Conversation

Notices

1. Embed this notice
   Joseph Cox (josephcox@infosec.exchange)'s status on Saturday, 26-Jul-2025 01:24:14 JST Joseph Cox

   New from 404 Media: viral woman's dating safety app Tea breached. 4chan taking peoples' uploaded photos, used to verify its a woman-only app. App recently hit no. 1 in App Store. “DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!” https://www.404media.co/women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/

   • Rich Felker repeated this.
   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 26-Jul-2025 01:24:14 JST Rich Felker

     in reply to

     @josephcox Key takeaway here should be that "ID verification" and "gender verification" are fundamentally putting at risk the exact people the advocates for this shit claim to be protecting.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 26-Jul-2025 01:25:44 JST Rich Felker

     in reply to

     @josephcox Also: WHY THE FUCK has 4chan still not been shutdown, or at least subpoenaed and raided when they refuse to comply, to find as much identifying information as possible for the accounts that are *constantly* using the site to commit crimes like this???

   • Embed this notice
     Suriele (suriele@eldritch.cafe)'s status on Saturday, 26-Jul-2025 01:51:02 JST Suriele

     in reply to

     @josephcox Why the fuck are they storing them if its only to verify entry .......

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 26-Jul-2025 01:52:26 JST Rich Felker

     in reply to

     • Suriele

     @suriele @josephcox Either incompetence or VC-exit-brained malice masquerading as incompetence.

     (If they can keep all that data now pretending it was a mistake, and not get caught, later once they have a big enough legal budget they can pivot to including it in their valuation when they sell out.)

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 26-Jul-2025 01:54:50 JST Rich Felker

     in reply to

     @josephcox And I don't think my view here is incongruous with full disclosure of vulns. The post to 4chan was not framed as a vuln disclosure blaming the company for putting people in danger and warning victims. It was explicitly "GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN" - encouraging audience to participate in the crime.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 26-Jul-2025 02:18:30 JST Rich Felker

     in reply to

     • Suriele

     @suriele @josephcox Note that these are hard to distinguish nowadays because the "modern" web/app dev idiom is just to store and pass around all your data in AWS S3 buckets or whatever with no access control and with no coherent lifetime model (no way to tell when the last component that might need to look at the data is done with it).