6 ms·
TeaOnHer, a rival Tea app for men, is leaking users' personal data
- trelane 1y ago> TechCrunch has found Interesting that they've gone from reporting about flaws others found to hunting and hacking themselves.
- haukilup 1y agoThat’s a form of (investigative) journalism that the world could use more of.
- mcintyre1994 1y agoI wonder whether they’re just looking at the exploits that worked against Tea (sounds like it could be the same from their description), or if they have staff that can find their own exploits.
- hooverd 1y agoPart of me wonders if this was deliberate.
- turnsout 1y agoExactly, color me skeptical. I'd never heard of this app, but now there's a headline about it. Users are so numb to data breaches, it probably won't hurt them.
- hyperific 1y agoI wondered the same until the section near the end of the article that mentions that the app creator's email address and password were left unsecured leaving his admin panel exposed. Seems to me if this was deliberate that the creator would have gone to greater lengths to protect themselves.
- amarcheschi 1y agoIt was a bad idea to create an app like that in the first place, it is a bad idea to have the corresponding man-version of the same thing
- hereaiham 1y agoI'm wondering who would fall for this after what happened to the original tea app!? Terrible apps anyway.
- everdrive 1y agoWhat in the world is a "rival tea app for men?"
- parpfish 1y agoliterally the first two sentences of the article: > TeaOnHer, an app designed for men to share photos and information about women they have supposedly dated, has exposed users’ personal information, including government IDs and selfies, TechCrunch can confirm. > The app, which launched on the Apple App Store earlier this week, is a response to another viral app Tea that allows women to post about the men they date.
- bombcar 1y agoRateMyProfessor for dating (DateMyProfessor?). Yelp for Tinder. Amazon Reviews for Match. It helps the argument that anyone you’d want to meet is not on a dating app.
- ashleyn 1y agoGender war can't be a sign of a healthy society.
- assword 1y ago[dead]
- oldpersonintx2 1y ago[dead]
- JKCalhoun 1y agoTo be sure. Thankfully, I don't see a "gender war" — just the usual sensational headlines.
- lagniappe 1y agoThe last decade has been various flavors of gender war.
- 01HNNWZ0MV43FF 1y agoA common symptom of Internet poisoning tbh
- heddel 1y agoTime to start paying attention
- smt88 1y agoDating and marriage are way down, politics are increasingly polarized by gender, and the original Tea app was hacked because men were angry about it... sounds a bit like gender war.
- michaelmrose 1y agoPolitics is only polarized by gender in the US because US men are ignorantly supporting anti women This is a very one sided war on women by conservative men.
- throwanem 1y agoClearly vibecoding is the future.
- grendelt 1y agoHeadline should be "Tea app spills the tea on users"
- smjburton 1y agoIt's concerning that these type of leaks keep happening. Outside of the damage from leaking personal information, they also lower public confidence in trying out new apps. Vibe coding is making it more difficult for app makers in general when users can't trust that their personal information is protected.
- pyrale 1y agoIs that a new thing, though? I feel like there's been a new leak every week for years now.
- smjburton 1y agoIt's not new, but I believe vibe coding is going to make it more common. Both this app and Tea's data breaches could have been avoided with basic web dev security.
- swat535 1y agoExactly, why would security and privacy be ever considered when time and time again, it has been proven to companies that they will face no consequences for their actions. We have had so many catastrophic breaches and leaks that I've lost count by now, from Equifax to AT&T to Lastpass. The consequences? at worst, the companies were forced to give people a 5$ credit or discounts and at best a few angry written articles. Our elected representatives fail to serve the public and punish these corporations.
- 01HNNWZ0MV43FF 1y agoNo, in an accelerationist sense this is good. People should not be trusting SaaS apps with their data. Even huge "trusthworthy" companies like Google and MS have had leaks over the ages. This is a learning opportunity.
- smjburton 1y agoWhy would you not want people trusting their data with SaaS apps? Smaller developers building software benefits users assuming their data is protected with basic security implemented.
- unhappy_meaning 1y ago> Images of these driver’s licenses are publicly accessible web addresses, allowing anyone with the links to access them using their web browser. > TechCrunch also identified a potential second security issue, in which an email address and plaintext password belonging to the app’s creator, Lampkin, was left exposed on the server > While the app requests IDs and selfies from its users to verify their identities — a process that is not automatic — users can access a “guest” view of the app without signing in. Is this just bad development? Are these just things could be missed by any developer or team? I'm curious as someone who would like to create side projects with users (albiet not dubious ones these like apps) but I'm always afraid of a glaring security flaw that would be basic 101 of web development.
- siva7 1y ago> Is this just bad development? Are these just things could be missed by any developer or team This couldn't be missed by competent developers, in both cases (tea and teaonher incidents). I'm not trying to be harsh, but i wouldn't call such teams competent and i'm fully aware that such bad teams exist. Also with the advent of a.i./vibe coding, people with no qualifications and/or experience in software development are now trying to sell / fake themselves as professional developers which also leads to such catastrophic security situations. You wouldn't hire a barista to build a bridge from a 2-week bridge building bootcamp but a licensed civil engineer, yet in software world this idea doesn't seem out of the order.
- 01HNNWZ0MV43FF 1y ago> Is this just bad development? Are these just things could be missed by any developer or team? As the saying goes, "Human error is not a root cause". A good Five Whys would eventually hit something: Why did the DL pictures leak? Because the images were accessible via public URL. Why were they accessible that way? Because nobody on the team checked they were not. Why did nobody check? Maybe not enough red team thinking was employed. It's easy to make an app and say "Look we have a sign-in screen, it's secure", but you need to think from the attacker's perspective and make sure every route to every piece of sensitive data is actually secure.
- hn_throw_250811 1y ago[flagged]
- 01HNNWZ0MV43FF 1y agoIsn't Andrew Tate wanted for rape in some country? Also it is highly funny to see "let's hold people accountable" from green account "HN throwaway"
- throwawayoldie 1y ago> Isn't Andrew Tate wanted for rape in some country? Several of them, if I remember correctly.
- cindyllm 1y ago[dead]
- tristan957 1y agoAndrew Tate is a rapist. We should not listen to anything he says with regard to women, at the very least.
- hn_throw_250811 1y ago[flagged]
- whatthedangit 1y agoIf the day comes when you develop self awareness, you'll feel embarrassed about writing reddit comments like this on hn.
- hn_throw_250811 1y agoConsidering even sama would rather do an AMA about his company on Reddit than HN, I’ll take it as a compliment.
- Noumenon72 1y agoAren't they worried about getting sued/pulled from the app store for appearing to be affiliated with Tea, as a trademark issue?
- Hizonner 1y agoAnybody who'd use an app like that is in a poor position to complain about any privacy problems. I mean, fuck those people. Of course, it's also probably leaking information about the victims of the gossip as well. Shame about that.
- mantra2 1y agoFool me...twice?
- Anonbrit 1y agoHas anybody tried a GDPR request against either this app or tea? My name, or any personally identifiable data is PII by definition, and GDPR gives me an absolute right to view anything they've got associated with my PII, which would include any posts
- anigbrowl 1y agoBoth of these apps are awful so seeing them both leak their user data seems like ironic justice.
- cmxch 1y agoHow about just not creating doxxing as a service apps?
- deleted 1y ago[deleted]
- tpoacher 1y agoI mean ... it is a competitor ...