Women dating safety app 'Tea' breached, users' IDs posted to 4chan

https://www.404media.co/women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/

by gloxkiqcza • 12 months ago

567 634 12 months ago

Also: https://www.reddit.com/r/4chan/comments/1m8z2w4/4chan_the_ha...

https://www.cnet.com/tech/services-and-software/tea-app-brea...

duxup5• 12 months ago

A flash in the pan gossip app that when it functions normally is not worried about anyone's privacy / accuracy ... also doesn't care about good policies or their user's privacy.

That seems about right.

darth_avocado• 12 months ago

You could say that the *Tea has been spilt*

JohnMakin• 12 months ago

Painting this as a "gossip" app seems extraordinarily reductive. Women have a good incentive to share info about and to one another for safety beyond "gossip."

duxup5• 12 months ago

Go checkout the website, the first image is just two people gossiping.

This app operates just like an app some creep online would use, people post pictures (permission or not) and gossip about them.

jahewson2• 12 months ago

There’s also a ton of bad incentives for those women who lie, manipulate and abuse beyond “gossip”.

darkwizard42• 12 months ago

Is it reductive? It also has good incentive for someone jilted or misinterpreting something to suddenly tarnish someone's reputation with little recourse for the other party. It is a one-sided review app for people in a way that people affected may never even know!

BizarroLand3• 12 months ago

If guys had an app that women couldn't access where we shit talked all of our exes with photo evidence women would riot at the company HQ.

But then again, can't convince people as a whole that men are, on average, good and decent people with normal flaws just like women, and therefore deserve to be protected, loved, and appreciated equally.

nis0s• 12 months ago

How is this user data even reliable or useful when someone can make fake personas and populate their activity with LLMs?

Drivers licenses can be faked. Moreover, someone can just pretend to be someone else on this app with real drivers licenses.

The whole premise, implementation and process of Tea as a social media app is flawed, and a legal liability for the devs.

tamimio• 12 months ago

I hope it served as a good lesson to the average person to be more cautious while submitting sensitive information like a government ID. Just because it's an app with a nice UI doesn't mean it's secure, let alone trustworthy regarding who owns it. Last week I was contacting a government agency here in Canada and the support team requested a government ID to be shared over email, which is anything but a secure communication. I tried to share it as a link to my vault, but they refused, so now either I will have to go in person or they will find another way in the meantime.

The internet went from 'YouTube asking users to never use your real name' to 'you have to submit your ID to some random app' in 10 years. Crazy!

ethagnawl2• 12 months ago

I hope it served as a good lesson to the average person to be more cautious while submitting sensitive information like a government ID.

This absolutely should not be normalized. If I'm ever prompted to submit photos of a government ID to some service, I'm turning heel. I'll try to use their phone service (which I just did successfully this week), correspond via mail or maybe, as you've said, handle it in person but I'm probably content to go without.

koakuma-chan2• 12 months ago

You can send it as an encrypted PDF, fwiw

chatmasta2• 12 months ago

On the rare occasion when I have to do this, I blur the maximum amount of the image and watermark it with hundreds of lines of small red font saying “FOR EMPLOYMENT VERIFICATION BY $X_ENTITY.”

If they have a problem with it then I will gradually remove pieces until they’re okay. But I haven’t had to do this the few times I’ve used this tactic – it causes issues with automated scans but eventually some human manually reviews it and says it’s okay.

What I don’t like is the “live verification” apps that leave me no choice but to take a photo of it.

dabockster12• 12 months ago

The internet went from 'YouTube asking users to never use your real name' to 'you have to submit your ID to some random app' in 10 years. Crazy!

Because we couldn't get anyone to take the internet seriously if it was just a bunch of anonymous pseudonyms trolling each other. And maybe that was a mistake.

xtracto• 12 months ago

CEOs and board members should be personally criminally liable for shared personal information coming out of their platforms.

It's the only way they will push companies to STOP storing them long term.

I've been in several companies (mostly FinTech) that store personal sensitive documents "just in case". They should be used for whatever is needed and deleted. But lazy compliance and operations VPs would push to keep them... or worse, the marketing people

add-sub-mul-div• 12 months ago

If my license gets leaked and then a stalker shows up at my house, I will simply turn them away on the grounds that it was illogical to assume the license wasnt faked.

carabiner4• 12 months ago

Drivers licenses can be faked. Moreover, someone can just pretend to be someone else on this app with real drivers licenses.

These are actually still very hard to do. I don't know anyone who would let me use their license for this purpose.

bobsmooth2• 12 months ago

With all this talk about age verification, I have to wonder if the complete lack of security was intentional.

pavel_lishin5• 12 months ago

How do you mean?

bobsmooth2• 12 months ago

The UK and some US states are instituting age verification for adult content. Doxxing thousands of women is a great way to get people talking about privacy and security.

bravetraveler2• 12 months ago

http://archive.today/U5Tah

Freewalled

more_corn3• 12 months ago

Freewalled I like that

neonate• 12 months ago

Is that site down? I'm just getting the default nginx page.

pavel_lishin5• 12 months ago

Good lord, why would they store those drivers' license images for an instant longer than it took to verify their users?

duxup5• 12 months ago

They shouldn't, but it appears to be a gossip app where by design they're also storing photos taken of other people (permission or not) and gossip about them...

They don't seem to value privacy.

Mountain_Skies• 12 months ago

According to another media report, the approval queue for new account verification was seventeen hours long. It's possible what the 4channers got was that approval queue.

IlikeKitties2• 12 months ago

No they got more, 23gb of files.

jsrozner• 12 months ago

This. Appropriate regulation should make this an offense punishable by a large fine. There is almost no consequence to companies for bad practices.

Ideally you'd see fines in the 10%s of revenue. In egregious cases (gross negligence) like this, you should be able to go outside the LLC and recoup from equity holders' personal assets.

Alas, if only we had consumer protections.

dabockster12• 12 months ago

Appropriate regulation should make this an offense punishable by a large fine.

And some kind of legal penalty for the engineers as well. Just fining the company does nothing to change the behavior of the people who built it in the first place.

dannyphantom• 12 months ago

Absent broader regulation, we all know that apps like Tea depend HEAVILY on user trust. However, I am a bit concerned users either won't fully grasp the severity of this breach or won't care enough and end up sticking with the app regardless.

A somewhat embarrassing but relevant example: my friends and I used Grindr for years (many still do), and we remained loyal despite the company's terrible track record with user data, privacy, and security as there simply wasn't (and still isn't) a viable alternative offering the same service at the expected level.

It appears Tea saw a pretty large pop in discussion across social channels over the last few days so I'm pretty hopeful this will lend itself to widespread discussion where the users can understand just how poorly this reflects on the company and determine if they want to stick around or jump ship.

hdgvhicv4• 12 months ago

Companies, especially American ones, see data as an asset, rather than a liability.

The GDPR in Europe attempts to reset this but it’s still an uphill battle

ytpete3• 12 months ago

Or maybe require them to prominently disclose the breech to all current and future users on the app main screen for some period of time afterward (a year or two?). Sort of like the health-code inspection ratings posted in restaurant windows.

That cuts to the issue some other comments have pointed out, that user trust is really their most important capital – and with short attention spans and short news cycles, it may rebound surprisingly fast.

hbn• 12 months ago

This is what vibe coding gets us!

GoatInGrey6• 12 months ago

The cynical part of me feels like certain employees had uncontrolled access to the user data.

There would be a morbid irony in the idea of a tool marketed as increasing safety for women actually being a honeypot operation to accumulate very sensitive personal information on those very women.

ytpete3• 12 months ago

Not a fan of the "vibe coding" hype, but is there any evidence that this app was built that way?

Proofread0592• 12 months ago

I am just making a wild guess with no evidence to back it up, but I have a question and a potential answer:

How was this app going to monetize?

I'm guessing by selling user data, namely drivers license info to phone number.

DanHulton• 12 months ago

We really need to get used to treating PII as poison, storing as little of it as possible, and getting rid of it as soon as we're done with it.

sigwinch2• 12 months ago

I think we can treat it as currency. All nine letters of my SSN, for example, I’ll allow you to store those if in return I get to store the name of the CEO’s boat.

lm28469• 12 months ago

People keep bitching about EU's GDPR but most of it is about sensible things like not storing sensitive data forever just because you can.

Nothing happens to these companies if there are no laws to keep them accountable, most companies I've worked with store everything forever because it's cheap and you never know what might become useful or what you might be able to sell to third parties later

Ancapistani2• 12 months ago

I thought 4chan died a year or so ago?

Ugh. I’m clearly getting old. I don’t even remember the last time I went to 4chan.

tokai• 12 months ago

It was knocked offline and a lot of journalists and bloggers spun a history about it not coming back. But it did.

morkalork• 12 months ago

All the mods were doxxed too, but life uh finds a way?

Ancapistani2• 12 months ago

Thanks - this is context I was missing :)

linkage• 12 months ago

It's unironically a stronger case for network effects than Facebook

jabroni_salad• 12 months ago

that thing is a cockroach. It will survive every tech company you can care to name.

raverbashing3• 12 months ago

"Security breach" more likely a vibe coded slop app

But yeah please tell me how "we care about your privacy"

pavel_lishin5• 12 months ago

more likely a vibe coded slop app

I mean, it's fun to throw baseless accusations around, but do you have any actual reason to suspect this?

raverbashing3• 12 months ago

Do you think if that was disproved that would be better somehow?

therein• 12 months ago

If you look at the API, it is a slop app. The IDs were being uploaded to a public Firebase bucket. Chats are also public now. The full API keys are leaked because they were in the shipped app.

jasonvorhe2• 12 months ago

Unlikely considering it allegedly launched 2 years ago: https://www.distractify.com/p/what-is-the-tea-dating-app

raverbashing3• 12 months ago

I believe this argument, still not clear why it became viral recently

aaron695• 12 months ago

4chan thread with details of the hack - https://boards.4chan.org/pol/thread/511317913

They have geo-mapped all the users - https://imgur.com/bRAJ2nU

Some of the users photo's are AI, which is interesting.

They got all the chat logs - https://x.com/NEElimit/status/1948766332503130562

60 Gig torrent said to be out with all the data - https://x.com/cremieuxrecueil/status/1948787086493901097 data structure - https://files.catbox.moe/c6ej81.json

For those who wish for the old days - "Vibe Coding" - shonky websites with shonky security, doxxing on all sides, 4chan pops back into relevance. You get your early internet redo.

HN 'Tea' thread discussing the ethics of the doxxing app - https://news.ycombinator.com/item?id=44682914

ridiculous_leke• 12 months ago

You can get Apple Legal involved if your face is on the app and they should get the related posts removed.

cherryteastain• 12 months ago

It's on a torrent. Good luck getting that removed.

schroeding• 12 months ago

I think they mean the actual posts on tea itself, not the leaked ID photos.

smnthermes• 12 months ago

You can report it to Google Play. The category is Restricted Content -> User Generated Content, and the app ID is "com.tea.tea". https://support.google.com/googleplay/android-developer/cont...

gruez5• 12 months ago

What's the actual violation though? If you click through the "User Generated Content" link, it shows that it's allowed, just that they have to moderate it.

https://support.google.com/googleplay/android-developer/answ...

ronsor5• 12 months ago

The actual violation would be a privacy violation

EcommerceFlow• 12 months ago

How is an app that allows users to post unverified and doxxing information about random men allowed on the IOS app store?

Apple had no issue mass censoring Parlor and others, how is an app like this able to reach #1 under all?

StanislavPetrov• 12 months ago

If big tech didn't have double standards they'd have no standards at all.

bitpush2• 12 months ago

There's only one guiding principle for Apple - and that's money. Dont let their privacy marketing ("Privacy is a human right") fool you otherwise.

cmxch2• 12 months ago

Safety for favored people, doxxing for the disfavored.

Truth.

koakuma-chan2• 12 months ago

Firebase again lol

progbits• 12 months ago

Letting frontend bootcamp devs think they can do backend was a mistake .

throwacct2• 12 months ago

Hahaha. Bet money they left everything accessible just by signing in into the app.

rozap• 12 months ago

it's always firebase. always.

batmaniam• 12 months ago

Isn't this basically Peeple except gender locked to women? Peeple failed because they couldn't eliminate bias and gossip against anyone. If someone was jealous of another, for example, that person could just write false slander and claim it was real with no evidence. That would have affected the victim for jobs, dates, etc. So it was laughed at by VCs and everyone online and it shut down.

How is Tea even legal? Isn't this just a legal libel timebomb waiting to happen?

webstrand2• 12 months ago

Not only that, I think they're forfeit their Section 230 protections since they're exercising editorial control by excluding males from the platform. So they'd be directly liable for any defamation they publish on their platform.

mikeyouse• 12 months ago

That's not how 230 works - why do people keep parroting this misinformation?

https://www.techdirt.com/2020/06/23/hello-youve-been-referre...

pridzone• 12 months ago

It would be in Apple and Google’s best interest to pull these apps immediately. Multiple Supreme Court justices have indicated an interest in narrowing the breadth of section 230 immunity. This app, structured entirely around effecting the reputation of private individuals, provides a relatively clean case to do so. It’s not a stretch that the app could be considered a ‘developer in part’ of the content it hosts, and thus lose section 230 protection.

A narrowing of section 230 would not be good for Apple or Google, though they wouldn’t face any liability for the Tea apps conduct.

carabiner4• 12 months ago

It's exactly like Lulu which shutdown due to privacy issues.

https://en.wikipedia.org/wiki/Lulu_(app)

prisenco4• 12 months ago

Every couple years someone tries this and it immediately turns into a cesspool because no matter the good intentions of the makers, it attracts the worst kind of person as active users.

It gets shut down, everyone forgets, then someone eventually has a brilliant idea...

It come from a place of sincerity but defenders imagine everyone would use it for the same reasons they would: Warning people of genuine threats in the dating world. They would never use it for gossip, or revenge, or creative writing, etc. so they don't imagine others would.

But at scale, if generously only 0.1% of women in America are bad actors that would weaponize this app, that's over 150k people (not to mention men slipping past security). And the thing about bad actors is that one bad actor can have an outsized effect.

duxup5• 12 months ago

This also seems like an app ripe for actual creep / abusers to follow / manipulate.

The claim that it provides safety really is just that, an empty claim.

dabockster12• 12 months ago

The fact that it verifies by ID scan is also not safe at all for a million different reasons.

A better way would have been to charge a small subscription fee - like $2/month or something. The fee filters out 99% of the trolls out there (who wants to pay to troll) and also gives the app/website admins access to billing info - name, mailing address, phone number, etc - without the need for a full ID scan. So the tiny amount of trolls that do pay to troll would have to enter accurate deanonymizing payment information to even get on the system in the first place.

And it can be made so only admins know peoples' true identities. For the user facing parts, pseudonyms and usernames are still very possible - again so long as everyone understands up front that such a platform would ultimately not be anonymous on the back end.

But oh no, that won't hypergrow the company and dominate the internet! Think of all the people in India and China you're missing out on! /sarcasm

PaulHoule2• 12 months ago

Many people will do anything they can to hurt their ex after a breakup.

djohnston• 12 months ago

Hey now! They use ID verification bub - how are you gonna fake that? It’s not like there are just public buckets of legitimate ID photos taken by real women for you to hoover up. Check mate.

danesparza2• 12 months ago

> How is Tea even legal? Isn't this just a legal libel timebomb waiting to happen?

By this logic: I suppose glassdoor, yelp, or Google reviews aren't legal either?

What about identity verification as part of any employment offer?

AndroTux• 12 months ago

The difference is, on these platforms you're rating legal entities. On Tea, you're rating, or rather sharing personal information about, an individual. Where I come from, sharing personal data of someone without their consent is not allowed.

fkyoureadthedoc• 12 months ago

By this logic: I suppose glassdoor, yelp, or Google reviews aren't legal either?

Imagining a future where I have to pay Tea to promote and astroturf my profile or they lower my rating, and pay bot farms to post glowing reviews

Beijinger4• 12 months ago

I have not used the app nor read much about it but this guys talk about it: https://youtu.be/WjfpryoQ0Mk

Yes, as far as I understand, you upload pictures of men, either taken in the wild or from dating sites (Tinder) against their will. I am pretty sure that this would be illegal in some jurisdictions. Especially EU.

ajuc• 12 months ago

Companies aren't people (despite lots of people pretending they are).

arrowsmith6• 12 months ago

Peeple failed because they couldn't eliminate bias and gossip against anyone

Without bias and gossip, who would even want to use the app?

dyauspitr4• 12 months ago

Almost everyone? And not in a cheap throwaway comment way, I mean genuinely. The value is that it’s informative not a gossip rag.

exiguus11• 12 months ago

A gray area in my eyes. As a father, I think it's good that my daughter uses the app. You only need to look at the statistics to see how many women are killed by their male partners every year.

thefourthchime• 12 months ago

It's harmful to spread this kind of fear. Statistically it's less than 0.05% of women die because they are killed by their partner. This puts a stigma on men in general as some sort of dangerous savages.

jabjq• 12 months ago

I wonder how well-received this comment would be if it mentioned crime statistics regarding something else than gender.

saparaloot• 12 months ago

You still think so?

jameslk2• 12 months ago

I keep seeing the defense for Tea as an app for women’s safety, which is of course a valid concern. Wouldn’t it make more sense for a service to exist, like some kind of enforcement service provided by the government, where others can report safety concerns and that service goes and does something about it legally?

If such a service exists and isn’t being too effective, shouldn’t that be worked on?

My guess is that there’s more to the reasons for why Tea is popular but the safety argument is largely being used to defend it

blks5• 12 months ago

Online men-dominated forums often dislike and feel personally attacked by people talking about sexual abuse/harassment done by other men. I guess they immediately imagine themselves being falsely accused of such acts, rather than being a woman that is attacked.

storus• 12 months ago

You are probably unaware of unintended consequences enabled by this app - many women use it to find bad boys they feel attracted to due to some brokenness in female psyche. So you'll get public outrage on one hand and private DMs on the other from them, based on how bad you are described/vetted by other women on the app.

laughing_man8• 12 months ago

If you had a son, would you think it's good spiteful women from his past were labeling him some kind of abuser on TEA when he has no way to know these allegations even exist?

xhkkffbf2• 12 months ago

I believe that at least one person has gotten a posting removed about himself by complaining directly to Apple. He presumed that Tea wouldn't care.

https://x.com/JacobJohnson494/status/1948222924235624870

kingkawn• 12 months ago

[flagged]

singleshot_• 12 months ago

“False slander” is not a thing.

The answer to your last two questions is found within section 230 of the Communications Decency Act.

pdabbadabba• 12 months ago

“False slander” is not a thing.

It's only not a thing because, in the U.S., it's redundant. In other jurisdictions, it might be a thing, because there are places where a claim can be both defamatory and true.

givemeethekeys• 12 months ago

There are large Facebook groups dedicated to "Are we dating the same guy?" / "Are we dating the same woman?" that predate this app.

Fogest3• 12 months ago

A lot of these groups have also had people get successfully sued for defamation.

tptacek3• 12 months ago

Defamation (libel and slander) consists of false statements (or direct implications) of fact. Actionable defamation consists either of those false claims that cause quantifiable damages, or that claim things that are per se considered damaging --- a specific and limited list.

"This guy is a creeper and treats romantic partners terribly" is pure opinion, and cannot be defamatory. The (rare) kinds of opinion statements that can be defamatory generally take the form of "I believe (subjective thing) about this person because I observed (objective thing)", where "(objective thing)" is itself false. "The vibe I get about this person is that they hunt humans for sport" does not take that form and is almost certainly not defamatory.

Under US law, providers are generally not liable for defamatory content generated by users unless you can show they materially encouraged that content in its specifics, which is a high bar app providers are unlikely to clear.

akerl_2• 12 months ago

A general plug that if you read this comment and thought “damn, 1st amendment law sounds complex and interesting”, you may want to check out https://www.serioustrouble.show/ , a podcast about legal news with a recurring focus on 1st amendment law and cases

dyauspitr4• 12 months ago

But you can ruin a person’s life on a whim. That cannot be allowed.

krisoft• 12 months ago

"This guy is a creeper and treats romantic partners terribly" is pure opinion, and cannot be defamatory.

That is true. But i think untrained and emotionaly involved individuals will have trouble navigating the boundaries of defamation. Instead of writing opinions like “treats romantic partners terribly” they will write statements purporting facts like “this creep lured me to his house, raped me, and gave me the clap”. This is not an opinion but three individually provable statements of facts. Plus the third would be considered “defamation per se” in most jurisdictions if it were false. (The false allegation that someone has an STD is considered so loathsome that in most places the person wouldn’t need to prove damages.)

Unles specifically coached people would write this second way. Both because it is rethoricaly more powerfull, but also because they would report on their own personal experience. To be able to say “treats romantic partners terribly” they would need to canvas multiple former partners and then put their emotionaly charged stories into calm terms. That requires a lot of work. While the kind of message i’m suggesting only requires the commenter to report things they personaly know about. And in an emotionaly charged situation, like a breakup, people would be more likely to exagarate in their descriptions, making defamatory claims more likely.

Under US law, providers are generally not liable for defamatory content generated by users…

This is true, and i believe this is the real key. Even if the commenters would be liable, the site themselves would be unlikely to become liable with them.

gizmo686• 12 months ago

or that claim things that are per se considered damaging --- a specific and limited list

Standard disclaimer that law varies by jurisdiction. However, that limited list typically includes claims that the person committed a crime. Many juristictions also include accusing someone of having a contagious disease, engaging in sexual misconduct, or engaging is misconduct that is inconsistent with proper conduct in their profession.

In other words, the types of things I would expect people to be talking about on tea overlap heavily with defamation per-se.

If the users were careful to make all of their statements opinions, that defense would work. However, I doubt that is the case. Instead, I expect many users to include example of what their ex did that led to their opinion; which gets directly into the realm of factual statements.

The provider protections are real, and likely protect the app from direct lawsuits (or, at least from losing them), but do not protect the app's users. A few news stories about an abusive ex going after their former partner based on what they posted in the app could be enough to scare users away. You don't even need to win the lawsuit if your goal is to harass the other person.

swat5352• 12 months ago

I wonder if you would make the same comment if the genders were reversed.

"Cofee App" for males only, that allows them to post pictures of woman they have dated, rate them and include green/red flags.

"She is not good enough in bed", "She is too fat", "She has a high body count",..

Arguing over the legal definition of the word "Defamation" is missing the forest for the trees.

ssalka• 12 months ago

I would imagine Tea enjoys protections from Section 230, same as all other social media sites.

listless• 12 months ago

This looks like a slam book. Or that’s what girls called it when I was in high school. Basically just a place where you write mean things about people you don’t like. And those people don’t get to see it.

boppo1• 12 months ago

Yes but if you brand it differently it's about safety!

dmatech• 12 months ago

Providing a platform for defamation and other tortious speech is generally legally protected under §230. They still have to respond to court orders and DMCA requests, though. This is how sites like Kiwi Farms remain online. That said, commercial apps can sometimes be sued under defective product laws.

jjangkke3• 12 months ago

Some observations:

- The fact that this app exists solidifies the data that a small group of men/women do most of the dating on tinder etc while the vast majority land dates far less if none at all.

- This creates distorted market supply and demand where those small group of men/women become sought after and its only human nature in that they value their supply less than the rest.

- Toxic behavior is expected from that small group of highly attractive people that do all the dating.

- It was only a matter of time before such app would run into legal issues or attract angry individuals. Now the damage to the leaked identities will be prolonged. With the AI tech today, the extent to which a damage can be doned with the information from the leaks is unknown.

- As for the company behind Tea, they are done. They face a monumental class action lawsuit as well as ongoing individual civil/criminal cases that will arise from the leaked identities, in particular the photo of driver licenses as well as selfies, usernames, emails drastically increase the surface area for damages.

- The users of this site and those that have directly posted images, details have opened themselves up to significant liability from not only the men they have targeted but from law enforcement.

- We'll see some new laws being formed from this case. Once again, we see the hidden dangers of blindly trusting large popular platforms with sensitive data but the twist with Tea here is the defamation activity that opens up its users to both civil and criminal liability.

pavel_lishin5• 12 months ago

The fact that this app exists solidifies that a small group of men/women do most of the dating on the quick fleeting connections on tinder etc while the vast majority on a few if not none at all.

I don't follow.

This creates distorted market supply and demand where those small group of men/women become sought after

Isn't that true in the real world as well? I'm not exactly a hunk; people weren't tripping over themselves to ask me out, whereas some of my friends and acquaintances did have to figuratively beat people off with a stick.

arrowsmith6• 12 months ago

It’s true in the real world, but dating apps make it much more exaggerated.

firefax3• 12 months ago

Isn't that true in the real world as well?

I suspect the folks complaining about "markets" in online dating are not the kind of people who can connect offline.

To be fair, I think online dating has gotten worse -- sites like OkCupid used to match you based on shared affinity... the issue there is you could be a very high match on shared values but not someone's "type" visually -- imagine being shown the girl of your dreams only to find out the feeling is not mutual :-)

Conversely, I feel like people sometimes forget that they opted into these interactions, it's not like someone strolled up in a bar and began talking at them.

Anyways... if you're frustrated with apps, I'd suggest doing just that. Talk to people.

I met my last girlfriend at a bus stop. Before that, on a porch -- I was walking by and struck up a convo.

If you can't connect with people organically, no amount of tech can save you.

msgodel2• 12 months ago

I think making prostitution illegal was probably a mistake. This used to be confined to brothels and everyone shamed it.

throw838384• 12 months ago

Is there a way, to verify if potential partner uses this app? Or if they are in "are we dating the same guy" type of group?

I take doxing, stalking, revenge porn and cyber bullying very seriously! And I would pay good money for a background check, to stay away from such people.

more_corn3• 12 months ago

Easy post negative information about yourself on there.

jeroenhd2• 12 months ago

You need to verify you're a woman with some form of ID before you can get into the app. Faking an ID and a picture can't be that difficult in the age of AI (especially not when the company that's supposed to verify you is this callous with their users' PII), but it's not as quick and easy as you suggest.

generalizations• 12 months ago

There is now.

codedokode5• 12 months ago

Ask her?

goku127• 12 months ago

Do you expect abusive people to answer honestly? The perceived anonymity on the app is a double edged sword.

SalmoShalazar• 12 months ago

Would you want your own app usage available to other people? I’m going to guess not. This is a gross request, not surprised you’re using a throwaway account, as you seem to know this is a shameful thing to ask for.

goku127• 12 months ago

And whatever happens on that app is not gross? If a revenge porn or csam site is busted, won't people want to know who were on it so that they can stay away from the potential predators? Isn't that why sex offenders' lists exist? Honestly, this app should be treated no less. The fact that they were able to remain on App and Play stores in the name of 'women's safety' demonstrate how grossly sexist, populist and vindictive the corporate structure in Apple, Google and the others have become. Binding one side to strict dogma and unwavering standards, while allowing the other side to anonymously wreak havoc on reputations is precisely the type of moral bankruptcy that's being challenged and assailed here.

jjangkke3• 12 months ago

- The fact that this app exists solidifies the data that a small group of men/women do most of the dating on tinder etc while the vast majority land dates far less if none at all.

- This creates distorted market supply and demand where those small group of men/women become sought after and its only human nature in that they value their supply less than the rest.

- Toxic behavior is expected from that small group of highly attractive people that do all the dating.

- Tea user's driver licenses as well as selfies, usernames, emails, posts about their dates will drastically increase the surface area for lawsuits, fraud and exploitation by malicious agents.

- The users of this site and those that have directly posted images, details have opened themselves up to significant legal and criminal liability. Given these apps were probably popular in large city centers like California, NY have heavy punishment for digital harassment and privacy violations on top of the damages that can be claimed against them by the men who's information and details were posted.

- Tea is largely insulated from what the users post which means that their biggest exposure might be just neglect and failure to secure data which comes with a slap on the wrist. Which will make it harder for Tea's userbase to claim large damages against it.

I read more details about this case and its beyond egregious. Unencrypted firebase and full public buckets. There is no hacking involved, the tokens were being used to pull data from roughly all 30,000 users of Tea and were only blocked short while ago.

Allegedly, 60GB of photos, user personal information, driver license, gps data being shared on torrent. A map of all 30,000 users tied to GPS data is being posted as well.

Given the extreme neglect to secure their data, I now believe Tea will be open to even bigger legal liability possibly criminal even.

wosined2• 12 months ago

Let's be real you wrote men/women only to be PC. You really meant small group of men.

packetlost2• 12 months ago

No, it really does apply to both. Women who are not dating or are in a stable relationship won't use that app.

phkahler• 12 months ago

> Let's be real you wrote men/women only to be PC. You really meant small group of men.

Let me share a message I got from a woman I met a couple years ago on a dating site: "Just a side note about the dating thing on here. I get very annoyed with how horribly men take care of themselves or even try to communicate. Most men today on these sites are repulsive. It was refreshing to see you smile, and look nice. Thank you for that."

So it's not a bunch of red-pill alpha guys. I'm an average guy with basic manners and a lack of creepiness. Heck I was near my all time high weight at the time. Every single woman on those things has at least one story about a guy she met that will make you cringe from his behavior. My fav was the guy who sent a woman flowers before even meeting her - at her workplace! Dude the cyberstalking you need to do to pull that off is CREEPY AF - not romantic.

If you want to be in that top 10 percent of men the bar is incredibly low.

IlikeKitties2• 12 months ago

Allegedly, 60GB of photos, user personal information, driver license, gps data being shared on torrent. A map of all 30,000 users tied to GPS data is being posted as well.

Yeah, I wouldn't worry about the allegedly part, 4chan is dissecting that torrent as we speak, it's quite the party.

cmxch2• 12 months ago

A case for ironclad data privacy laws that allow people to pierce the veil and request deletion.

8f2ab37a-ed6c4• 12 months ago

Sad that a common response to "we might not want this app to exist" is "well, if you weren't cheating, you wouldn't have a problem with it".

Why do people want to live in a panopticon of their own creation, with random anonymous strangers morally policing, judging each other with zero consequence to them?

Don't think we'll ever learn our lesson when it comes to privacy, it will be Eternal September forever.

duxup5• 12 months ago

I think for many people see <cause> and any criticism of something that claims to be relate to that cause is seen as criticism of the cause and that's a full stop when it comes to thinking much further.

The irony in this case being that this app operates like a lot of creep subreddits and forums out there with people posting photos of other people without their permission and gossiping / telling stories about them...

8f2ab37a-ed6c4• 12 months ago

I agree that you could make a Tea app for every faction's favorite cause, and use "safety" as the justification: report your local communist, report your local infidel, report your local secret white supremacist, report your local secret Western imperialism agent, report your local suspected jihadi, report a homosexual, report a suspected illegal immigrant, report a local adulterer, report an apostate, report a kulak.. etc. chefkiss

Witch Hunt as a Service, with a delightful UX, a little gamification, and soon integration with your favorite apps. Coming to an App Store near you.

cjs_ac• 12 months ago

I think this is also called 'politician's logic': https://www.youtube.com/watch?v=vidzkYnaf6Y

scarmig• 12 months ago

It's a useful app, as it helps men avoid the type of women who'd use such an app.

BizarroLand3• 12 months ago

How would you even identify who is on the app?

throwawayq342310• 12 months ago

Blaming women for wanting to seek out safety in this way is strange.

However there is something to be said about the crowd you find yourself with. If you assume this app to be necessary, I would assume your social standards are not high enough.

05• 12 months ago

The type not into nonconsensual sex?

bawolff11• 12 months ago

Because our entire civilization is built on recipricoal alturism, which requires reputation so that in the event someone defects it carries negative consequences to discourage defection.

8f2ab37a-ed6c4• 12 months ago

We're in agreement. Is an anonymous takedown app the solution for reputation management that enables civilization? If someone is trying to destroy your reputation, on which your entire livelihood depends, should you at least know who the accuser is, how reputable they are, what evidence they have? Do you want to give the Internet a magical button to destroy you on a whim?

grokgrok• 12 months ago

And these apps represent an attempt to privatize the state

standardUser8• 12 months ago

I mostly agree, but it's different for women due to how frequently they are subject to violence and how comparatively defenseless they are compared to the average man. Many women (and men) would gladly give up some privacy in exchange for (perceived) safety. And any man who doesn't understand that is either lying or has never known a woman.

8f2ab37a-ed6c4• 12 months ago

It's fair that men and women have different challenges here. But humans are squishy and chaotic and self-interested, they're not angels of pure wisdom, fairness and justice. Giving someone a repercussion-free button to destroy someone else the instant they feel slighted, vindictive, threatened, jealous, disrespected, is a recipe for disaster. There's a reason these apps have not once worked sustainably, they always turn into a vile cesspool that brings the worst out of mobs.

I don't have a fix for this, it is entirely fair to want justice for the defenseless. At the same time I have a strong hunch that there is no problem-solution fit here, at least not with this sort of app.

tonymet21• 12 months ago

Maybe this is a good time to think about what policy could help discourage these horrific practices (it sounds like their storage was unprotected)

* App Store review requires a lightweight security audit / checklist on the backend protections.

* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached.

* Publisher is required to include their own sensitive records ( access to a high-value bank account) within their backend . Apple audits that these secrets are in the same storage as the consumer records.

tonymet21• 12 months ago

* Mandate 3rd party auditing once an app reaches > 10k users

* App publishing process includes signatures that the publisher must embed in their database. When those signatures end up on the dark web, App Store is notified and the App is revoked

fn-mote• 12 months ago

* Mandate 3rd party auditing once an app exceeds 10k users

You have a lot of interesting suggestions.

I would love to see some kind of forced transparency. Too bad back-end code doesn’t run under any App/Play Store control, so it’s harder to force an (accurate) audit.

beeflet• 12 months ago

just use your brain and don't upload your face and driver's license to a gossip website. when I was growing up, it was common knowledge that you shouldn't post your identity online outside of a professional setting.

The onus is on users to protect themselves, not the OS. As long as the OS enables the users to do what they want, no security policy will totally protect the user from themselves.

tonymet21• 12 months ago

The app store is auditing & restricting functionality within the iPhone, but the backend protections are a wild west.

"use your brain" is no substitute for security. This is a hacker forum. We think about how to protect apps. Even smart people have slipped up

dvngnt_• 12 months ago

This is becoming more unfeasible as it becomes required to access online services like reddit, nexusmods, verification on dating apps. Sending facial, and documentation data is becoming mandated by governments across the world.

arrowsmith6• 12 months ago

just use your brain and don't upload your face and driver's license to a gossip website

Meanwhile, in the UK, new legislation requires me to upload my face and driver's license just to browse Reddit.

qualeed3• 12 months ago

just use your brain and don't upload your face and driver's license to a gossip website.

It isn't just gossip websites requiring this, and it isn't just gossip websites suffering breaches.

Beijinger4• 12 months ago

Yeah, just upload the pictures of unsuspecting guys.

Sorry, well deserved ladies. It just made my day. ROTFL.

And please provide an app with all the names and pictures of the ladies who used it. So that I can easily check who not to date.

adamrezich• 12 months ago

Good thing our children will learn all about this at their mandatory Internet Literacy Fundamentals course they have to take in high school.

Oh wait—no such thing exists!

It's up to us to teach this to our children. There's no hope of getting the current generations of Internet users to grasp the simple idea that app/website backends are black boxes to you, the user, such that there is absolutely nothing preventing them from selling the personal information you gave them to anyone they see fit, or even just failing to secure it properly.

Without being a developer yourself or having this information drilled into you at a young age, you're just going to grow up naively thinking that there's nothing wrong with giving personal information such as photos of your driver's license to random third parties that you have no reason to trust whatsoever, just because they have a form in their app or on their website that requests it from you.

9dev13• 12 months ago

Nice, some unsolicited victim blaming!

gruez5• 12 months ago

* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached.

How do you enforce the token actually exists? Do app developers have to hire some auditing firm to attest all their infra actually have the token available? Seems expensive.

tonymet21• 12 months ago

it could be made available just to apple servers via ACL or protected token. but no one else .

tbrownaw2• 12 months ago

Yes, pushing companies away from mobile apps and towards PWAs or even ordinary websites does sound like an excellent idea.

tonymet21• 12 months ago

it could be an enhanced certification like "Enhanced SEcurity" or "End to End security" to allow gradual adoption.

benlivengood2• 12 months ago

In this case it appears to be a public Firebase bucket; shutting down the app wouldn't help. Quite possibly access to Firebase was mediated through a backend service and Apple couldn't validate the security of the unknown bucket anyway.

tonymet21• 12 months ago

I partially agree. At least the threat of app shutdown would be enough consequence for the publisher to take things seriously

tonymet21• 12 months ago

Also about validating the backends, apple has the resources to provide a level of auditing over the common backends. S3, Firebase -- perhaps the top 5. It's easy to provide apple with limited access to query backend metadata and confirm common misconfigurations.

dabockster12• 12 months ago

The world is moving away from App Stores and walled gardens. Figure out other options.

tonymet21• 12 months ago

that sounds preposterous . can you qualify that?

bluescrn2• 12 months ago

The world was moving away from App Stores and walled gardens. And then I woke up, and returned to grim reality.

Rendello• 12 months ago

Publisher is required to include their own sensitive records within their backend.

Now that's a creative solution! Every admin must have a table called `MY_PERSONAL_INFO` in their DB.

tonymet21• 12 months ago

wouldn't it be funny if the app store had to review it and make sure the personal info was sensitive and possibly humiliating enough . "sir your app has been denied because MY_PERSONAL_INFO table requires at least 3 d-pics"

bawolff11• 12 months ago

Make company liable for damages when breached.

If you want companies to care about security then you need to make it affect their bottom line.

This wasn't the work of some super hacker. They literally just posted the info in public.

tonymet21• 12 months ago

I agree, but relying on lawsuits is far too slow and costly . We can reduce the latency of discovery and resolution by adding software protocols.

GoatInGrey6• 12 months ago

That's a reactive measure. Certainly, it's worth pursuing. Though like the notion that you can't protect people from being murdered if you only focus on arresting murderers, there is a need for a preventative solution as well.

ryandrake3• 12 months ago

This is the only way to deter this. Negligence and incompetence needs to cost companies big money, business-ruining amounts of money, or this is just going to keep happening.

itake• 12 months ago

the problem is what are the damages? how much are those damages?

My SSN / private information has been leaked 10+ now. I had identify fraud once, resulting in ~8 hours of phone calls to various banks resulting in everything being removed.

What are my damages?

standardUser8• 12 months ago

There has to be a better way than just adding another deterrent to starting a company. Could there be an industry standard for storage security? Certification (a known hurdle) is better than "don't fuck up or we'll fine you to death".

TZubiri4• 12 months ago

Maybe the idiot that published this didn't even form an llc, "waste of 200$"

spixy• 12 months ago

GDPR makes company liable for damages when breached.

That is why Tea did not operate in Europe.

swat5352• 12 months ago

Make company liable for damages when breached.

This won't be enough, you have to make PEOPLE liable for breach.

Making a corporation being liable is useless, it's a legal Person and it can simply declare bankruptcy and move on.

TZubiri4• 12 months ago

I like the ctf one, but it would probably be hidden way deeper than the rest of the info.

tacker2000• 12 months ago

More power to app store reviewers? Please no. They already deny apps for random reasons and figuring out why is often a hair pulling experience.

tonymet21• 12 months ago

i agree about the power concerns, but where would you assign the authority if not the app store?

dang• 12 months ago

Related ongoing thread; others?

Women are anonymously spilling tea about men in their cities on viral app - https://news.ycombinator.com/item?id=44682914 - July 2025 (17 comments)

honeybadger1• 12 months ago

it should have never been allowed to be published anyway. not trying to justify what is happening, but these kind of apps are historically abused and create more problems than they intentionally try to solve.

trallnag• 12 months ago

Damn, this app is going down quicker than coalfax

Edit: Nevermind, looks like Tea has been around for quite some time already. But it kinda flew under the radar with a fairly small user base.

exiguus11• 12 months ago

Kind of meta toxic behaviour to download the data from a App that has the goal to prevent woman from men toxic behaviour.

az226• 12 months ago

Doxxers getting doxxed is peak irony.

jahewson2• 12 months ago

Let’s not kid ourselves, the goal is to shame men in an attempt to control them.

archagon• 12 months ago

Maybe if all these creepy men just dated each other and left women alone, the problem would solve itself.

loeg2• 12 months ago

I don't think that's the actual goal, or outcome.

aaaja• 12 months ago

This is such excruciating incompetence by the app developers I'm wondering if it was intentional. Done to punish the women who dared to speak up about vile men.

I just hope they can pursue legal action for this, whether it was a deliberate trap or not.

motohagiography2• 12 months ago

for someone who thought Tea was a good idea, what would be the objection be if this leaked contributor data were used to populate a similar app to warn men off?

Frost1x• 12 months ago

A rather brilliant idea I must say.

motohagiography2• 12 months ago

obviously it would be malicious and unethical, but since that didn't seem to stop Tea users, I'd be interested in what their arguments against it would be.

octoberfranklin5• 12 months ago

There's no objection, but it doesn't work because men compete while women collude.

This has evolutionary origins. A man can, theoretically, father around a thousand children or more in the time it takes a woman to bear one. Sperm are cheap so those who need sperm (i.e. women) don't need to fight with each other. There's plenty to go around. Eggs are scarce so males of myriad species fight each other to the death over them.

It's just biology.

tiznow2• 12 months ago

There's no objection, but it doesn't work because men compete while women collude.

It's funny because many people, even some women would say you have the genders flipped here

robotnikman• 12 months ago

With all the state/countries starting to do ID verification, this is a good lesson in what can go horribly wrong with these types of policies.

throwacct2• 12 months ago

This x100.

SomaticPirate• 12 months ago

"An app was created to help women stay safe on dates and avoid creeps, proceeds to be hacked by creeps"

Not a great look here.

However, Tea could have done a modicum of cybersecurity work (or hired an outside firm) to prevent this. If they are claiming to want to keep women safe (and not just running a gossip board) then this should be a red alert for them. No public acknowledgement is concerning...

Levitz2• 12 months ago

An app that was created to publicly share images and public information of people got the images and public information of the people sharing it exposed.

I don't know how can anyone feel wrong about this without feeling even worse for what was already taking place.

anonfordays• 12 months ago

However, Tea could have done a modicum of cybersecurity work (or hired an outside firm) to prevent this.

I have no doubt in my mind that this is what they did. An "outside firm" vibe coded this and delivered the results.

bendigedig• 12 months ago

Dear reader, the women were the creeps.

loeg2• 12 months ago

"Safety" is doing a lot in this headline. It's a gossip app.

mandmandam2• 12 months ago

Here are some statistics for you to consider:

* Out of every 1,000 sexual assaults, approximately 310 are reported to the police.

* Of those reported, only about 13 cases are referred to a prosecutor.

* Ultimately, only about 7 cases lead to a felony conviction.

* For every 100 rapes reported, only 18 result in an arrest.

* Fewer than 7% of reported rape cases lead to a conviction.

* In some studies, the conviction rate for rape has been reported as low as 3.2% in certain jurisdictions.

Sources:

https://rainn.org/articles/what-expect-criminal-justice-syst...

https://www.uml.edu/news/stories/2019/sexual_assault_researc...

If you could imagine what girls and women go through, some on a daily basis, for years, since childhood, I think you might have a better understanding of why a "gossip app" might actually be a pretty sensible option for avoiding sexual assault and worse.

mystraline2• 12 months ago

And as a man, do you know what happens when you report sexual assault?

You get laughed at. Hard.

So yeah, I'd like to see these broken down between cis-, hetero-, homo-, and trans-.

And why are cis-lesbian-women also reporting higher numbers of sexual assault than man/woman relationship? No men in that relationship.

https://pmc.ncbi.nlm.nih.gov/articles/PMC5511765/

The rainn articles are propaganda with a specific slant.

amelius• 12 months ago

Isn't Apple supposed to protect these app users? I suspect a lawsuit is in the making.

spacebanana7• 12 months ago

There’s nothing Apple can really do about backend security of apps.

Conceivably these storage endpoints might’ve never been directly exposed to mobile clients, instead going through other proxies or CDNs.

chneu10• 12 months ago

I think what they meant is that Apple is allowing a legally dubious app to operate.

Not that apple should enforce minimum security, but that the app shouldn't be allowed on the App Store in the first place. For obvious reasons.

Supposedly, if your photo is posted on Tea you can contact Apple. Then Apple will force Tea to take your information down.

Beijinger4• 12 months ago

LOL, well deserved. https://youtu.be/WjfpryoQ0Mk

Beijinger4• 12 months ago

Why the downvote? It is just pictures and names. Both disclosed against their will but, and this is the ROTFL part, this is exactly what the ladies did. Uploading pictures and names of unsuspecting male victims and violating their privacy.

Let ladies have some of their own medicine.

1970-01-01• 12 months ago

"Breached"

1st sentence: "exposed database"

We need a more nuanced headline here. They did nothing responsible. 404 should title this story with something that will blame them first and the 'hackers' 2nd.

zahlman• 12 months ago

My general observation thus far has been that submissions from 404media are rarely anything that I'd consider quality content for HN.

prophesi• 12 months ago

I wouldn't go that far. What they uncover with their FOIA requests that the general public would otherwise never know about tends to be quality content. And, like the Wired, their FOIA-based articles aren't paywalled.

ch_fr• 12 months ago

Yeah, the term "breached" was a very poor choice, because it sounds like "this was breached recently" instead of telling "the database could be seen by anyone ever since the app's conception, and it only came to light today" which has much worse implications.

aaronmdjones2• 12 months ago

This app's data store was "breached" in the same way that one breaches a castle by walking across the lowered drawbridge, through the open gate, past the empty guard stations.

gaws• 12 months ago

No one "breached" the site. The pictures sat on a public-facing Firebase bucket, ripe for the taking.

deanCommie• 12 months ago

This kind of pedantry drives me crazy.

If i leave my house unlocked and someone walks in and takes my TV, they still committed a crime!

Just because it was irresponsible of me, they still BREACHED MY PRIVACY.

The correct ethical behaviour in situations like this is to report to the site that this information is exposed, not download it and archive and repost it.

EVEN IF you believe that the app is itself unethical, you cannot tell from just the drivers licenses of the users who signed up that they have themselves done anything unethical justifying reprisal.

indycliff• 12 months ago

My guess, hired the absolute lowest paid developers and got what they paid for.

kashnote• 12 months ago

I'm a firm believer that if you want to start a tech company, at least one of the founders has to have a technical background. Even if you outsource all the work, you need to be able to ask the right questions related to security.

It's not just that this database was accessible via the internet. It was all public data. Storing people's IDs in a public database is just... wow.

kenjackson• 12 months ago

Tech background isn’t sufficient. They need to have security background. Some of the worst people I’ve met with respect to security have been technical enough to have the wrong level of confidence.

TZubiri4• 12 months ago

Doctors need to study 5 to 8 years and pass rigorous exams Attorneys the same Structural architects and engineers the same

We have a couple of decades more until we lock tech up, up until now it was all fun and games, but now and in the future tech will be everywhere and will be load bearing

Pigalowda• 12 months ago

Tech is special! Think about the margins, the gains, the $$$!

I bet on greed. It always wins.

justahuman74• 12 months ago

By then we'll just launder the blame onto the AIs

alibarber• 12 months ago

But now we have amazing vibe coding tools that mean that you don’t need to be technical or whatever - you can just deliver results. After all, the best LinkedIn influencers and founders don’t care about how something is delivered, just what.

Yeah, we’ve finally, nearly, just got to the point where realizing that treating IT and security and such as simply a cost centre to be minimised maybe quite wasn’t leading to optimal security outcomes - to throwing it all away again.

jackdawipper2• 12 months ago

a few more of these incidents and they'll care a lot more

TechDebtDevin• 12 months ago

Isnt there like millions of misconfigured firebase dbs in the wild with no auth, some including fortune 500 companies?

https://www.bleepingcomputer.com/news/security/misconfigured...

anal_reactor• 12 months ago

This is legit funny

ok1234562• 12 months ago

We need to stop allowing companies that are not directly engaged in financial services to request government IDs.

Facebook shouldn't legally be allowed to demand an ID any more than this disaster of an "app."

Now tens of thousands of people will be subject to identity theft because someone thought this was a neat growth hacking pattern for their ethically dubious idea of a social networking site.

11235813213• 12 months ago

A secure Know Your Customer API would be a useful service for Apple and Google to provide to developers. It could scan the ID and reveal individual pieces of information with permission to the application or multiple applications. Forgive me if it already exists and this app just wasn’t using it.

arianvanp• 12 months ago

Apple is launching such a service in iOS26

https://developer.apple.com/videos/play/wwdc2025/232/

ok1234562• 12 months ago

Or we could deny providing "app" developers with any such information.

codedokode5• 12 months ago

I am not going to show my ID to Google, especially given that it is a foreign company with dubious data collection history.

EnderWT• 12 months ago

This is mDL (mobile driver's license) here in the US, but it's a new technology and not widely available or adopted yet. https://www.nccoe.nist.gov/projects/digital-identities-mdl

octoberfranklin5• 12 months ago

The crimes of creating or posessing a fake ID are distinct from the crime of knowingly using one, an act which has the peculiar name "uttering".

Simple solution: decriminalize uttering to any person who is not an employee of the government or a regulated bank.

Revisional_Sin• 12 months ago

Unfortunately for some of us, the UK has gone the opposite direction. We now have to verify our age (or use a VPN) before accessing certain websites.

https://theconversation.com/porn-websites-now-require-age-ve...

throwawayq342310• 12 months ago

This is fine if you have a secure tool to access. It's not okay if you just try to spin up your own solution.

killerstorm• 12 months ago

There are verifiable credentials protocols which would let a site to check something (and prove that they checked it) without de-anonymizing the user.

It can be done with fairly basic cryptography. But the infrastructure around it would grow only if there's a demand. Otherwise people go with lowest denominator.

sigwinch2• 12 months ago

Shouldn’t a single mention of sex details make this a pornographic site, and thus subject to 18+ non-anonymous registration?

bilekas• 12 months ago

So it wasn't "breached" ... It was just so badly made that the bucket was public. Vibe coding ?

elicash• 12 months ago

Lots of us were bad at this even before AI.

throwawayq342310• 12 months ago

Seriously, if you looked at the comments in this thread, you'd think this is the first data breach of its kind.

throwpoaster• 12 months ago

Oh no, they doxxed the users of the doxxing app. Shocking (tiny violin emoji)!

jackdawipper2• 12 months ago

In 2008 when the GFC every company we worked IT for on contract fired their IT staff first. Two weeks later, we had bonanza period right through into the next year. They realised the hard way that those lowly cheap IT staff were quietly keeping them afloat. We charged a lot to fix their problems they created because their CEO thought IT was a waste of money.

This will prove security in IT coding is necessary, so enjoy watching the drama unfold.

IT security bonanza time. It wont be long.

fHr• 12 months ago

hahahhahaha

edm0nd• 12 months ago

Someone dropped a map from all of the photos metadata

RIP

https://x.com/vxunderground/status/1948850061493850598

WrongOnInternet• 12 months ago

Not to get all conspiratorial, but if I was an incel, or other type of woman-hating-man, with an axe to grind, creating an app to "protect" women and their dirty secrets, then having their data "breached" would be a pretty diabolical revenge plan. Only women can join the app, but the only person running the app is a man? Nothing suspicious about that...

thekevan• 12 months ago

Just yesterday I saw tweets from someone popular in tech Twitter talking about how great it was that he helped the person who made this.

hnpolicestate• 12 months ago

The trend has been for all things related to sex, dating and relationships to be aggressively male hostile. But I think it's certainly peaked. Off topic, any notice how anti -male bumble is? Trash app.

noisy_boy2• 12 months ago

At this rate what is even the point of dating for men? An angry ex can just ruin your reputation.

goku127• 12 months ago

I get this feeling that you will be downvoted to oblivion on HN if you talk against anything that harms men. Even when it involves technology and is therefore relevant here. Many seem to think that gender equality, justice, sexual violence, etc applies only to one gender. I really would like to know how we reached this situation and their justifications for it.

noisy_boy2• 12 months ago

I think there is a stupid propensity to overcorrect in the mainstream media about polarizing issues for profit which has been normalized by repeated messaging and has spread into our normal lives like a disease.

Violence again women is very real and men have been the main inflictors of it. However violence against men isn't physical because just biology. So it takes more insidious forms which combined with expectations of masculinity makes it so much more worse.

If we chose to selectively condemn the former kind of visible violence without protesting the more hidden kind, it is equally toxic as condoning violence against women.

Proudly lauding an app that enables scaling up of this kind of toxicity without any recourse by giving women carte blanche is another form of extremism.

gaiagraphia• 12 months ago

Not sure, but think this may have been the original thread: https://archive.4plebs.org/pol/thread/511313558

DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!
Tea App uploads all user verification submissions to this public firebase storage bucket with the prefix "attachments/": [link, now offline]
Yes, if you sent Tea App your face and drivers license, they doxxed you publicly! No authentication, no nothing. It's a public bucket. I have written a Python script which scrapes the bucket and downloads all the images, page by page, so you can see if you're in it: [pastebin link]
The censoring in picrel was added by me. The images in the bucket are raw and uncensored. Nice "anonymous" app. This is what happens when you entrust your personal information to a bunch of vibe-coding DEI hires.
I won't be replying to this or making any more threads about it. I did my part, God bless you all. Regards, anon

Being so careless with people's personal data should be a major crime, tbh. If I manipulated thousands of people to let me scan their passports and various other bits of personal info, then just left the copies around the city for people to find, I'd be prosecuted, and rightfully so.

ipnon• 12 months ago

The irony of a doxxing app being wrecked by the anonymous is too much for me!

pwdisswordfishz• 12 months ago

This is not irony.

udev40963• 12 months ago

Are you being serious right now? No one forced those people to upload their data to this sketchy site. Everyone with one brain cell would know the repercussions of uploading IDs to a no-name site

mr_00ff00• 12 months ago

Exactly, this is why if I walk down a street that looks sketchy and I get assaulted/robbed, it’s not a crime and no one can be charged!

Any bad behavior should be legal if the victim should have realized the warning signs.

mnky9800n• 12 months ago

i think you are assuming a level of computer literacy that doesn't exist in the general population. most people seem to not actually know where data goes when they put it in their phone, how that data is used, or what actually happens on computers in general. They mostly appear as magic to them.

Bridged7756• 12 months ago

Victim blaming isn't right. Yes, they could have exhibited more caution. No, it's not their fault.

hedora• 12 months ago

Look at what this site does.

You upload other people’s personal information on it to run background checks on them.

So, many of the victims probably haven’t heard of the company.

_moof• 12 months ago

"No one forced these people to get on that non-airworthy airplane."

People should not have to understand every technical field in order to participate in society. This is what regulatory bodies are for.

moritzwarhier• 12 months ago

Being so careless with people's personal data should be a major crime, tbh. If I manipulated thousands of people to let me scan their passports and various other bits of personal info, then just left the copies around the city for people to find, I'd be prosecuted, and rightfully so.

Good analogy. Also, this is the main point of the EU GDPR.

tinyoli• 12 months ago

It is, in the EU.

throwawaylaptop2• 12 months ago

California car dealerships are sometimes visited by the DMV inspector, an actual officer of some kind technically.

If they find any driver license photo copies, even turned over inside an unlocked desk drawer, the fine to a dealership is $10k per occurrence.

tandr• 12 months ago

Is it weird that internet companies do not have this kind of oversight?

angst• 12 months ago

FYI the original post of the thread is now "This post is not available at this time."

technion• 12 months ago

Given it's now "fixed", here's the scraping code so you can verify how this went down:

https://pastebin.com/CPBiqd1E

news_hacker• 12 months ago

Mirror: https://web.archive.org/web/20250725124140/https://pastebin....

ungreased0675• 12 months ago

I’d like to start seeing legal jeopardy for companies that are careless with customer information. Make developers scared to retain anything they don’t absolutely need.

calexanderaz• 12 months ago

What Tea Got Wrong (and how to avoid it) https://youtu.be/mMvfBUNNKIY

DaSHacka• 12 months ago

They posted an official response:

https://www.teaforwomen.com/data-breach

megadopechos• 12 months ago

"Your data privacy is of the utmost importance to us."

No it ain't.

oc15• 12 months ago

At 6:44 AM PST on 7/25, we identified unauthorized access to our systems and immediately launched a full investigation to understand the scope and impact of the incident. Here’s what we know at this tim

The first sentence is already a lie as there was never authorization in place followed by more lies.

tpmoney3• 12 months ago

Not to be overly pedantic but authorization and security are two different things. If I leave my front door unlocked and open, that doesn't mean Bob the Homeless Hobo is authorized to enter my house.

chneu10• 12 months ago

That page is nothing but lies. Wow. They admit to lying to their users(about data retention) and then lie more. That's incredible.

nonhaver2• 12 months ago

if im understanding correctly this was a public bucket? aside from the obvious leaking of data couldnt this also be subject to a DoW (denial of wallet) attack where a user could auto download all the images constantly on a VPS and cause a massive bill?

chneu10• 12 months ago

according to the company this was an old bucket they used prior to 2024 when they moved to a more robust system.

So...they were storing people's information long term in a publically accessible bucket when users did not know. In fact, I believe users were told their IDs/selfies were immediately deleted(not stored), then Tea turned around and says they were legally required to store those photos. Tea had to address this in their press release, apparently.

nonhaver2• 12 months ago

thats so insane

realsolipsist• 12 months ago

Just wanted to add…I can’t sneed

oc15• 12 months ago

Wait, the app does what?

The app aims to provide a space for women to exchange information about men in order to stay safe, and verifies that new users are women by asking them to upload a selfie.

What exactly does this mean? Which information is exchanged without consent of these people? This seems to me more problematic than the actual topic of the data breach.

iforgotpassword• 12 months ago

You can use that app in different ways:

1) you dated a guy on tinder, he became all pushy on your first date, touched you inappropriately even though you said no. Or some guy became violent during your relationship and you even found out he has a history of that.

2) you dated a nice guy but he dumped you for whatever reason, and now you want to get back at him so you make up stuff like mentioned above, and post it there.

eastbound• 12 months ago

3) You’re in competition with someone at work and you want to make his life difficult. You want to blackmail someone into promoting you, etc.

raincole• 12 months ago

In other words it's a slander platform. Got it.

smeeger• 12 months ago

you forgot the most common use cases in practice: a man you work with slighted you in some small way. now hes going to have sexual assault red flags. the HR lady who already hates men will look you up on tea and decline to hire you because you dont have green flags.

soraminazuki2• 12 months ago

That's PR speak for saying that it's a Kiwi Farms clone. I'm sure the two userbases even share their sense of righteousness regarding their own actions.

This case couldn't be more clear cut. It's horrid, and the people running the sites should be held accountable. Two wrongs don't make a right, especially when it will inevitably cost innocent lives, sooner or later.

dash2• 12 months ago

Gossip about the opposite sex is probably the world's oldest social activity. The problem is that the internet lets it happen at industrial scale, and obviously that can be misused or have dangerous unintended consequences.

chneu10• 12 months ago

it also doesn't disappear. Before the internet you could say something, laugh, and move on. It disappeared.

Now if someone says something online it can be read for years and often without context of when it was originally written.

kelseyfrog• 12 months ago

It's the digital version of a whisper network. Whisper networks have been around as long as humans. Informal ways for people (often women) to share warnings will always self assemble when formal systems don’t protect them.

That said, you;re right to raise concerns about consent and the ethics of sharing information about people without their knowledge. These systems inherently involve trade-offs. When the risk is violence or death, the cost of a false negative (saying nothing) is obvious. So people naturally lean toward maximizing sensitivity, even if that means lower specificity. That;s not ideal, but it's understandable in a world where formal accountability is inconsistent at best, and finding out after the fact isn't an option.

Their existence reflects a failure elsewhere. If we want to reduce the need for them, the solution isn't to shut them down but to make them obsolete. The solution is building systems and cultural norms where violence and coercion are reliably called out and acted upon.

If that idea feels scary or unfair, that's the emotional context many women are already living in. Understanding that is the first step toward addressing why these networks exist in the first place.

1. https://en.wikipedia.org/wiki/Whisper_network

anonzzzies2• 12 months ago

Outsourcing job was it? Modern programmers are literally terrible at all basic stuff (who stores ID images in the db and then in the clear, do you have many other mental issues or what?) (I see startups like Resend making the same mistakes and still people use them, so there isn't much punishment even from people with half a brain) and AI is going to make it all so much worse. And a public bucket. I think it should be criminally liable to be that sloppy.

juandsc2• 12 months ago

I don't think it's a modern programmers problem, in fact, I think we can argue we are much better than 20 years ago at least in terms of security.

There is a much higher concern for data validation and no one used HTTPS 20 years ago. Literally there were social networks with people uploading photos and personal stuff which didn't even have HTTPS.

anonzzzies2• 12 months ago

But that was because no one told them. Now they are told and taught. A lot of systems Warn even for opening something publicly... And yet.

I check all CVE's of the software my clients use because we need to figure out why things are broken and often this is a start -> unpatched CVE's. Most (by far) CVE's are not 'honest mistakes' or missed corner cases because rocket-science; they are just sloppy programming. Something that should never pass review. We DO know better but people ship things and hope for the best (including the case in this post etc).

poemxo• 12 months ago

On X, one of the leaked pictures seemed to be a DoD ID card, and I wondered why Tea needed proof of someone's identity. Then I remembered Uber and Lime both want your drivers license. Facebook and Instagram supposedly request it too if your account gets locked. This is not a new normal I like.

odiroot• 12 months ago

That "Tea" app seems like a real GDPR nightmare anyway.

irusensei• 12 months ago

It's almost poetic that this happens on the same day UK demands website to collect personal identification. I'm looking forward to the shitshow in the upcoming months.

okokwhatever• 12 months ago

What a moment to be a woman dude...

mandmandam2• 12 months ago

For all the gloating in here about doxxers getting doxxed, there sure are a lot of HN accounts exposing themselves as utter creeps in here.

energy123• 12 months ago

Repeal section 230 and end this Black Mirror dystopian madness.

red_acted• 12 months ago

Bro, I’m just vibing. Wym I have to care about data security… shakingmyheadsmh

John-1172• 12 months ago

I would not be disappointed if some actual hacking was done to bring down the entire app. I don't think the Tea app realizes just how many competent people dislike them, and they clearly have very few competent people of their own.

The_President• 12 months ago

Gentlemen, we're working on a new app called Eyeroll. It's a revolutionary new dating app, where our users can rate the women they have dated based on favorable and/or unfavorable attributes. Every month, our marketing team will generate a scoreboard of profiles that score highest on all mainstream attributes, and our search and filter function will rival that of Amazon (including the much requested sort by lowest first.) We're seeking $23-to-$23.5 million in funding to get our product over the finish line.

codedokode5• 12 months ago

This reminds me of people saying "a honest person has nothing to hide". A honest woman who has nothing to hide, would post stories under her name and write her address, GPS coordinates and phone number in case someone needs clarifications or has objections to the post.

excalibur• 12 months ago

4chan is still a thing? I thought it was hacked to death.

jennyholzer• 12 months ago

i thought the CIA cut its funding

thebiggening2• 12 months ago

LMAOOOO deserved

thebiggening2• 12 months ago

To be fair offering a platform for people to commit torts probably isn’t the best idea

Women dating safety app 'Tea' breached, users' IDs posted to 4chan

Related Stories