Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.
People sign up to app intended to share personal information about others without their permission, end up having their own personal information shared without permission - the irony is impressive.
sunglocto@lemmy.dbzer0.com 3 weeks ago
This is what happens when you decide to vibecode a service with zero attention to safety or web development. This is why you don’t immediately jump onto a new service without it being vetted properly. Now one of the worst communities on the Internet is in possession of over a hundred thousand women’s driving licenses and faces. This is going to be an absolute disaster.
Darrell_Winfield@lemmy.world 3 weeks ago
This is ALSO why no service should ever require or get my driver’s license information. Fuck that. Also, yet another Constance to those who can’t afford a car or want to improve the environment by living car free.
shiroininja@lemmy.world 3 weeks ago
My only exception to that are uber drivers. But then again we live in an age where somehow better help has become popular, even though they sell your data.
JackbyDev@programming.dev 2 weeks ago
Instead, just prove you have a credit card by submitting the details. Also totally safe. Be sure to include the CVV, please!
Alaik@lemmy.zip 2 weeks ago
The only site I ever felt comfortable scanning shit like that into was a site that sold things only to military/medics/fire fighters so I had to upload my medic license and my FF cert.
Anything beyond that is a no go from me.
4am@lemmy.zip 3 weeks ago
Now now, I like to shit on vibecoders too but let’s not pretend this is some new problem.
Idiots leave databases on cloud servers exposed all the time rather than deal with their companies often arcane rules for generating certificates
JackbyDev@programming.dev 2 weeks ago
Remember when the government published SSNs in HTML? zdnet.com/…/missouri-will-not-prosecute-hacker-re…
Passerby6497@lemmy.world 2 weeks ago
Where do you think the AI learned it?
Like, I get that competent coders do it too, but now any skiddie with an idea can cosplay as a developer so this is going to be so much more prevelant
panda_abyss@lemmy.ca 3 weeks ago
To be fair, I’m not sure why firebase even has a public access option. That’s a recipe for issues.
Though if it’s anything like Google Cloud Store, they hopefully make it very clear that your bucket is public.
Zetta@mander.xyz 3 weeks ago
“Vibe coded” you just made that up didn’t you, because you don’t like llms. I don’t see anything in the article about “Ai” and this service has been operating for 2 years.
shalafi@lemmy.world 3 weeks ago
My thoughts as well. But hey, it’s lemmy! Just accuse someone of doing something we hate, good to go!
Redjard@lemmy.dbzer0.com 2 weeks ago
The og 4chan post brought up the vibe coding. Using it as an insult to quality is wider spread than just lemmy.
sunglocto@lemmy.dbzer0.com 2 weeks ago
Maybe I shouldn’t have used the term vibe coded. I apologize.
Eheran@lemmy.world 3 weeks ago
How is something “vetted properly” and how do I find out about that?
Hupf@feddit.org 3 weeks ago
You wait a while until something like this happens.
thymos@discuss.tchncs.de 2 weeks ago
This is something I worry about all the time as well, especially since I’ve started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)
As a user, there is no proper way I know of to verify an app’s security. Most apps are closed source, but even if you could view the code, what would you look for?
Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn’t see this happening.
There are academic researchers working on apps and privacy as well, but it’s not like you can ask them for a report on an app you’re thinking of installing.
I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: privacyguides.org/…/queer-dating-apps-beware-who-…
It’s a long read (haven’t fully read it myself yet) and it paints a bleak picture, but that’s the world we live in today.
bytesonbike@discuss.online 3 weeks ago
I honestly don’t understand what op is talking about.
Leaks happen all the time, even in billion dollar companies.
zarkanian@sh.itjust.works 2 weeks ago
Anybody oblivious enough to create something like this isn’t someone you should trust your most private data with. This service had red flags from the concept phase, never mind the execution.
This is not to say, of course, that the victims deserved it. It just really sucks that they had to learn this lesson this way.