Comment on Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan

• Hupf@feddit.org ⁨1⁩ ⁨day⁩ ago

  You wait a while until something like this happens.

  source
• thymos@discuss.tchncs.de ⁨1⁩ ⁨day⁩ ago

  This is something I worry about all the time as well, especially since I’ve started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)

  As a user, there is no proper way I know of to verify an app’s security. Most apps are closed source, but even if you could view the code, what would you look for?

  Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn’t see this happening.

  There are academic researchers working on apps and privacy as well, but it’s not like you can ask them for a report on an app you’re thinking of installing.

  I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: privacyguides.org/…/queer-dating-apps-beware-who-…

  It’s a long read (haven’t fully read it myself yet) and it paints a bleak picture, but that’s the world we live in today.

  source

  • troglodyke@lemmy.federate.cc ⁨9⁩ ⁨minutes⁩ ago

    You can pay for a 3rd party to penetration test your app, it’s good practice to do this before you launch an app, after any significant changes, and annually at a minimum.

    There are also a growing number of companies offering continuous penetration testing - basically, automated pen tests - but these are expensive and it’s difficult to convince companies that the cost is worth it

    source
• bytesonbike@discuss.online ⁨1⁩ ⁨day⁩ ago

  I honestly don’t understand what op is talking about.

  Leaks happen all the time, even in billion dollar companies.

  source

  • prof@infosec.pub ⁨1⁩ ⁨day⁩ ago

    This situation would have been easily preventable with basic understanding of what they’re doing is what OP is saying. This leak is not something highly complex, it is painfully stupid on the side of the developers.

    There’s a difference between a hack, where data is exposed, compared to data exposure due to negligence or ignorance on the development side.

    source

    • Eheran@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Again, how should the end use know anything about what is going on at their end? How does anyone “vett” that? It is a nonsense “argument” to put blame on the users.

      source

      • prof@infosec.pub ⁨20⁩ ⁨hours⁩ ago

        Where I’m from there’s certificates a company can get, that confirm a certain level of process and IT security. Also a company existing for at least 5-10 years without incidents is a “vetted” company in my books. At least anything that managed to produce a working IT system before 2021 when AI came around.

        I believe there’s a bit of bad wording going on with the original comment. Take it up with that guy, lol.

        source
  • Tlaloc_Temporal@lemmy.ca ⁨1⁩ ⁨day⁩ ago

    This was more like leaving all your valuables in a cardboard box on your front lawn. Anyone can just take it, if they care to look inside the complete unsecured box.

    Someone just drove up and tossed the box in their truck. No lock involved.

    source

    • Hupf@feddit.org ⁨1⁩ ⁨day⁩ ago

      de.wikipedia.org/…/Datenvermeidung_und_Datenspars…

      source
  • Eheran@lemmy.world ⁨1⁩ ⁨day⁩ ago

    I love how people just jump on whatever they like, instead of actually thinking about the stuff they read/comment on/upvote. Exactly like on Reddit, no difference.

    source

    • zarkanian@sh.itjust.works ⁨11⁩ ⁨hours⁩ ago

      How strange that a site designed exactly like reddit behaves like reddit.

      source

      • Eheran@lemmy.world ⁨58⁩ ⁨minutes⁩ ago

        The thing is that many here think they are better, they look down on Reddit. There is a certain shift in what demographic switched over but generally it is the same.

        source