Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.

top 100 comments

sorted by: hot top controversial new old
[–] 111 points 1 year ago (11 children)

I would not under any circumstances give my drivers license to a for profit app. I don’t even like to give my email.

  • source
  • hideshow 11 child comments
  • [–] 40 points 1 year ago (10 children)

    apparently there's some law in the UK that mandates it now 🙄

  • source
  • parent
  • hideshow 10 child comments
  • [–] 33 points 1 year ago (5 children)

    Well UK, have the day you voted for I guess

  • source
  • parent
  • hideshow 5 child comments
  • [–] 20 points 1 year ago (1 child)

    Unfortunately this is the better of the two main parties. This isn't republicans winning because dems didn't vote. Labour won, and this still went through. The UK government as a whole has been on an anti porn brigade for decades. I can't wait for the day labour and the Tories just die off.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 1 year ago

    Technically the act passed in 2023 under the Sunak government.

    That said; I can't seem to find a vote breakdown and I would not be at all surprised if labour also backed it.

    I'm hoping enough public dissatisfaction leads to labour repealing it but I won't hold my breath.

  • source
  • parent
  • [–] 102 points 1 year ago* (last edited 1 year ago) (16 children)

    Wow that was fast.

    I did not even know this app existed untill about 8 hours ago.

    Already comprimised.

    EDIT: Also, lol, this arguably is not even largely a hack.

    These idiots just had everything stored in a fucking publically accesible firebase bucket... amazing.

    They didn't delete anything they claimed to.

    Either way you look at it, anywhere on the spectrum from:

    A ] A bunch of women reasonably concerned for their safety

    B ] A bunch of gossip mongers

    ... well, they've now all been doxxed, ironic from each angle.

    What a fucking disaster.

  • source
  • hideshow 16 child comments
  • [–] 3 points 1 year ago (13 children)

    this arguably is not even largely a hack.

    While I agree in principle, I think we should still call it a hack. As in "to gain illegal access to (a computer network, system, etc.)" as Merriam-Webster puts it. It shouldn't be legal to do do this just because the website had horrible (non-existent) security. You shouldn't be allowed to rob a house just because the door wasn't locked.

  • source
  • parent
  • hideshow 13 child comments
  • [–] -1 points 1 year ago* (10 children)

    At which step should it turn illegal? You accessing publicly available website? How exactly are you to know if it is supposed to be public or not, if there is not even an attempt at security?

  • source
  • parent
  • hideshow 10 child comments
  • [–] 2 points 1 year ago (9 children)

    The thing is we don't need to come up with some absolute definition of what should and shouldn't be illegal to talk about this case specifically. They didn't accidentally stumble on this. They doxxed the users instead of responsibly disclosing the problem. This is extremely cut and dry.

    If the story here was "I mistyped something and got to a page I shouldn't have access to, I disclosed it to the company, didn't dox anyone by sharing the problem, and now the FBI is after me" it would be different.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 1 year ago* (8 children)

    They were looking through publicly accessible buckets on firebase. They literally did stumble upon this by accident while going through public data. And then just told other people about what they found. Should they have disclosed it once they realized what it was instead of spreading it? Sure, morally speaking. But I don't see how you could write a law to make this illegal without just trampling on free speech.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 1 year ago (7 children)

    And then just told other people about what they found.

    That's a weird way to say they doxxed people instead of ethically disclosing what they found. Hiding that detail is why I have a problem with defending this.

    If someone steals something they didn't know belonged to someone (say through an unlocked door), should we prosecute them? I don't know. What did they do next after they found out they shouldn't be there? Did they give it back and tell the building owners "hey, you have an unlocked door" or did they yell to the street "hey everyone, come get free stuff!" How did they behave once they knew they did something wrong.

  • source
  • parent
  • hideshow 7 child comments
  • [–] -1 points 1 year ago* (last edited 1 year ago) (6 children)

    From what I have seen, they initial guys shared a link to the database, not any content. The equivalent of telling people: "Look at this unlocked door I found." They did not "steal" anything as far as I know.

    Also, the analogy doesn't work either. What if it really was intended to be public? Making a copy is not analogous to stealing something, it's analogous to taking a picture.

    PS: Maybe to make it clearer what I am thinking of. A real court case that happened: A person found a bunch of documents on a government website, just sitting there. He decided to share them. Turns out they were not supposed to be public. The government tried to prosecute the guy who had no idea the files were not public. They thankfully lost.

    How can it be the responsibility of a person to try to figure out if these files are supposed to be public or are public on accident? Yes, these guys had a good guess that this was an accident, but so what. We don't prosecute people for having good guesses.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 year ago (5 children)

    Damn, do you think this link I found that has a ton of women's drivers licenses is supposed to be public? Better share it to 4chan. They'll know what to do.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 0 points 1 year ago* (last edited 1 year ago) (4 children)

    So it's just about the drivers licenses? We should make a law to ban sharing drivers licenses? Or is it posting to 4chan that should be illegal?

    What do you believe should be the law here? You just keep arguing this specific case should be illegal, but based on what? Which specific part?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 0 points 1 year ago (3 children)

    When did this ever become about what laws should be? There already are laws for this. How are you so obtuse? They doxxed thousands of women. I can't stress that enough. They doxxed thousands of women and you're defending them.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 1 year ago* (2 children)

    Not legally, no they didn't. Tea did. Under current laws, they have no obligation to report this or to not tell other people about it.

    Seems the issue is you don't understand how laws work.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago (1 child)

    No need to be condescending. The current laws about hacking in America are actually much more strict than they should be and can be used to punish people who actually do just stumble on things they shouldn't have access to as well as people who are ethical whistle blowers. So no, it seems you don't "how laws work."

    But I don't believe those laws should be used to go after people who make mistakes or report problems in good faith. These folks didn't make an innocent mistake and weren't acting in good faith.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 50 points 1 year ago

    Protecting our users' privacy and data is our highest priority. We are taking every necessary step to ensure the security of our platform

    Since sensitive data was put on a public bucket, maybe they meant it was their lowest priority?

  • source
  • [–] 93 points 1 year ago (13 children)

    I can't open the article, but I think I read that this was hosted on an unprotected bucket. Assuming that's correct I wouldn't say this was a breach. A better headline would be "Women dating safety app 'Tea' exposed women's PII".

    To be 100% clear, I'm not excusing the hackers. I don't believe it's morally correct to publicize something because it is exposed. For folks curious about that you can look into how to ethically disclose vulnerabilities. I still view this as doxxing. I still believe what the hackers did should be a criminal offense, it's just that I also believe the app holds a ton of the blame as well. How can you proclaim to be about keeping women safe while putting them at risk? That should be punished as well.

    Like if the storage facility you trusted to hold your stuff never had locks on the doors, shouldn't they take a lot of the blame as well as the thief who found out a door was unlocked?

  • source
  • hideshow 13 child comments
  • [–] 41 points 1 year ago (8 children)

    The bigger problem is trying to get the mainstream that would read an article like that to understand the technical difference between hacking and accessing unsecured data.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 25 points 1 year ago (4 children)

    One of the definitions of hacking is illegally gaining access to a computer system. It doesn't need to involve any sort of exploit. Stealing from an unlocked home is still stealing. Gaining access to a system by phishing is still hacking. Leaking data that is technically publicly accessible that isn't meant to be publicly accessible is still hacking.

    Not that I suspect anything good from 4chan but the proper thing to do would be to disclose to Tea that their data is public and allow them to fix the problem. The ethics of vulnerability disclosure still apply when the vulnerability is "hey you literally didn't secure this at all."

  • source
  • parent
  • hideshow 4 child comments
  • [–] 8 points 1 year ago (3 children)

    This reminded me of an anecdote from maybe 6 years ago. I was setting up and testing a small network and a couple devices to install for a customer, let's say the subnet was 192.168.2.0/24.

    Weird things were happening, I was being lazy and wasn't directly connected to the network, may have setup a VPN between devices somewhere; can't really remember. But pings would sometimes drop or blow out to 100's ms.

    I eventually ended up disconnecting that network entirely, then the pings continued and got more stable?? WTF! I need we didn't have that subnet in use, even checked before setting it up. In the time between checking and the issues happening, someone in Sydney somewhere had stuffed up on their router and exposed there LAN to the internet without any Firewalls, just available.

    Scanned and found all the IPs in use and in them found a printer. Connected to it and printed a page saying I'm from company XYZ and found all these devices available, and to either contact their IT and resolve it ASAP or my company to help. About an hour later it seemed to be resolved.

    It was an interesting day.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 1 year ago (1 child)

    Uh... you can't just "expose a LAN network to the Internet" in this manner. Local subnets aren't routable over the Internet, so you can't just enter 192.168.2.3 and end up on somebody else's private LAN.

    https://www.geeksforgeeks.org/computer-networks/non-routable-address-space/

    They would have needed to either have all their internal devices being assigned public IP's or had NAT+firewall rules explicitly routing ports from their outside address(es) to the inside ones. The former is unlikely as normally ISPs don't allocate that many to a given client, or at least not by DHCP. the latter would require a specific configuration mapping the outside addresses/ports to inside devices, likely on a per device+port basis.

    Either your story is missing key details or you've misunderstood/made-up something.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    I worked for a ISP. A cable company. We were getting our local offair channels from a site that was in easy reception of them. They had a large amount of bandwidth and did the same thing for dish and direct tv. The man who ran network side had a stroke and died. The hack that ran the broadcast side of their main business took over. Next thing I know I'm having all kinds of problems with our multicast tunnel. I port scanned the IP range and discover they have opened the whole thing up. We had a conference call where I detailed my concerns. Later that day the hack called my boss with his boss on the line and we had another meeting where I told them that they were exposed with default passwords and it could be a real problem.

    After I was given verbal permission to demonstrate my concerns with some limitations I took over all default password equipment and sent a large amount short stories to their printers. I ended it with the story superiority by Author C. Clark. Some back and forth a day later and they needed a new sysadmin.

  • source
  • parent
  • [–] 2 points 1 year ago

    The storage facility concept is kinda close, if you count it as "a storage facility beside a major intersection in a big facility, with the locker doors left open despite meant the warning at the front desk not to do so"

  • source
  • parent
  • [–] 43 points 1 year ago (4 children)

    This is why there should be a nationwide rule that PII data should be deleted after the users identity has been verified

  • source
  • hideshow 4 child comments
  • [–] 37 points 1 year ago (2 children)

    Never upload PII to social media

    Your privacy is not legally protected.

  • source
  • hideshow 2 child comments
  • [–] 32 points 1 year ago (1 child)

    What are the chances of this being the main reason for the app's existence?

  • source
  • hideshow 1 child comment
  • [–] 24 points 1 year ago

    Hungry data privacy lawyers when they learned about Tea this week:

  • source
  • [–] 210 points 1 year ago (28 children)

    This is what happens when you decide to vibecode a service with zero attention to safety or web development. This is why you don't immediately jump onto a new service without it being vetted properly. Now one of the worst communities on the Internet is in possession of over a hundred thousand women's driving licenses and faces. This is going to be an absolute disaster.

  • source
  • hideshow 28 child comments
  • [–] 156 points 1 year ago (4 children)

    This is ALSO why no service should ever require or get my driver's license information. Fuck that. Also, yet another Constance to those who can't afford a car or want to improve the environment by living car free.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 27 points 1 year ago (1 child)

    My only exception to that are uber drivers. But then again we live in an age where somehow better help has become popular, even though they sell your data.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 1 year ago

    I disagree on even that. It should be enough to have some trusted "notary" tick a box that they have verified your driver's license as valid. It should not be stored out sent anywhere at any time. Just showed to a human. Regularly, if needed.

  • source
  • parent
  • [–] 2 points 1 year ago

    The only site I ever felt comfortable scanning shit like that into was a site that sold things only to military/medics/fire fighters so I had to upload my medic license and my FF cert.

    Anything beyond that is a no go from me.

  • source
  • parent
  • [–] 26 points 1 year ago

    To be fair, I’m not sure why firebase even has a public access option. That’s a recipe for issues.

    Though if it’s anything like Google Cloud Store, they hopefully make it very clear that your bucket is public.

  • source
  • parent
  • [–] 64 points 1 year ago (3 children)

    Now now, I like to shit on vibecoders too but let’s not pretend this is some new problem.

    Idiots leave databases on cloud servers exposed all the time rather than deal with their companies often arcane rules for generating certificates

  • source
  • parent
  • hideshow 3 child comments
  • [–] 21 points 1 year ago (12 children)

    How is something "vetted properly" and how do I find out about that?

  • source
  • parent
  • hideshow 12 child comments
  • [–] 7 points 1 year ago (2 children)

    This is something I worry about all the time as well, especially since I've started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)

    As a user, there is no proper way I know of to verify an app's security. Most apps are closed source, but even if you could view the code, what would you look for?

    Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn't see this happening.

    There are academic researchers working on apps and privacy as well, but it's not like you can ask them for a report on an app you're thinking of installing.

    I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: https://www.privacyguides.org/articles/2025/06/24/queer-dating-apps-beware-who-you-trust/#reducing-the-risks-when-using-dating-apps

    It's a long read (haven't fully read it myself yet) and it paints a bleak picture, but that's the world we live in today.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    You can pay for a 3rd party to penetration test your app, it's good practice to do this before you launch an app, after any significant changes, and annually at a minimum.

    There are also a growing number of companies offering continuous penetration testing - basically, automated pen tests - but these are expensive and it's difficult to convince companies that the cost is worth it

  • source
  • parent
  • hideshow 1 child comment
  • [+] [S] -14 points 1 year ago* (8 children)

    I honestly don't understand what op is talking about.

    Leaks happen all the time, even in billion dollar companies.

    Their comment is the equivalent like, "This is why you should lock your doors!" Like uh okay.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 20 points 1 year ago (2 children)

    This situation would have been easily preventable with basic understanding of what they're doing is what OP is saying. This leak is not something highly complex, it is painfully stupid on the side of the developers.

    There's a difference between a hack, where data is exposed, compared to data exposure due to negligence or ignorance on the development side.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 1 year ago (1 child)

    Again, how should the end use know anything about what is going on at their end? How does anyone "vett" that? It is a nonsense "argument" to put blame on the users.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Where I'm from there's certificates a company can get, that confirm a certain level of process and IT security. Also a company existing for at least 5-10 years without incidents is a "vetted" company in my books. At least anything that managed to produce a working IT system before 2021 when AI came around.

    I believe there's a bit of bad wording going on with the original comment. Take it up with that guy, lol.

  • source
  • parent
  • [–] 11 points 1 year ago

    This was more like leaving all your valuables in a cardboard box on your front lawn. Anyone can just take it, if they care to look inside the complete unsecured box.

    Someone just drove up and tossed the box in their truck. No lock involved.

  • source
  • parent
  • [–] -3 points 1 year ago (3 children)

    I love how people just jump on whatever they like, instead of actually thinking about the stuff they read/comment on/upvote. Exactly like on Reddit, no difference.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    How strange that a site designed exactly like reddit behaves like reddit.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago

    Anybody oblivious enough to create something like this isn't someone you should trust your most private data with. This service had red flags from the concept phase, never mind the execution.

    This is not to say, of course, that the victims deserved it. It just really sucks that they had to learn this lesson this way.

  • source
  • parent
  • [+] -12 points 1 year ago (3 children)

    "Vibe coded" you just made that up didn't you, because you don't like llms. I don't see anything in the article about "Ai" and this service has been operating for 2 years.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 16 points 1 year ago

    Self proclaimed "5 star man" Dennis Reynolds is the top suspect

  • source
  • Not sure if this is ironic that the users are now less safe after using the safety app. But I still feel bad for the users. Dating is hard enough without the fear of being harmed.

  • source
  • [–] 25 points 1 year ago (6 children)

    I had been under the impression that 4chan had also basically died due to their own site getting hacked

  • source
  • hideshow 6 child comments
  • [–] 18 points 1 year ago (2 children)

    the site got hacked and most of the admins were revealed to have .gov emails but everyone pretty much already expected that so nobody actually cared and it's back to business as usual

  • source
  • parent
  • hideshow 2 child comments
  • [–] 81 points 1 year ago (6 children)

    Maybe I'm just getting old, but the idea of "verifying" my real identity to a faceless website or mobile app is abhorrent.

    I guess it doesn't help that governments in some countries (UK, Australia that I know of) are encouraging this bullshit with Trojan horse laws claiming to protect children from adult websites / social media.

    Can't help but think there is also an element of pot meet kettle here, when users of an app designed to dox and slander people without their knowledge are now the ones getting doxxed themselves.

  • source
  • hideshow 6 child comments
  • [+] -12 points 1 year ago (3 children)

    What if they take people's biometric aka fingerprint and to view nsfw stuff you goota use the biometric and I am not talking about passkey

  • source
  • parent
  • hideshow 3 child comments
  • [–] 14 points 1 year ago (1 child)

    How does having my fingerprint prove my age.

    The issue is, at some point, they have to connect your "digital you" to your self as a real person, after that they can track you, keep tabs on you. If that data was ever stolen, or a corrupt government rose to power, you're really screwed.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments
    view more: next ›
    8 comments in c/technology@beehaw.org view that post
    1 comment in c/technology@lemmy.zip view that post