Women’s ‘red flag’ app Tea is a privacy nightmare
Technology
127
Beiträge
61
Kommentatoren
1.4k
Aufrufe
-
Defaming people without giving them a chance to defend themselves, talk about shit people...
But have you considered man bad?
-
Defaming people without giving them a chance to defend themselves, talk about shit people...
It's not defamation if it's true
-
What are you basing the majority of men are shit on? Confirmation bias?
Oh come on, you know how Those People are
-
I am not sure, but I read somewhere that the developer(s) used vibe coding to create the app so...
A lot of people have speculated that.
According to their statement their code was written in Feb/2024 and predates "vibe coding"
-
It's not defamation if it's true
And its legally actionable libel/slander if false.
-
It was potentially defamation when it was just women...talking to one another, too. This seems like a pretty solid case of men looking at something women do to protect each other, and saying "...but what about the men who could be negatively affected in some cases?" I also think the tone in which this is being discussed is pretty revealing about Lemmy's demographics.
Yeah, because only men are talking about this.
-
What are you basing the majority of men are shit on? Confirmation bias?
Well im a man. And most men i interact with are casually misandrist, ableist and homophobic. I can't imagine they behave any better when they're trying to fuck you
-
Lots of men in this thread real upset about this app pointing out how the majority men are shit
Lots of misandrists in this thread framing security failures as sexism against men
-
This post did not contain any content.
Lots of misandrists in this thread framing security failures as sexism against men
-
How dare you!
The misogyny!No one is saying THAT'S misogynistic. We're saying there are a bunch of stupid misogynistic comments in this thread, not that the app is cool.
-
This post did not contain any content.
S2 Underground has a great video about this. It's basically a spy app with national security implications.
People using their military IDs for account verification and location data found in their pictures lays the argument that this data could be used for blackmail.
-
I mean, yes, but does that take priority over women who are worried about their safety? There's been women doing this over local Facebook groups for a long time. Defamation of this sort is not a new issue.
Considering even the mere accusation can ruin someone's life? Yes.
The problem isn't women don't deserve to be safe, the problem is we cannot just give people powerful weapons with no oversight or burden of proof to be deployed simply because a date didn't go well.
Facebook or App, the danger is too great
-
It was potentially defamation when it was just women...talking to one another, too. This seems like a pretty solid case of men looking at something women do to protect each other, and saying "...but what about the men who could be negatively affected in some cases?" I also think the tone in which this is being discussed is pretty revealing about Lemmy's demographics.
For what it is worth. I am a woman and I still think this app is wrong.
-
Lots of misandrists in this thread framing security failures as sexism against men
It can be both.
So many problems are caused because society assumes cisgender women are always victims and anything that looks like a man if you look at it long enough is an abuser.
-
I'm certainly no web security expert, but shouldn't Tea's junior network/backend/security developers, let alone seniors, know how to secure said Firebase or S3 buckets with STARTTLS or SSL certificates? Shouldn't a company like this have some sort of compliance department?
SSL is not the tool you need in this case, although you should obviously already be running exclusively on encrypted traffic.
The problem here is one of access rights - you should not make files default-available for anyone that can figure out the file name to the particular file in the bucket. At the very least, you need to be using signed URLs with a reasonably short expiration, and default all other access to be blocked.
-
Tea was storing its users’ sensitive information on Firebase, a Google-owned backend cloud storage and computing service.
Every time. With startups, it's always an unsecured Firebase or S3 bucket.
My hey we’re probably using Firestore as their database without authenticating their api calls to firebase functions. Basically leaving their api endpoints open to the public Internet.
They could have connected service account and used some kind of auth handshake between that and generate a temporary login token based on user credentials and the service account oauth credentials to access the api. but they probably just had everything set to unauthenticated
-
You sign up and then a while later, your personal information gets leaked to the public. Not sure what its other purpose is.
You could easily convince me that it was a brilliantly executed honeypot. It's just too damn poetic.
"It's a women's safety app" No it wasn't. This app was about women's safety as much as the recent payment processor porn game censorship bullshit was about child safety. This was about slandering men for fun because women love gossip. The app's name was "Tea."
Not a single woman who signed up for this app stopped to think, "Here's a brand new app, just came out, has no track record, no reputation. I don't know who runs this. I don't know how they secure their database. I know what they're asking, they want a picture of my government-issued ID. We've spent the last two decades reading news headlines of the pattern "tech company was hacked, 2.2 million users compromised including emails, home addresses and SSNs" on a weekly basis. There hasn't been a week gone by since Dubya was president that hasn't happened."
The women who uploaded pictures of their IDs to some app really had their own safety in mind. Turns out you can short circuit that whole process with hilarious ease if you say things like "women only" and "slander your exes."
I don't think I could have constructed a better example as to why all the recent "prove your identity" shit is comprehensively retarded.
-
It can be both.
So many problems are caused because society assumes cisgender women are always victims and anything that looks like a man if you look at it long enough is an abuser.
It's just original Facebook but for women to rate and bully men instead of Mark and his scum bros using it to rate and bully women.
-
SSL is not the tool you need in this case, although you should obviously already be running exclusively on encrypted traffic.
The problem here is one of access rights - you should not make files default-available for anyone that can figure out the file name to the particular file in the bucket. At the very least, you need to be using signed URLs with a reasonably short expiration, and default all other access to be blocked.
As I mentioned in other comments, I am a noob when it comes to web-sec; please forgive what may be dumb questions.
Is it really just permission rights "over-exposure" issue? Or does one need to also encrypt and then decrypt the data itself that must be sent to a database?
Also, if you have time, recommend any links to web/cloud/SaaS security best practices "for dummies"?
-
Well im a man. And most men i interact with are casually misandrist, ableist and homophobic. I can't imagine they behave any better when they're trying to fuck you
I'm a man too and I haven't interacted with someone like that since what, university? Maybe the problem is in who you choose to spend time with?
