it would quickly go nowhere because they're treating you as if you're a predator. The whole vibe with these people is awkward and judgmental. Then folks wonder why their dating app experience is bad.
- aaaja 1y agoThis is such excruciating incompetence by the app developers I'm wondering if it was intentional. Done to punish the women who dared to speak up about vile men. I just hope they can pursue legal action for this, whether it was a deliberate trap or not.
- motohagiography 1y agofor someone who thought Tea was a good idea, what would be the objection be if this leaked contributor data were used to populate a similar app to warn men off?
- Frost1x 1y agoA rather brilliant idea I must say.
- motohagiography 1y agoobviously it would be malicious and unethical, but since that didn't seem to stop Tea users, I'd be interested in what their arguments against it would be.
- baobabKoodaa 1y ago[flagged]
- octoberfranklin 1y agoThere's no objection, but it doesn't work because men compete while women collude. This has evolutionary origins. A man can, theoretically, father around a thousand children or more in the time it takes a woman to bear one. Sperm are cheap so those who need sperm (i.e. women) don't need to fight with each other. There's plenty to go around. Eggs are scarce so males of myriad species fight each other to the death over them. It's just biology.
- tiznow 1y ago> There's no objection, but it doesn't work because men compete while women collude. It's funny because many people, even some women would say you have the genders flipped here
- octoberfranklin 1y agoAnyone who says a woman can give birth multiple times a day is.... smoking crack.
- robotnikman 1y agoWith all the state/countries starting to do ID verification, this is a good lesson in what can go horribly wrong with these types of policies.
- throwacct 1y agoThis x100.
- testing321123 1y ago[dead]
- infamouscow 1y ago[flagged]
- SomaticPirate 1y ago"An app was created to help women stay safe on dates and avoid creeps, proceeds to be hacked by creeps" Not a great look here. However, Tea could have done a modicum of cybersecurity work (or hired an outside firm) to prevent this. If they are claiming to want to keep women safe (and not just running a gossip board) then this should be a red alert for them. No public acknowledgement is concerning...
- Levitz 1y agoAn app that was created to publicly share images and public information of people got the images and public information of the people sharing it exposed. I don't know how can anyone feel wrong about this without feeling even worse for what was already taking place.
- anonfordays 1y ago>However, Tea could have done a modicum of cybersecurity work (or hired an outside firm) to prevent this. I have no doubt in my mind that this is what they did. An "outside firm" vibe coded this and delivered the results.
- bendigedig 1y agoDear reader, the women were the creeps.
- loeg 1y ago"Safety" is doing a lot in this headline. It's a gossip app.
- mandmandam 1y agoHere are some statistics for you to consider: * Out of every 1,000 sexual assaults, approximately 310 are reported to the police. * Of those reported, only about 13 cases are referred to a prosecutor. * Ultimately, only about 7 cases lead to a felony conviction. * For every 100 rapes reported, only 18 result in an arrest. * Fewer than 7% of reported rape cases lead to a conviction. * In some studies, the conviction rate for rape has been reported as low as 3.2% in certain jurisdictions. Sources: https://rainn.org/articles/what-expect-criminal-justice-system https://rainn.org/articles/what-expect-criminal-justice-syst... https://www.uml.edu/news/stories/2019/sexual_assault_research.aspx https://www.uml.edu/news/stories/2019/sexual_assault_researc... If you could imagine what girls and women go through, some on a daily basis, for years, since childhood, I think you might have a better understanding of why a "gossip app" might actually be a pretty sensible option for avoiding sexual assault and worse.
- mystraline 1y agoAnd as a man, do you know what happens when you report sexual assault? You get laughed at. Hard. So yeah, I'd like to see these broken down between cis-, hetero-, homo-, and trans-. And why are cis-lesbian-women also reporting higher numbers of sexual assault than man/woman relationship? No men in that relationship. https://pmc.ncbi.nlm.nih.gov/articles/PMC5511765/ https://pmc.ncbi.nlm.nih.gov/articles/PMC5511765/ The rainn articles are propaganda with a specific slant.
- Aloisius 1y ago> And why are cis-lesbian-women also reporting higher numbers of sexual assault than man/woman relationship? No men in that relationship. I think you've misread that paper. The sexual assault survey wasn't limited to sexual assaults within a relationship or limited to one's sexual orientation. Lesbians can be sexually assaulted by men.
- amelius 1y agoIsn't Apple supposed to protect these app users? I suspect a lawsuit is in the making.
- spacebanana7 1y agoThere’s nothing Apple can really do about backend security of apps. Conceivably these storage endpoints might’ve never been directly exposed to mobile clients, instead going through other proxies or CDNs.
- chneu 1y agoI think what they meant is that Apple is allowing a legally dubious app to operate. Not that apple should enforce minimum security, but that the app shouldn't be allowed on the App Store in the first place. For obvious reasons. Supposedly, if your photo is posted on Tea you can contact Apple. Then Apple will force Tea to take your information down.
- SilverElfin 1y agoBut how would you know your photo or any slander is even on there? From what I heard, the app requires a photo and video based verification through a third party service to determine if you’re a woman (which itself seems problematic). Without that access you wouldn’t even know if your information is on there.
- goku12 1y agoIMO, you don't need individual grievances to shut down that app. A lot of the content has already been leaked - some even by women who don't necessarily agree with the method. And there are a lot of complaints based on them. Many don't even need you to know the background of the men to know that they are toxic and unethical (and probably illegal as well). Cases like 'ghosting after a single date', 'not good in bed', something else equally frivolous or a lot of one-sided narratives. What do all these have to do with 'women's safety', as much as they have to do with men's safety? A lot of men are genuinely weary of dating precisely because of those (I'm talking about men who prefer relationships, not the MGTOW types). This is extremely harmful to the society in general. I believe that these platforms are misusing the 'women's safety' argument to exploit corporate bias in order to circumvent anti-doxxing safeguards and reinforce a very toxic culture.
- Beijinger 1y agoLOL, well deserved. https://youtu.be/WjfpryoQ0Mk https://youtu.be/WjfpryoQ0Mk
- Beijinger 1y agoWhy the downvote? It is just pictures and names. Both disclosed against their will but, and this is the ROTFL part, this is exactly what the ladies did. Uploading pictures and names of unsuspecting male victims and violating their privacy. Let ladies have some of their own medicine.
- idkfasayer 1y ago[dead]
- whatsupdog 1y ago[flagged]
- IlikeKitties 1y ago4Chan suggested a better name BodyCountr. Where you rate woman on how high their respective bodycount is.
- whatsupdog 1y agoTotally valid. If men can be shamed for number of sexual partners they have (I'm talking about calling someone an incel), so should be women.
- saagarjha 1y agoThey're shamed for being misogynists. You can be celibate without making it your entire life or blaming it on women.
- ryoshu 1y agohttps://x.com/tolly_xyz/status/1948375237994672389 https://x.com/tolly_xyz/status/1948375237994672389 - BoxScore. Someone did it.
- SilverElfin 1y agoI think it isn’t real? Or Apple banned it.
- 1970-01-01 1y ago"Breached" 1st sentence: "exposed database" We need a more nuanced headline here. They did nothing responsible. 404 should title this story with something that will blame them first and the 'hackers' 2nd.
- aaronmdjones 1y agoThis app's data store was "breached" in the same way that one breaches a castle by walking across the lowered drawbridge, through the open gate, past the empty guard stations.
- zahlman 1y agoMy general observation thus far has been that submissions from 404media are rarely anything that I'd consider quality content for HN.
- prophesi 1y agoI wouldn't go that far. What they uncover with their FOIA requests that the general public would otherwise never know about tends to be quality content. And, like the Wired, their FOIA-based articles aren't paywalled.
- ch_fr 1y agoYeah, the term "breached" was a very poor choice, because it sounds like "this was breached recently" instead of telling "the database could be seen by anyone ever since the app's conception, and it only came to light today" which has much worse implications.
- gaws 1y agoNo one "breached" the site. The pictures sat on a public-facing Firebase bucket, ripe for the taking.
- deanCommie 1y agoThis kind of pedantry drives me crazy. If i leave my house unlocked and someone walks in and takes my TV, they still committed a crime! Just because it was irresponsible of me, they still BREACHED MY PRIVACY. The correct ethical behaviour in situations like this is to report to the site that this information is exposed, not download it and archive and repost it. EVEN IF you believe that the app is itself unethical, you cannot tell from just the drivers licenses of the users who signed up that they have themselves done anything unethical justifying reprisal.
- indycliff 1y agoMy guess, hired the absolute lowest paid developers and got what they paid for.
- kashnote 1y agoI'm a firm believer that if you want to start a tech company, at least one of the founders has to have a technical background. Even if you outsource all the work, you need to be able to ask the right questions related to security. It's not just that this database was accessible via the internet. It was all public data. Storing people's IDs in a public database is just... wow.
- kenjackson 1y agoTech background isn’t sufficient. They need to have security background. Some of the worst people I’ve met with respect to security have been technical enough to have the wrong level of confidence.
- TZubiri 1y agoDoctors need to study 5 to 8 years and pass rigorous exams Attorneys the same Structural architects and engineers the same We have a couple of decades more until we lock tech up, up until now it was all fun and games, but now and in the future tech will be everywhere and will be load bearing
- Pigalowda 1y agoTech is special! Think about the margins, the gains, the $$$! I bet on greed. It always wins.
- justahuman74 1y agoBy then we'll just launder the blame onto the AIs
- alibarber 1y agoBut now we have amazing vibe coding tools that mean that you don’t need to be technical or whatever - you can just deliver results. After all, the best LinkedIn influencers and founders don’t care about how something is delivered, just what. Yeah, we’ve finally, nearly, just got to the point where realizing that treating IT and security and such as simply a cost centre to be minimised maybe quite wasn’t leading to optimal security outcomes - to throwing it all away again.
- anal_reactor 1y agoThis is legit funny
- ok123456 1y agoWe need to stop allowing companies that are not directly engaged in financial services to request government IDs. Facebook shouldn't legally be allowed to demand an ID any more than this disaster of an "app." Now tens of thousands of people will be subject to identity theft because someone thought this was a neat growth hacking pattern for their ethically dubious idea of a social networking site.
- 1123581321 1y agoA secure Know Your Customer API would be a useful service for Apple and Google to provide to developers. It could scan the ID and reveal individual pieces of information with permission to the application or multiple applications. Forgive me if it already exists and this app just wasn’t using it.
- arianvanp 1y agoApple is launching such a service in iOS26 https://developer.apple.com/videos/play/wwdc2025/232/ https://developer.apple.com/videos/play/wwdc2025/232/
- 1123581321 1y agoAh, nice that it's a web standard. Looks like Google is as well. https://developer.chrome.com/blog/digital-credentials-api-origin-trial https://developer.chrome.com/blog/digital-credentials-api-or... Link to the related web standard https://www.w3.org/TR/vc-data-model-2.0/ https://www.w3.org/TR/vc-data-model-2.0/
- ok123456 1y agoOr we could deny providing "app" developers with any such information.
- codedokode 1y agoI am not going to show my ID to Google, especially given that it is a foreign company with dubious data collection history.
- deleted 1y ago[deleted]
- bilekas 1y agoSo it wasn't "breached" ... It was just so badly made that the bucket was public. Vibe coding ?
- elicash 1y agoLots of us were bad at this even before AI.
- throwawayq3423 1y agoSeriously, if you looked at the comments in this thread, you'd think this is the first data breach of its kind.
- throwpoaster 1y agoOh no, they doxxed the users of the doxxing app. Shocking (tiny violin emoji)!
- jackdawipper 1y agoIn 2008 when the GFC every company we worked IT for on contract fired their IT staff first. Two weeks later, we had bonanza period right through into the next year. They realised the hard way that those lowly cheap IT staff were quietly keeping them afloat. We charged a lot to fix their problems they created because their CEO thought IT was a waste of money. This will prove security in IT coding is necessary, so enjoy watching the drama unfold. IT security bonanza time. It wont be long.
- fHr 1y agohahahhahaha
- edm0nd 1y agoSomeone dropped a map from all of the photos metadata RIP https://x.com/vxunderground/status/1948850061493850598 https://x.com/vxunderground/status/1948850061493850598
- WrongOnInternet 1y agoNot to get all conspiratorial, but if I was an incel, or other type of woman-hating-man, with an axe to grind, creating an app to "protect" women and their dirty secrets, then having their data "breached" would be a pretty diabolical revenge plan. Only women can join the app, but the only person running the app is a man? Nothing suspicious about that...
- thekevan 1y agoJust yesterday I saw tweets from someone popular in tech Twitter talking about how great it was that he helped the person who made this.
- seivan 1y ago[dead]
- hnpolicestate 1y agoThe trend has been for all things related to sex, dating and relationships to be aggressively male hostile. But I think it's certainly peaked. Off topic, any notice how anti -male bumble is? Trash app.
- noisy_boy 1y agoAt this rate what is even the point of dating for men? An angry ex can just ruin your reputation.
- goku12 1y agoI get this feeling that you will be downvoted to oblivion on HN if you talk against anything that harms men. Even when it involves technology and is therefore relevant here. Many seem to think that gender equality, justice, sexual violence, etc applies only to one gender. I really would like to know how we reached this situation and their justifications for it.
- noisy_boy 1y agoI think there is a stupid propensity to overcorrect in the mainstream media about polarizing issues for profit which has been normalized by repeated messaging and has spread into our normal lives like a disease. Violence again women is very real and men have been the main inflictors of it. However violence against men isn't physical because just biology. So it takes more insidious forms which combined with expectations of masculinity makes it so much more worse. If we chose to selectively condemn the former kind of visible violence without protesting the more hidden kind, it is equally toxic as condoning violence against women. Proudly lauding an app that enables scaling up of this kind of toxicity without any recourse by giving women carte blanche is another form of extremism.
- gaiagraphia 1y agoNot sure, but think this may have been the original thread: https://archive.4plebs.org/pol/thread/511313558 https://archive.4plebs.org/pol/thread/511313558 >DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN! >Tea App uploads all user verification submissions to this public firebase storage bucket with the prefix "attachments/": [link, now offline] >Yes, if you sent Tea App your face and drivers license, they doxxed you publicly! No authentication, no nothing. It's a public bucket. I have written a Python script which scrapes the bucket and downloads all the images, page by page, so you can see if you're in it: [pastebin link] >The censoring in picrel was added by me. The images in the bucket are raw and uncensored. Nice "anonymous" app. This is what happens when you entrust your personal information to a bunch of vibe-coding DEI hires. >I won't be replying to this or making any more threads about it. I did my part, God bless you all. Regards, anon Being so careless with people's personal data should be a major crime, tbh. If I manipulated thousands of people to let me scan their passports and various other bits of personal info, then just left the copies around the city for people to find, I'd be prosecuted, and rightfully so.
- ipnon 1y agoThe irony of a doxxing app being wrecked by the anonymous is too much for me!
- gitremote 1y ago[flagged]
- aaron695 1y ago> It's not ironic. [OP edited out] Either use the criminal justice system. Or form a lynch mob and stand behind your lynching. But don't cry when you have chosen the route of self organized violence with zero checks and balances, clear examples of lynching the wrong people, then running and hiding back behind "civilized society" when your inept violence backfires. You are no different to Kiwi Farms, I suggest you look to their site for tips on how to protect yourself while being violent on others. Kiwi Farms also has a list of sexual abusers they have helped stop, some really horrific people.... but like "Tea" that's not the full story. Until then it is "ironic"
- technion 1y agoGiven it's now "fixed", here's the scraping code so you can verify how this went down: https://pastebin.com/CPBiqd1E https://pastebin.com/CPBiqd1E
- deleted 1y ago[deleted]
- news_hacker 1y agoMirror: https://web.archive.org/web/20250725124140/https://pastebin.com/CPBiqd1E https://web.archive.org/web/20250725124140/https://pastebin....
- ungreased0675 1y agoI’d like to start seeing legal jeopardy for companies that are careless with customer information. Make developers scared to retain anything they don’t absolutely need.
- calexanderaz 1y agoWhat Tea Got Wrong (and how to avoid it) https://youtu.be/mMvfBUNNKIY https://youtu.be/mMvfBUNNKIY
- DaSHacka 1y agoThey posted an official response: https://www.teaforwomen.com/data-breach https://www.teaforwomen.com/data-breach
- megadopechos 1y ago"Your data privacy is of the utmost importance to us." No it ain't.
- oc1 1y ago> At 6:44 AM PST on 7/25, we identified unauthorized access to our systems and immediately launched a full investigation to understand the scope and impact of the incident. Here’s what we know at this tim The first sentence is already a lie as there was never authorization in place followed by more lies.
- chneu 1y agoThat page is nothing but lies. Wow. They admit to lying to their users(about data retention) and then lie more. That's incredible.
- nonhaver 1y agoif im understanding correctly this was a public bucket? aside from the obvious leaking of data couldnt this also be subject to a DoW (denial of wallet) attack where a user could auto download all the images constantly on a VPS and cause a massive bill?
- chneu 1y agoaccording to the company this was an old bucket they used prior to 2024 when they moved to a more robust system. So...they were storing people's information long term in a publically accessible bucket when users did not know. In fact, I believe users were told their IDs/selfies were immediately deleted(not stored), then Tea turned around and says they were legally required to store those photos. Tea had to address this in their press release, apparently.
- nonhaver 1y agothats so insane
- realsolipsist 1y agoJust wanted to add…I can’t sneed
- mullingitover 1y ago[flagged]
- boppo1 1y agoWomen never lie
- josteink 1y agoI guess a significant difference is than 4chan is fully public. Whatever anyone says there can be observed by anyone and refuted by anyone. You can’t secretly slander anyone there. What happened on the tea app were probably not knowable, observable or refutable for those actually being doxxed or slandered. That isn’t me saying 4chan is absolutely morally in the clear, but it’s still quite a significant distinction.
- fn-mote 1y agoThe difference _for you_ is in the public or private nature. It seems like your argument is based on (1) the discussion being slander (assumption); and (2) the idea that you could refute it if it were public (good luck, low credibility, also most men would immediately respond with vulgar name calling and - at least if anonymous - threats).
- Yeul 1y ago[flagged]
- John-117 1y agoMen do not believe they have "sexual privileges". There is an entire community (I'm sure quite active on this website) of men who are notorious for not being able to have sex with anyone. Let me correct that statement for you. Men get upset when they are, as a policy, unable to view the (not fact checked) things being said about them in a public internet forum.
- Der_Einzige 1y ago[flagged]
- oc1 1y agoWait, the app does what? > The app aims to provide a space for women to exchange information about men in order to stay safe, and verifies that new users are women by asking them to upload a selfie. What exactly does this mean? Which information is exchanged without consent of these people? This seems to me more problematic than the actual topic of the data breach.
- iforgotpassword 1y agoYou can use that app in different ways: 1) you dated a guy on tinder, he became all pushy on your first date, touched you inappropriately even though you said no. Or some guy became violent during your relationship and you even found out he has a history of that. 2) you dated a nice guy but he dumped you for whatever reason, and now you want to get back at him so you make up stuff like mentioned above, and post it there.
- eastbound 1y ago3) You’re in competition with someone at work and you want to make his life difficult. You want to blackmail someone into promoting you, etc.
- raincole 1y agoIn other words it's a slander platform. Got it.
- mandmandam 1y ago[flagged]
- deleted 1y ago[deleted]
- atoav 1y agoI was curious what the percentage of false allegations are, as this is often quoted as a problem by men online¹. The conclusion of my research is that the rate of false reports is essentially the same as for any other crime (so somewhere in the single digits). ¹: I am a man myself and I understand that men feel threatened this may happen to them. But I personally know multiple women who experienced sexual violence and zero men who were accused of rape
- anonzzzies 1y agoOutsourcing job was it? Modern programmers are literally terrible at all basic stuff (who stores ID images in the db and then in the clear, do you have many other mental issues or what?) (I see startups like Resend making the same mistakes and still people use them, so there isn't much punishment even from people with half a brain) and AI is going to make it all so much worse. And a public bucket. I think it should be criminally liable to be that sloppy.
- juandsc 1y agoI don't think it's a modern programmers problem, in fact, I think we can argue we are much better than 20 years ago at least in terms of security. There is a much higher concern for data validation and no one used HTTPS 20 years ago. Literally there were social networks with people uploading photos and personal stuff which didn't even have HTTPS.
- anonzzzies 1y agoBut that was because no one told them. Now they are told and taught. A lot of systems Warn even for opening something publicly... And yet. I check all CVE's of the software my clients use because we need to figure out why things are broken and often this is a start -> unpatched CVE's. Most (by far) CVE's are not 'honest mistakes' or missed corner cases because rocket-science; they are just sloppy programming. Something that should never pass review. We DO know better but people ship things and hope for the best (including the case in this post etc).
- juandsc 1y ago> But that was because no one told them. Now they are told and taught. That's precisely my point. > Most (by far) CVE's are not 'honest mistakes' or missed corner cases because rocket-science; they are just sloppy programming. This is actually true, but it's true because we have way better tooling and safer languages, which means we don't see nearly as many buffer overflows or memory management issues. It's not that you didn't have negligent programmers back then. > Something that should never pass review. We DO know better but people ship things and hope for the best (including the case in this post etc). That's not new though. We've seen similar things happen in the past multiple times. 20 years ago code review was literally a bunch of meetings in a room or talk with another developer in person. Having something like github where you make a pull request, passes the automated test suite and requires a code review, etc. simply wasn't done. If in 2005 that already existed it was extremely bleeding edge. I do have concerns about the code quality issues introduced by the abuse of LLMs, but until right before that was a thing, definitely the code quality in general has improved a lot.
- poemxo 1y agoOn X, one of the leaked pictures seemed to be a DoD ID card, and I wondered why Tea needed proof of someone's identity. Then I remembered Uber and Lime both want your drivers license. Facebook and Instagram supposedly request it too if your account gets locked. This is not a new normal I like.
- odiroot 1y agoThat "Tea" app seems like a real GDPR nightmare anyway.
- deleted 1y ago[deleted]
- irusensei 1y agoIt's almost poetic that this happens on the same day UK demands website to collect personal identification. I'm looking forward to the shitshow in the upcoming months.
- okokwhatever 1y agoWhat a moment to be a woman dude...
- mandmandam 1y agoFor all the gloating in here about doxxers getting doxxed, there sure are a lot of HN accounts exposing themselves as utter creeps in here.
- VerminOctopus1 1y ago[flagged]
- mandmandam 1y ago[flagged]
- energy123 1y agoRepeal section 230 and end this Black Mirror dystopian madness.
- red_acted 1y agoBro, I’m just vibing. Wym I have to care about data security… shakingmyheadsmh
- John-117 1y agoI would not be disappointed if some actual hacking was done to bring down the entire app. I don't think the Tea app realizes just how many competent people dislike them, and they clearly have very few competent people of their own.
- egeggrg 1y ago[flagged]
- egeggrg 1y ago[flagged]
- The_President 1y agoGentlemen, we're working on a new app called Eyeroll. It's a revolutionary new dating app, where our users can rate the women they have dated based on favorable and/or unfavorable attributes. Every month, our marketing team will generate a scoreboard of profiles that score highest on all mainstream attributes, and our search and filter function will rival that of Amazon (including the much requested sort by lowest first.) We're seeking $23-to-$23.5 million in funding to get our product over the finish line.
- codedokode 1y agoThis reminds me of people saying "a honest person has nothing to hide". A honest woman who has nothing to hide, would post stories under her name and write her address, GPS coordinates and phone number in case someone needs clarifications or has objections to the post.
- cindyllm 1y ago[dead]
- liul77360 1y ago[dead]
- excalibur 1y ago4chan is still a thing? I thought it was hacked to death.
- jennyholzer 1y agoi thought the CIA cut its funding
- thebiggening 1y agoLMAOOOO deserved
- thebiggening 1y agoTo be fair offering a platform for people to commit torts probably isn’t the best idea