639
Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan (www.404media.co)
submitted 1 year ago by to c/technology@lemmy.world
255 comments fedilink hide all child comments
 

Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.

you are viewing a single comment's thread
view the rest of the comments
[–] 21 points 1 year ago (16 children)

How is something "vetted properly" and how do I find out about that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 7 points 1 year ago (2 children)

    This is something I worry about all the time as well, especially since I've started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)

    As a user, there is no proper way I know of to verify an app's security. Most apps are closed source, but even if you could view the code, what would you look for?

    Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn't see this happening.

    There are academic researchers working on apps and privacy as well, but it's not like you can ask them for a report on an app you're thinking of installing.

    I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: https://www.privacyguides.org/articles/2025/06/24/queer-dating-apps-beware-who-you-trust/#reducing-the-risks-when-using-dating-apps

    It's a long read (haven't fully read it myself yet) and it paints a bleak picture, but that's the world we live in today.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 year ago (1 child)

    You can pay for a 3rd party to penetration test your app, it's good practice to do this before you launch an app, after any significant changes, and annually at a minimum.

    There are also a growing number of companies offering continuous penetration testing - basically, automated pen tests - but these are expensive and it's difficult to convince companies that the cost is worth it

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [+] [S] -15 points 1 year ago* (11 children)

    I honestly don't understand what op is talking about.

    Leaks happen all the time, even in billion dollar companies.

    Their comment is the equivalent like, "This is why you should lock your doors!" Like uh okay.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 20 points 1 year ago (2 children)

    This situation would have been easily preventable with basic understanding of what they're doing is what OP is saying. This leak is not something highly complex, it is painfully stupid on the side of the developers.

    There's a difference between a hack, where data is exposed, compared to data exposure due to negligence or ignorance on the development side.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 1 year ago (1 child)

    Again, how should the end use know anything about what is going on at their end? How does anyone "vett" that? It is a nonsense "argument" to put blame on the users.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago*

    Where I'm from there's certificates a company can get, that confirm a certain level of process and IT security. Also a company existing for at least 5-10 years without incidents is a "vetted" company in my books. At least anything that managed to produce a working IT system before 2021 when AI came around.

    I believe there's a bit of bad wording going on with the original comment. Take it up with that guy, lol.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 1 year ago (3 children)

    This was more like leaving all your valuables in a cardboard box on your front lawn. Anyone can just take it, if they care to look inside the complete unsecured box.

    Someone just drove up and tossed the box in their truck. No lock involved.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] -2 points 1 year ago (2 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -3 points 1 year ago (3 children)

    I love how people just jump on whatever they like, instead of actually thinking about the stuff they read/comment on/upvote. Exactly like on Reddit, no difference.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago (2 children)

    How strange that a site designed exactly like reddit behaves like reddit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •