2d ago

Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan

www.404media.co

Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.

Technology @lemmy.zip

misk @sopuli.xyz

2d ago

Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan

www.404media.co /women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/

Technology @beehaw.org

coyotino [he/him] @beehaw.org

2d ago

Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan | 404 Media

www.404media.co /women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/

Hacker News @lemmy.bestiver.se

RSS Bot @lemmy.bestiver.se

BOT

2d ago

Women dating safety app 'Tea' breached, users' IDs posted to 4chan

www.404media.co /women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/

You're viewing a single thread.

184 comments

This is what happens when you decide to vibecode a service with zero attention to safety or web development. This is why you don't immediately jump onto a new service without it being vetted properly. Now one of the worst communities on the Internet is in possession of over a hundred thousand women's driving licenses and faces. This is going to be an absolute disaster.
- This is ALSO why no service should ever require or get my driver's license information. Fuck that. Also, yet another Constance to those who can't afford a car or want to improve the environment by living car free.
  
  My only exception to that are uber drivers. But then again we live in an age where somehow better help has become popular, even though they sell your data.
  
  I disagree on even that. It should be enough to have some trusted "notary" tick a box that they have verified your driver's license as valid. It should not be stored out sent anywhere at any time. Just showed to a human. Regularly, if needed.
  
  Instead, just prove you have a credit card by submitting the details. Also totally safe. Be sure to include the CVV, please!
  
  The only site I ever felt comfortable scanning shit like that into was a site that sold things only to military/medics/fire fighters so I had to upload my medic license and my FF cert.
  Anything beyond that is a no go from me.
- Now now, I like to shit on vibecoders too but let’s not pretend this is some new problem.
  Idiots leave databases on cloud servers exposed all the time rather than deal with their companies often arcane rules for generating certificates
  
  Remember when the government published SSNs in HTML? https://www.zdnet.com/article/missouri-will-not-prosecute-hacker-reporter-for-daring-to-view-state-website-html/
  
  Where do you think the AI learned it?
  Like, I get that competent coders do it too, but now any skiddie with an idea can cosplay as a developer so this is going to be so much more prevelant
  
  That's not new, either.
- To be fair, I’m not sure why firebase even has a public access option. That’s a recipe for issues.
  Though if it’s anything like Google Cloud Store, they hopefully make it very clear that your bucket is public.
- How is something "vetted properly" and how do I find out about that?
  
  You wait a while until something like this happens.
  
  This is something I worry about all the time as well, especially since I've started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)
  As a user, there is no proper way I know of to verify an app's security. Most apps are closed source, but even if you could view the code, what would you look for?
  Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn't see this happening.
  There are academic researchers working on apps and privacy as well, but it's not like you can ask them for a report on an app you're thinking of installing.
  I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: https://www.privacyguides.org/articles/2025/06/24/queer-dating-apps-beware-who-you-trust/#reducing-the-risks-when-using-dating-apps
  It's a long read (haven't fully read it myself yet) and it paints a bleak picture, but that's the world we live in today.
  
  I honestly don't understand what op is talking about.
  Leaks happen all the time, even in billion dollar companies.
  Their comment is the equivalent like, "This is why you should lock your doors!" Like uh okay.
  
  This situation would have been easily preventable with basic understanding of what they're doing is what OP is saying. This leak is not something highly complex, it is painfully stupid on the side of the developers.
  There's a difference between a hack, where data is exposed, compared to data exposure due to negligence or ignorance on the development side.
  
  Again, how should the end use know anything about what is going on at their end? How does anyone "vett" that? It is a nonsense "argument" to put blame on the users.
  
  Where I'm from there's certificates a company can get, that confirm a certain level of process and IT security. Also a company existing for at least 5-10 years without incidents is a "vetted" company in my books. At least anything that managed to produce a working IT system before 2021 when AI came around.
  I also believe there's a bit of bad wording going on with the original comment. Take it up with that guy, lol.
  
  This was more like leaving all your valuables in a cardboard box on your front lawn. Anyone can just take it, if they care to look inside the complete unsecured box.
  Someone just drove up and tossed the box in their truck. No lock involved.
  
  https://de.wikipedia.org/wiki/Datenvermeidung_und_Datensparsamkeit
  
  I love how people just jump on whatever they like, instead of actually thinking about the stuff they read/comment on/upvote. Exactly like on Reddit, no difference.
  
  How strange that a site designed exactly like reddit behaves like reddit.
  
  The thing is that many here think they are better, they look down on Reddit. There is a certain shift in what demographic switched over but generally it is the same.
- Anybody oblivious enough to create something like this isn't someone you should trust your most private data with. This service had red flags from the concept phase, never mind the execution.
  This is not to say, of course, that the victims deserved it. It just really sucks that they had to learn this lesson this way.
- "Vibe coded" you just made that up didn't you, because you don't like llms. I don't see anything in the article about "Ai" and this service has been operating for 2 years.
  
  My thoughts as well. But hey, it's lemmy! Just accuse someone of doing something we hate, good to go!
  
  The og 4chan post brought up the vibe coding. Using it as an insult to quality is wider spread than just lemmy.
  
  Maybe I shouldn't have used the term vibe coded. I apologize.

184 comments