Skip Navigation

Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan

www.404media.co

Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan

Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.

171 comments
  • I can't open the article, but I think I read that this was hosted on an unprotected bucket. Assuming that's correct I wouldn't say this was a breach. A better headline would be "Women dating safety app 'Tea' exposed women's PII".

    To be 100% clear, I'm not excusing the hackers. I don't believe it's morally correct to publicize something because it is exposed. For folks curious about that you can look into how to ethically disclose vulnerabilities. I still view this as doxxing. I still believe what the hackers did should be a criminal offense, it's just that I also believe the app holds a ton of the blame as well. How can you proclaim to be about keeping women safe while putting them at risk? That should be punished as well.

    Like if the storage facility you trusted to hold your stuff never had locks on the doors, shouldn't they take a lot of the blame as well as the thief who found out a door was unlocked?

  • Hungry data privacy lawyers when they learned about Tea this week:

  • I don't quite understand the outrage in the thread. I've been looking through the comments, trying to see if this ever went beyond gossip and I can't find anything.

    From my understanding the app was intended to be a safe space for women to discuss dating. Relaying information about dangerous individuals, or people who cheat. I can imagine that things might have gotten slightly out of hand in regards to anonymous gossip, but is that anything compared to being doxxed? Besides, women, and men have been gossiping behind each others backs for as long as humans have existed. An anonymous app makes it significantly worse certainly, but it is what it is. This behavior is always going to exist for better or for worse. For example, people already discuss this on sites like fetlife since the risk of ending up with someone who wants to batter you for the sake of battering you is somewhat high there.

    Surely we can have some sympathy for people who have had their identifications doxxed by 4chan who haven't done anything worse than a bit of toxic gossip at most?

    • you're right as far it's intentions go. I honestly couldn't give a rats ass about what it intended to do what I have a MASSIVE issue with is that it did the EXACT opposite of what it "intended to do."

      It didn't provide Women with a "safe space" because women's government issued IDs and their personal selfies were, quite literally, OUT IN THE OPEN. It opened Women who used the app to way more harm.

      Their database, and i'm being extremely generous when I call it that, wasn't even password protected. not even a simple plain text password like "password123" there was NO password. at all. period. All I would have had to do was simply see where the app sent the scanned ID's, open a terminal, SSH into it WITHOUT A PASSWORD OR KEY, and then I now have access to the IDs of over 13,000 Women. Hell I probably wouldn't have even had to SSH into it, probably could have opened the damn thing from a web browser.

      So when the media is saying 4chan "leaked" this stuff again they're being generous. It's like if you were walking down the street that Tea lived on and you noticed they left their door wide open so you decided to peak your head inside and while peaking your head in you noticed a box right by the door that had thousands of IDs in it so you picked up the box and walked out. Chances are other people got to this box before 4chan did, many people probably did, it's just that 4chan were the only ones to say "Hey I found this house with a wide open door and decided to pick up this box with all these IDs in it, neat huh?"

      • None of this is what I am discussing. I'm talking about the people in the thread who are saying that these people deserved this.

  • Stay classy, 4chan. /facepalm

    I can understand some people's skepticism on how quickly an app like this can turn into a gossip and defamation tool, especially when those who might be defamed can't access it... but god damn this isn't how to show people that aspect of it.

    Also, not to say I don't see the value in apps like these: I absolutely do, they are there for women to protect themselves. I would suspect the number of women misusing it is in the minority and the majority use it appropriately.

    Whereas a similar app for men? Those are almost instantly used for things like Revenge Porn. Men are not going to win this battle and prove they are better than women in this regard because the men who would misuse such an app are solidly in the majority. Basically the complete opposite. Events like this prove it.

    Anyway, fuck 4chan misogynist freaks.

    • Men are not going to win this battle and prove they are better than women in this regard because the men who would misuse such an app are solidly in the majority.

      I think there’s also a lot of confirmation bias, in the sense that you need to consider why people would seek out such an app. Why would women seek out a women-only app? And inversely, why would men seek out a men-only app? The answer to each will be fundamentally different, which means the user bases will be fundamentally different as well.

      Basically, what types of women would go out of their way to engage with a women-only app? Chances are good that the average woman has probably had the thought before, and is doing so to try and stay safe. The active engagement is seen as a positive thing, and she’s willing to jump through a few hoops (like uploading a photo ID) to get there.

      Now imagine the inverse. Most guys probably wouldn’t even think of using a men-only app for safety reasons. Like it’s not even on their radar, because safety while dating isn’t something they’re concerned with. Most men probably wouldn’t think of seeking out a men-only app at all. So the pool of men who would be willing to go out of their way to engage with a men-only app is going to look vastly different. The average user likely won’t reflect the average man, because the average man wouldn’t even think to seek out a men-only app. Or if he does, he doesn’t feel strongly enough about it to jump through any hoops to engage. It means the average user would most likely be one of the extremely toxic manosphere/men’s rights advocate/creep/etc stereotypes instead.

      To be clear, this isn’t a “not all men” post. Because the reality is that it’s certainly enough men to be concerning. My point is simply that the confirmation bias will be a large factor in whether or not the user base actually reflects the average person.

      It’s basically the same way the average Lemmy user doesn’t reflect the average person. If you looked at the average Lemmy user and tried to print that into society, you’d expect the average person to be a Linux-using communist programmer.

      • Disclaimer: Please consider this a sort of fork of your discussion so far, I only mean to say anything about the parts of your comment I actually reference.

        ...

        Why would women seek out a women-only app? And inversely, why would men seek out a men-only app? The answer to each will be fundamentally different, which means the user bases will be fundamentally different as well.

        To a significant degree, yes, but I think you are overstating that degree.

        Tea is imo more like a gossip app, ala Nextdoor, just specific to dating.

        Tea isn't a dating app, it is... I guess you could call it ... dating-app-meta-review app, from a technically minded standpoint?

        A supplement to a (or many) dating app(s).

        But it doesn't actually directly link to

        [(EDIT: whoops I accidentally a sentence there.)]

        It is named 'tea', as in gossiping, the deets, the low down, the real story, etc.

        Literally this is their own marketing:

        https://www.teaforwomen.com/about

        It is literally just a replacement for Facebook 'Are we dating the same guy' groups, but better, if you pay, because the Premium account allows you to run background / criminal / sex offender records.

        ...

        So, a rough equivalent for guys would probably be named something like MPH, officially Miles Per Hour, unofficially, Miles Per Hoe, I dunno, something edgy for the manosphere crowd, where guys would gossip about cheating girls/women, and also be able to run background checks on them for a premium.

        I can guarantee you that men would be broadly interested in such an app if it existed.

        ...

        Now imagine the inverse. Most guys probably wouldn’t even think of using a men-only app for safety reasons. Like it’s not even on their radar, because safety while dating isn’t something they’re concerned with.

        Maybe not as much in the safety sense of immediate physical danger, but absolutely in the sense of... is this person financially abusive, emotionally manipulative, do they have kids, or a massive amount of debt/bad spending habits, an STI, etc, that they don't mention untill they've been dating you for some time, do they have a history of acting like they're committed when they've in the past cheated whilst acting like they were monogamous?

        These kinds of things apply to both men and women, and are far more common to occur in a dating/relationship than physical abuse.

        Yes, women are more likely to be the victim of physical or sexual violence or stalking...

        But its not like this doesn't happen to men.

        I can personally tell you that I, a guy, have been so lucky as to have had all three of those happen to me, done by women.

        But lets not just use myself as an anecdote, here are the stats on that from the CDC, last updated before the Trump Admin got into power, doesn't look like they've fucked with this page.

        https://www.cdc.gov/intimate-partner-violence/about/index.html

        IPV is common. It affects millions of people in the United States each year. Data from CDC's National Intimate Partner and Sexual Violence Survey (NISVS) indicate:1

        About 41% of women and 26% of men experienced contact sexual violence, physical violence, or stalking by an intimate partner during their lifetime and reported a related impact.

        Over 61 million women and 53 million men have experienced psychological aggression by an intimate partner in their lifetime.

        We could quibble about the exact stats of what sex/gender the partner was, and they do cite some studies directly, but uh, oversimplifying to pretend only heterosexuality exists...

        About half as many men have been seriously, violently victimized or stalked as women, and I'd be willing to bet the psychological abuse numbers are at least a bit closer to equal if you account for men being unwilling to admit to being victimized in that way due to internalized machismo, 'shut up and deal with it', whatever you want to call it.

        ...

        Point of me saying all this is to throw numbers toward countering your claim here:

        Most men probably wouldn’t think of seeking out a men-only app at all. So the pool of men who would be willing to go out of their way to engage with a men-only app is going to look vastly different. The average user likely won’t reflect the average man, because the average man wouldn’t even think to seek out a men-only app.

        I agree that it wouldn't represent the average man, but we've got a potential user pool of 50+ million men in the US who've been through a bad relationship and would probably also not want to go through that again.

        Again, yes it is absolutely true that women more often experience a more severe form of relationship than men, no argument there.

        But I don't think you can just say that a man version of tea would only appeal to blackpilled manosphere men.

        Yes, that would likely be a large proportion of the user base, but there are tons of men who are not misogynists and also would like to avoid being played or abused.

        ...

        Also, uh:

        You say that,

        The active engagement is seen as a positive thing, and she’s willing to jump through a few hoops (like uploading a photo ID) to get there.

        But what I am seeing is:

        To access Tea, women have to verify their gender by submitting a selfie, which is then verified by the app’s team.

        https://www.fastcompany.com/91374409/everything-to-know-about-tea-the-viral-and-controversial-app-that-lets-women-mark-men-as-red-flags

        The rest of that quote is that the picture is 'verified by the Tea team', but I think we both know that almost certainly means they just use an AI face scanning tool.

        Anyway, point is: taking a selfie is a way, way lower bar to entry than taking a picture of your driver's liscense... basically every dating app already does the former, this is totally normal now, whereas the latter is... so uncommon I cannot think of an example.

        So....taking a selfie is not that much of a trifle, not a strong potential blocker, for a guy who's already used a dating app in the last 5 ish years.

        ...

        EDIT 2:

        Occured to me on reviewing this:

        ... Yeah, an AI face recognition to verify gender?

        How... does that work for trans folks, or even probably just non white women, and are women who are maybe bald or have more typically masculine coded shorter hair cuts, with less stereotypically/heuristically feminine facial features?

        AI has fucked up this kinda shit in the past quite badly.

      • Funnily enough there was a men-only equivalent of this. It got removed from the appstore because it became a revenge porn hub.

      • This is a valid take but also consider that the "average man" in the USA is more likely to be a Trump voter or non-voter than someone who would vote to protect women's rights. Over half of men voters vote for Republican Presidental candidates consistently. On the flip side men supporting Democrat Presidential candidates mostly clocks in at just above 40%. When you account for the size of the USA, those differences are pretty big and put arguably awful men in the clear majority.

    • Are you projecting or what is this?

    • I would suspect the number of women misusing it is in the minority and the majority use it appropriately.

      Well just look at Facebook groups that are dedicated to the same sort of thing and see how catty they get. You know the types that decide that just because a man they have never seen before is in the neighbourhood he's clearly up to no good when he's probably just delivering parcels.

      Anyway it doesn't matter if 90% were legitimate and 10% not. They are still defaming people, with no opportunity for those people to correct the record. Anyway I am a much more cynical person, mostly through experience of working in customer service, and I think it's probably more like 50/50.

171 comments