12 ms·
Tea app leak worsens with second database exposing user chats
- booleandilemma 1y agoWhat happened with this app feels like karma.
- OutOfHere 1y agoYet, the app is alive and thriving. For some reason, Google and Apple are protecting it.
- monkeywork 1y agobecause news articles and media are putting out this narrative that the site was a "safety tool" that was critical in allowing women to "protect themselves", instead of what it actually was: a gossip and hate-spewing site with zero oversight/recourse for anyone who is being slandered. The app stores haven't pulled it because they are waiting for this to flow out of the news cycle and reduce the impact of this subset of our culture freaking out at them.
- frollogaston 1y agoSay I were single and ended up being slandered on that site, what would happen? Sounds like the users on there are not the kind I'd want near me anyway.
- _--__--__ 1y agoThere is no safe amount of attention from people who spend their time sharing 'drama' online. The most extreme example is the kiwifarms lolcow stuff, but even very normal and boring internet 'microcelebs' learn the hard way that some insane person somewhere will decide they don't like you and go out of their way to interfere with your life and relationships.
- monkeywork 1y agoThat's the equiv of saying I don't need privacy because I have nothing to hide. Just because you don't want anything to do with the type of people who would post pictures of you and slander / shit talk you doesn't mean that you should want that being out there to begin with - it's not like that sort of thing hasn't ever been weaponized against someone before. The worst part is with this app there is a high chance you'd never find out that anything was ever said about you until the snowball is so big that it'll crush any attempt to slow it down.
- frollogaston 1y agoGuess this is too theoretical for me to worry. This app was up for years, I was wondering if they ever coordinated an attack on someone other than just avoiding him. And yeah, I am trusting certain companies like Apple with some of my data to some extent.
- booleandilemma 1y agoImagine being shadow banned from dating.
- frollogaston 1y agoThat's only if the normal women are on that website. Which could happen, but sounds like it was a weird place.
- npteljes 1y agoThe outcome is very hard to determine, because we don't know your goals and circumstances. Focusing on the downsides, 1. Wrt/ dating, the obvious downside is that your potential partner is dissuaded from dating you because of what is said on the platform. 2. I can also see vigilante justice; an extremist reaction to what is said on the platform. Actual violence, or just harassment, online or real life. 3. Or, I can see corporations using these databases on the down low to filter potential employees, similar to how they screen online presence as well. Of course, all of these are just potential risks, not things that actually happen(ed yet).
- tough 1y agoif the US govt had told the company to get their shit together or close up after the first leak, the second one wouldn't have happened
- deleted 1y ago[deleted]
- cwmoore 1y agoYou are now permanently banned from /r/TwoXChromosomes
- cmxch 1y agoThey wouldn’t protect it if it were a male oriented dating safety app.
- monkeywork 1y agobecause there is no subset of our current culture that would go scorched earth on them over the removal. They aren't so much picking sides based on their moral compass more picking sides to induce the least harm to bottom line.
- OutOfHere 1y ago> picking sides to induce the least harm to bottom line. This is why Google has a large number of scam dating apps on its app store. The apps I refer to are near/complete scams with 99% fake profiles and 1% lured, like the phishers of Myanmar, only these are Western. They bring big money in.
- seec 1y agoEven apps that are not strictly for dating are full of scams, a lot of catfishing is going on with a ton of onlyfans egirl type of profile. A while ago (about 3 years), I downloaded a ton of apps made (allegedly) to meet new people in cities you don't know (I was going to spend about 3 weeks at a friend and he would be busy with his job); Meet with Locals types of apps. I shit you not, the vast majority were filled with scam profiles and a lot of what I assume is escort services/soft prostitution and whatnot. So, I just deleted them all and just met people the old-fashioned way (which was just fine, not sure technology has a real use case for that); but it was an eye-opener.
- scarmig 1y ago<tinfoil>Google is invested in ratcheting up the war behind the sexes, because it atomizes people and makes them prime targets for an upcoming companion AI product.</tinfoil>
- jasonm23 1y agoWell, to be fair, the "gender war" has been incredibly lucrative for years, sad lonely people do tend to buy more crap.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- dlcarrier 1y agoThis is why I immediately nope out of anything that requests a copy of a photo ID.
- iszomer 1y agoEspecially the IRS? eg, ID.me?
- zamadatix 1y agoMost people don't actually require ID.me to deal with the IRS, even if e-filing.
- frollogaston 1y agoIf you lost your last return and need to request a transcript, I think it's your only option
- fc417fc802 1y agoI mean yeah, I'm extremely uncomfortable with commercial ID solutions when accessing government services. When I can I even avoid government websites that have captchas or other third party resources on them but that's becoming increasingly unworkable. It's absurd that I should be required to leak my personal information to third parties in order to make use of a government service (ie something with no competition that I am legally obligated to use). For the IRS it doesn't even make sense because I can drop paper forms in the mail. Don't need any ID whatsoever for that.
- iszomer 1y agoI don't trust dropping any PII/payment-related forms in the mail either, stemmed from a recent experience in which a NYC's DoF had used my information to pay for services on my behalf without authorization.
- paulpauper 1y agomaybe AI will become good enough to create realistic IDs
- comrade1234 1y agoOut of curiosity I downloaded the larger size one - 200+GB I think (not at my computer right now) and skim through it every now and then. It's depressing - so much toxicity. Everyone seems mentally ill to me - male and female. This is a world completely alien to me and the people close to me.
- slg 1y ago[flagged]
- AuthAuth 1y agoIts public info, you cant cover your eyes and pretend it doesnt exist right there for everyone to see. Thats the reason why leaks are so bad.
- neilv 1y agoIf someone gets beaten up and left in the street, and, consequently, their wallet is laying right there beside their unconscious body, is it OK for you to take their wallet? I mean, you can't pretend the wallet isn't right there, for everyone to see, just begging for someone to take it? This is why beatdowns are so wrong? The person who takes the wallet is as much a victim as anyone? Blame society?
- GloomyBoots 1y agoThis feels like a very dated metaphor. When my older brother introduced me Napster, was I actually rifling through Lars Ulrich’s wallet and shaking out mp3s? In this case, a clone of the wallet has been preserved for all and sundry to peruse. Is it really wrong as a genuinely curious person not to pretend it isn’t there? There’s a lot to be said about privacy on the Internet. I don’t think there’s much to be gained by attacking those who, out of genuine curiosity, don’t abide by the same polite fictions as the rest of us. I dont like browsing random strangers’ PII. I tend to hope those who do show due respect. And don’t see any sign of malice in GP.
- igor47 1y agoimho, as much as i like firebase, i think the design encourages this kind of broken security model. the default is open-to-the-world with credentials in the client app. setting up firebase permissions is kind of a pain. in the traditional db world, at least your db creds live on the server-side app.
- frollogaston 1y agoFirebase's DB (Firestore) being almost default-allow is even funnier, and that was the core functionality from the start, leading to tons of huge breaches over the years. At least a public file bucket is a more valid use case, except I'm guessing they left the "list files" permission open. Edit: Oh, chat DB is probably Firestore, so they left that open too, nice. Having used it several times, yeah I wouldn't entrust it to a dev team. It's gotten better lately but still seems like the gun is always pointed at your foot. Also GCP, storing secrets properly in AppEngine is notoriously difficult and prone to accidental git-commit: https://stackoverflow.com/questions/58371905/how-to-handle-secrets-in-google-app-engine https://stackoverflow.com/questions/58371905/how-to-handle-s...
- andrepd 1y agoIt's to this kind of quality engineering that they want me to entrust my ID so I can watch pr0n or insult a politician online. Jesus.
- frollogaston 1y agoAre they specifically using Firebase for that? I'm not saying GCP is unsafe in general, just Firebase.
- darth_avocado 1y agoI wonder why I learnt “deny by default is a good starting point” in an undergraduate computer science course decades ago.
- 1y ago
- mg794613 1y ago"Worsens" is relative. Discovery of heinous defamation circles, doesn't sound like something to look away from or feel sorry for.
- fn-mote 1y ago> doesn't sound like something to look away from Frankly, I don’t waste my time online with toxic behavior. In real life, I might have a response. Online, it is too hard to get an idea if the interaction is even sincere.
- mg794613 1y agoYou're completely right, sorry, I meant more for authorities, not you or me.
- deepfriedchokes 1y agoSo this is an app where people defame others? Would these leaked communications expose their users to libel charges?
- Gigachad 1y agoI doubt it if they were private communications.
- Perceval 1y agoEven private written communications can be libel if they are false and injure the reputation of the subject.
- mensetmanusman 1y agoNot as part of a mass hack where one could just argue it’s fake data.
- whamlastxmas 1y agoIt isn’t that straight forward. If you wrote it and it got published, it still counts as published even if you didn’t publish it yourself. The crux of libel is that you made it permanent somehow by writing it.
- Gigachad 1y agoWho's to say you wrote it and that the hackers didn't just insert that in the dataset?
- singleshot_ 1y ago> This information was stored in accordance with law enforcement requirements related to cyber-bullying investigations. Citation, anyone?
- exabrial 1y agoI think it's wrong to upload someone's photo without their consent or knowledge, but I don't think this is right either.
- nsksl 1y agoLive by the sword.
- joshdavham 1y agoThis is correct. While I’m not sad about Tea’s most toxic users being exposed, there were likely also many innocent women caught in the crossfire who likely just signed up out curiosity.
- goku12 1y agoIf the chats also leaked, then those innocent women's reputations will be intact. Identity theft however, is a different matter. Overall, it shows what a rotten influence that social media has been on interpersonal relationships in the society. Apps like these show the apathy of authorities towards slander (especially of men) and the presence of predators who want to worsen and take advantage of the gender wars and other forms of bigotry. Ultimately, people must introspect and reassess the influence of these venomous propaganda on their biases and emotions. This sort of radical beliefs is never healthy for anyone.
- general1726 1y agoTea app looks like Kiwi farms, but for girls.
- fruitworks 1y agoAt what point do you just pull the plug out of the wall
- budududuroiu 1y agoWhile I think this app is disgusting, it’s kinda interesting to see the outrage that this app generated. Kiwifarms never gets this level of outrage going, and I’d argue it’s an order of magnitude more toxic to society than Tea would be
- yanderekko 1y agoKF never topped the app store charts, nor had the widespread defense that Tea did.
- mcosta 1y agoCloudflare blocked Kiwifarms. Now and then I read some group trying to boycott Kiwifarms.
- deleted 1y ago[deleted]
- cindyllm 1y ago[dead]
- cmxch 1y agoConsider advocating for data privacy that makes Tea a nonstarter?
- jc4p 1y agoHi all, i'm the security researcher mentioned in the article -- just to be clear: 1. The leak Friday was from firebase's file storage service 2. This one is about their firebase database service also being open (up until Saturday morning) The tl;dr is: 1. App signed up using Firebase Auth 2. App traded Firebase Auth token to API for API token 3. API talked to Firebase DB The issue is you could just take the Firebase Auth key, talk to Firebase directly, and they had the read/write/update/delete permissions open to all users so it opened up an IDOR exploit. I pulled the data Friday night to have evidence to prove the information wasn't old like the previous leak and immediately reached out to 404media. Here is a gist of Gemini 2.5 Pro summarizing 10k random posts: https://gist.github.com/jc4p/7c8ce9a7392f2cbc227f9c6a40961117 https://gist.github.com/jc4p/7c8ce9a7392f2cbc227f9c6a4096111... And to be 100% clear, the data in this second "leak" is a 300MB JSON file that (hopefully) only exists on my computer, but I did see evidence that other people were communicating with the Firebase database directly. If anyone is interested in the how: I signed up against Firebase Auth using a dummy email and password, retrieved an idToken, sent it into the script generated by this Claude convo: https://claude.ai/share/2c53838d-4d11-466b-8617-eae1a1e84f56 https://claude.ai/share/2c53838d-4d11-466b-8617-eae1a1e84f56 And here's the output of that script (any db that has <100 rows is something another "hacker" wrote to and deleted from): https://gist.github.com/jc4p/bc35138a120715b92a1925f54a9d8bba https://gist.github.com/jc4p/bc35138a120715b92a1925f54a9d8bb...
- coopreme 1y agoAre you concerned about potential CFAA issues?
- 1y ago
- thefz 1y agoNow reverse sexes and imagine if such an app would be allowed to exist in the first place
- realsolipsist 1y agoWell that’s it. I can’t sneed.
- water-data-dude 1y ago"The platform states that selfies were not deleted as expected to comply with law enforcement requirements related to cyber-bullying prevention." This is why laws that say "just give websites your photo ID! It's for the safety of the children!" are concerning
- goku12 1y agoExcept, that's not how most laws mandate it. The verification of personal data, its storage and the subsequent authentications based on it are done by a trusted third party - usually a government agency. Either they (the agency) maintain the mapping between the real life identities and the 3rd party online accounts, or they give the 3rd party an ID code which cannot be used to retrieve the personal info without the consent of both the agency and the individual user. Thus, you don't litter your personal data everywhere on the web and risk leaking it like this. All that said, I'm still not a fan of such invasive arrangements and laws.
- frollogaston 1y agoI don't trust a government agency to run such a service competently, at least not US.
- goku12 1y agoThat's a prudent stance. Even in countries where the current government is trustworthy, we have no good way to predict who will attain power in the future. Not to mention the fact that governments themselves are never homogeneous.
- CHUCKEESH 1y ago[dead]
- gotouted 1y ago[flagged]