633
Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan (www.404media.co)
submitted 1 year ago by to c/technology@lemmy.world
250 comments fedilink hide all child comments
 

Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.

you are viewing a single comment's thread
view the rest of the comments
[–] 102 points 1 year ago* (last edited 1 year ago) (16 children)

Wow that was fast.

I did not even know this app existed untill about 8 hours ago.

Already comprimised.

EDIT: Also, lol, this arguably is not even largely a hack.

These idiots just had everything stored in a fucking publically accesible firebase bucket... amazing.

They didn't delete anything they claimed to.

Either way you look at it, anywhere on the spectrum from:

A ] A bunch of women reasonably concerned for their safety

B ] A bunch of gossip mongers

... well, they've now all been doxxed, ironic from each angle.

What a fucking disaster.

  • permalink
  • fedilink
  • source
  • hideshow 16 child comments
    •
  • [–] 3 points 1 year ago (13 children)

    this arguably is not even largely a hack.

    While I agree in principle, I think we should still call it a hack. As in "to gain illegal access to (a computer network, system, etc.)" as Merriam-Webster puts it. It shouldn't be legal to do do this just because the website had horrible (non-existent) security. You shouldn't be allowed to rob a house just because the door wasn't locked.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [–] -1 points 1 year ago* (10 children)

    At which step should it turn illegal? You accessing publicly available website? How exactly are you to know if it is supposed to be public or not, if there is not even an attempt at security?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 2 points 1 year ago (9 children)

    The thing is we don't need to come up with some absolute definition of what should and shouldn't be illegal to talk about this case specifically. They didn't accidentally stumble on this. They doxxed the users instead of responsibly disclosing the problem. This is extremely cut and dry.

    If the story here was "I mistyped something and got to a page I shouldn't have access to, I disclosed it to the company, didn't dox anyone by sharing the problem, and now the FBI is after me" it would be different.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 1 year ago* (8 children)

    They were looking through publicly accessible buckets on firebase. They literally did stumble upon this by accident while going through public data. And then just told other people about what they found. Should they have disclosed it once they realized what it was instead of spreading it? Sure, morally speaking. But I don't see how you could write a law to make this illegal without just trampling on free speech.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 1 year ago (7 children)

    And then just told other people about what they found.

    That's a weird way to say they doxxed people instead of ethically disclosing what they found. Hiding that detail is why I have a problem with defending this.

    If someone steals something they didn't know belonged to someone (say through an unlocked door), should we prosecute them? I don't know. What did they do next after they found out they shouldn't be there? Did they give it back and tell the building owners "hey, you have an unlocked door" or did they yell to the street "hey everyone, come get free stuff!" How did they behave once they knew they did something wrong.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] -1 points 1 year ago* (last edited 1 year ago) (6 children)

    From what I have seen, they initial guys shared a link to the database, not any content. The equivalent of telling people: "Look at this unlocked door I found." They did not "steal" anything as far as I know.

    Also, the analogy doesn't work either. What if it really was intended to be public? Making a copy is not analogous to stealing something, it's analogous to taking a picture.

    PS: Maybe to make it clearer what I am thinking of. A real court case that happened: A person found a bunch of documents on a government website, just sitting there. He decided to share them. Turns out they were not supposed to be public. The government tried to prosecute the guy who had no idea the files were not public. They thankfully lost.

    How can it be the responsibility of a person to try to figure out if these files are supposed to be public or are public on accident? Yes, these guys had a good guess that this was an accident, but so what. We don't prosecute people for having good guesses.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 1 year ago (5 children)

    Damn, do you think this link I found that has a ton of women's drivers licenses is supposed to be public? Better share it to 4chan. They'll know what to do.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 0 points 1 year ago* (last edited 1 year ago) (4 children)

    So it's just about the drivers licenses? We should make a law to ban sharing drivers licenses? Or is it posting to 4chan that should be illegal?

    What do you believe should be the law here? You just keep arguing this specific case should be illegal, but based on what? Which specific part?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 1 year ago (3 children)

    When did this ever become about what laws should be? There already are laws for this. How are you so obtuse? They doxxed thousands of women. I can't stress that enough. They doxxed thousands of women and you're defending them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 1 year ago* (2 children)

    Not legally, no they didn't. Tea did. Under current laws, they have no obligation to report this or to not tell other people about it.

    Seems the issue is you don't understand how laws work.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 year ago (1 child)

    No need to be condescending. The current laws about hacking in America are actually much more strict than they should be and can be used to punish people who actually do just stumble on things they shouldn't have access to as well as people who are ethical whistle blowers. So no, it seems you don't "how laws work."

    But I don't believe those laws should be used to go after people who make mistakes or report problems in good faith. These folks didn't make an innocent mistake and weren't acting in good faith.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •