Women dating safety app 'Tea' breached, users' IDs posted to 4chan

There is a long-standing conflict between archive and cloudflare

https://jarv.is/notes/cloudflare-dns-archive-is-blocked

Strange! Doesn't seem to be down, at least at time of writing (either my original post or this one)

I linked the plain HTTP version... which seems to rely on a series of redirects; potentially TOR:

    ~ $ curl -vLsq http://archive.today/U5Tah |& grep -Ei 'location:|title'
    < Location: https://archive.today/U5Tah
    < onion-location: http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/U5Tah
    < location: https://archive.ph/U5Tah
    <title>archive.ph</title>

I've seen this issue with certain dns providers. I don't have issues with google dns (8.8.8.8).

It does, but those bars to defamation claims are based on the US Constitution more than they are on state law. I think another way to put that is that I gave the maximally generous interpretation to the plaintiff there.

[flagged]

Just keep in mind there are two very high bars you need to clear to come out ahead on a defamation action:

1. To prove that the factual claims made by the defendant were false, and that the defendant should have known they were false

2. That you suffered actual damages from those claims

Very hard to make happen on a dating app.

> "She is too fat"

Do modern men need an app to understand this?

Can you cite that? Because in the US I’m not aware of a law against sharing negative opinions about someone.

I think you underestimate the willingness of people to pay to troll, it may filter out people but an app that was (in theory) meant to be secure shouldn't think of a problem as filtering rather than securing. Admins knowing peoples' identities simply moves the weakest link in the chain to the admins. I think an app like this was doomed from the start and 4chan simply pulled the plug on an already leaking bathtub.

>A better way would have been to charge a small subscription fee - like $2/month or something.

That's Pure. And they have more than 5$ I believe.

> A better way would have been to charge a small subscription fee - like $2/month or something. The fee filters out 99% of the trolls out there

Have you seen who has the blue checkmarks on Twitter/X now? I'll give you a hint, it's not the people who argue in good faith.

Whats wrong with verifying the ID?

The issue is they decided to roll their own extremely questionable service and insecurely store sensitive images in a public bucket

Multiple SAAS vendors provide ID verification for ~$2/each. They should have eaten that fee when it was small and then found a way pass it onto the users later

> who wants to pay to troll

You've never visited X (formerly known as Twitter)?

you act like it's impossible to get payment credentials that have nothing to do with the user

[flagged]

Also on those platforms you can see if people are trash talking you even if you don’t have a procedure to face your accuser.

Even the open platforms creep me out. I don’t like seeing unverified accounts of crime in Nextdoor, I think if you see some crime you go to the police. I had a series of in person interactions with a woman which seemed creepy in retrospect, her Nextdoor was full of creepy stuff including screenshots of creepy online interactions. At least this gives everyone clear evidence they should keep away.

> Where I come from, sharing personal data of someone without their consent is not allowed.

Where you come from, people arent allowed to share their own experiences interacting with third parties without the third parties consent?

Sounds pretty oppressive, but there are absolutely many jurisdictions where that is not the case.

> Where I come from

…is clearly not the US, which has probably the most expansive understanding of “freedom of speech” in the world.

> On Tea, you're rating, or rather sharing personal information about, an individual.

Or in this case, sharing personal information about yourself...

I think its a mostly US based app, in the US sharing your opinion about other people is protected speech.

What was leaked was women's personal data, like driver's licenses. What they shared with each other was their experiences with men who sexually assaulted them or stalked them and their names, not the men's personal data.

Men's driver licenses were not distributed online. Only women's driver licenses were distributed online.

In this future that you want me to imagine, do you imagine, that I'm imagining that I am poor or I am rich? Because oh man, I didn't have much luck at the lottery or at blackjack or craps or startups or crypto, but I'm sure, this time, AI is gonna help me strike it rich!

These kinds of apps are already in existence across many cities in the world in the form of informal, invite-only WhatsApp and Telegram groups.

The problem is the demand is there for such groups and I see posts that range from, “this guy tried to get me to get in his car”, or “man exposed himself to me”, to “man has twice approached children at my child’s school” or “I was drugged and raped after meeting with X on Y dating app”.

Lots of sexual attackers are known to multiple women.

Fact is that in lots of countries rape kits don’t get processed, it’s hard to secure a conviction, many serial sex offenders walk free and many women don’t want to go through a reliving of their trauma in court.

As a result these kinds of groups are very useful, not just for women who are actively dating, but for women who are simply existing in day-to-day public life. We have a president and a supreme court judge who both have been accused of serious sex offenses and nothing happened.

Is there a chance that some man who has done nothing wrong, gets accused by a woman in these groups? Yes of course there is a chance that could happen, but many would prefer to not take the risk of dating someone that has been accused of being a sex offender and the vast majority of posts with confirmation by multiple women confirm that bias.

These groups help keep women safer than without them. There’s a good reason why many women just don’t date at all any more. Covid lockdowns reminded them that they don’t really need it and it’s more hassle than it’s worth.

Sadly the vast majority of men are fine (not all men), but not enough call out the bad and dangerous behavior of a minority of their friends and peers. Until that happens women will be drawn to these apps and groups to try to be safer and not be a part of a sex crime statistic.

There needs to be a startup accelerator or VC that solely focuses on recycled ideas. We could have an app that gathers strangers for dinners, one for reviewing people, and so on. Since all of these gained traction at some point, the idea would be you get 1-2 quick puffs of these discarded cigarette butts before selling or shutting down. Just vibe code it, go viral, collect some subscriber fees, then close due to whatever reason.

I don't think you understand humans. Spicy social gossip is far more attractive to people rather than anything informative.

This is more a question of English than law. Slanderous statements are false by definition.

There are countries where "false defamation" could be a term of art. Japan, for instance, where spreading rumors about someone that hurt their reputation is actionable even if those rumors are true. If your boss is having an affair, for instance, and you tell all your coworkers, he can successfully sue you.

> Statistically it's less than 0.05% of women die because they are killed by their partner.

2020 USA Per Capita Count of Mortality Event: Assault(Homicide), Female: 0.00139%

https://datacommons.org/tools/visualization#visType%3Dtimeli...

As a man, I find it absurd and even dangerous to not attach some stigma to men. That you feel the need to invoke "dangerous savages" is maybe your own prerogative, but by any sober and fact-based analysis it is indisputable that women are justified in acting cautiously when dealing with strange men.

It's also leads to racism when people break down relationship violence by race. It's a dumb argument that helps no one

It's better to think in terms of overall life damage and "quality of life years lost". I think it's very debatable which side loses more from getting involved in relationships.

In my opinion, it's dangerous to consider absolute numbers alone in this context. Saying something like, "Less than 0.02% of paragliders die because of the sport," can be misleading. When nn reality, the chance of dying from paragliding is 1000 times higher than in football. When I choose my next hobby, this information is very useful.

Statistically that is a rather small number. But if we take the number of women in say, America, a web search says 334.9 million. 0.05% of that is 167,450. That is quite a lot of women being killed by their partner.

I don't know were you have this numbers from, but in 2021 34% of women were killed by partner and 76% of women where killed by a known person (family, friends, colleges, partner) [1].

Edit: 100% are murder victims

https://bjs.ojp.gov/female-murder-victims-and-victim-offende...

> Wouldn’t it make more sense for a service to exist, like some kind of enforcement service provided by the government, where others can report safety concerns and that service goes and does something about it legally?

I think this is called "the police"

Right. Generally, people don't like things that can only negatively impact them.

I think groups in general feel personally attacked by things that attack people on the basis of their immutable group characteristics. Notably women dislike and feel attacked by unqualified statements like "women are crazy" or calling someone a "karen". Black people dislike and feel attacked when people talk about "ghetto trash" or "welfare queens".

Sure any individual discussion about an individual might justifiably refer to that person as "crazy" or "ghetto trash". But the nature of online spaces, and the nature of the public discourse that tends to bring these phrases and discussions into the public eye very quickly starts painting people with broad brushes.

People also feel attacked because often times discussions tend to confuse useful rhetorical devices for conveying a point with justification for a behavior that has harmful impacts on the broader group. For example, it was pretty common to here the "bowl of M&Ms where one M&M is poisoned" analogy in the height of the "Me Too" movement. It's a useful rhetorical device for explaining why someone would fell cautious about a strange man, and why they wouldn't start from a position of trust. But it's also a terrible way of generally treating men in your life, and a terrible broad philosophy for organizations and governments to follow.

And we know this rhetorical device makes bad policy and at large is harmful to innocent people because another time in recent history when that analogy was really popular was immediately after the Sept 11 attacks when talking about Muslims in general and immigrants from Muslim countries. Surely no one would find it strange that Muslims might dislike and feel personally attacked by "people talking about crimes and terrorism done by other Muslims" in the same way that many online spaces talk about "sexual abuse/harassment done by other men". Surely we wouldn't be surprised if people felt attacked or disliked an app for sharing anonymous and private information about suspicious Muslims right? Or let's say someone noticed that black people are statistically 2x as likely relative to their population to be the offender of a violent crime[1]. You'd reasonably expect people to be bothered by an app that excluded black people from signing up and was entirely about strangers providing un-verified experiences with black people under the premise of keeping people safe.

Ultimately, people are bad at statistics and really bad at understanding the degree to which a small minority of individuals can affect a large majority of people by virtue of repeat offending. So it can be true both that lots of people have completely valid awful experiences with members of a given broad group, and that members of that group feel unfairly maligned when discussion about those experiences paints with broad, unqualified strokes.

[1]: https://bjs.ojp.gov/document/cv23.pdf

It continues to confuse me that the publisher/distributor distinction that section 230 was meant to remove (created by prior Federal court decisions) gets so frequently interpreted as if section 230 had been intended to establish it.

To me this feels as if people widely thought that the Apollo Program was intended to prevent people from traveling to the moon, or Magna Carta was meant to prevent barons from limiting the king's power, or Impressionism was all about using technical artistic skills to depict scenes in a realistically detailed way.

Thanks for posting the link. I had read that before and forgot.

I think sometimes confusion about Section 230 maybe points to some legal soft spots.

I think there's a trend — good or bad — for courts to see websites as accountable for users' activities on the site when those activities are systematic and collectively illegal or jeopardized, when the website is seen as encouraging the activity.

It's not hard for me to imagine a court deciding that the intrinsic nature of the website encourages systematic libel, and is therefore is somehow involved in the creation of post content.

Even more specifically, I'm not sure the "good faith" clause of Section 230 even applies to something like Tea in the case of libel, should libel be there.

Now, actually showing libel is another thing, but that's also easier for me to imagine today than even a year ago, especially in the presence of a data breach where posters are exposed.

I guess I don't see Tea as being held legally responsible for anything about the content of user posts, in the US at least, for the reasons outlined in that article. But I also wouldn't be surprised if it did happen.

Because it's really good misinformation, thanks for the link. I had no idea that it was effectively unconditional protection.

Because they seem to want it to work that way and seem to think that by spreading the misinformation that it will somehow change the way the law is interpreted.

There is no "secure tool", there is no secure way to verify ID online right now, none of these companies can be trusted to do it properly. Just last week a bunch of my personal info was implicated in a breach of a background check company who supposedly knew what they were doing.

A private way of doing this is absolutely 100% viable with some cryptography and government support. Apparently nobody gives enough of a fuck to even try.

As for the UK's new 'porn ID' law, people are going to die. People will take their own lives when their porn browsing habits are inevitably leaked. Private companies cannot be trusted to keep their hand out of the cookie jar, they WILL link peoples' histories to their real IDs.

Ah, nice that it's a web standard. Looks like Google is as well. https://developer.chrome.com/blog/digital-credentials-api-or...

Link to the related web standard https://www.w3.org/TR/vc-data-model-2.0/

Interesting; thanks. That should connect to browsers' Digital Credentials API the other user mentioned.

You are going to show your ID to at least one foreign company with dubious data collection history, because the government will eventually force it on you.

"They just trust me. Dumb f*cks.."

I would at least love to see a public postmortem. What was the developer's rationale for storing extremely personal user data unencrypted, in a publicly facing database? How many layers of management approved storing extremely personal user data unencrypted, in a publicly facing database? What amount of testing was done that failed to figure out that extremely personal user data was stored unencrypted, in a publicly facing database?

In the US, professional certifications (PE, Bar, USMLE, CPA) exist to partially solve this problem when the certification is required to perform work legally. These are typically required in industries where lives and livelihoods of individuals and the public are at risk based on the decisions of the professional.

Joining in with some other comments on this thread, if the stamp of a certified person was required to submit/sign apps with more than 10K or 100K users and came with personal risk and potential loss of licensure, I imagine things would change quickly.

I'm personally not for introducing more gatekeeping and control over software distribution (Apple/Google already have too much power). Also not sure how you'd make it work in an international context, but would be simple to implement for US based companies if Apple/Google wanted to tackle the problem.

I think the broader issue is that we as a society don't see data exposure or bad development practices as real harm. However, exposing the addresses and personal info of people talking about potentially violent, aggressive or unsafe people seems very dangerous.

That's only a partial archive. There's another one with 55gb.

Honestly it doesn't matter that they didn't have that additional nefarious intent their incompetence and carelessness drove to the same result.

You can’t just quote from a PR puff piece and expect anyone to be convinced it is not a doxxing app.

The proof is in the pudding.

It was built for doxxing and quite potentially spreading lies about men and on top of that, they doxxed all of their users, too. They pretty much doxxed everyone who used the app or was mentioned on the platform.

I don’t see how it is not a doxxing app, but go ahead and find me another PR article that says it is the best thing since sliced bread and the founders should be saints.

Apparently, the red flags also include "has ghosted me" and "is married." Now, those are valid reasons to not date someone, but it's not safety. Safety is just the excuse, just like it is in so many other cases.

It's fucked up that you can't have an honest app to keep people safe, but the makers could have known the problems in advance, and probably did.

> One user’s story stands out

In which precisely nothing happened. We don't even know the nature of the alleged violence.

> It's expected that anon is misogynist

Did you just give a negative impression of someone you don't know?

It's an app that exposes the identity of people against their will. That's the exact definition of doxxing.

Whether the original intent was honourable or not - or if they decide to spend part of their income to a honourable cause - does not factor in to the nature of the system.

Worse, in some jurisdictions (I’m not certain about the US specifics), this kind of unsanctioned exposure could actively hinder legal prosecution of actual predators. If a person is publicly accused on a non-official platform before trial, any resulting lawsuit might be thrown out on grounds of prejudicial exposure or even perjury. The accused could claim that the testimony is tainted or retaliatory — particularly if the platform enables near-anonymous posting without formal vetting^1.

[1] Yes, the app collects driver’s licenses. But let’s be honest: in the U.S., a fake driver’s license is practically a rite of passage. Entire generations of underage teens have used them to get into clubs and bars. If that’s your trust anchor, you don’t have much of one.

> One user’s story stands out: Sarah, a 28-year-old from Chicago, posted about her ex, who seemed charming but turned violent. After escaping the relationship, she learned he was active on dating apps. Her Tea post detailed his behavior

How hard would it be to believe that none of that was true and the woman was being vindictive?

People can be shitty, including women.

this app is replicating a set of women only facebook groups. there's one for every major US city. it's sort of an if you know you know situation.

the vast majority of posts are speculation on someone being douchey or a cheater. women in their twenties seem to really enjoy browsing through the gossip.

> It's not ironic. [OP edited out]

Either use the criminal justice system.

Or form a lynch mob and stand behind your lynching.

But don't cry when you have chosen the route of self organized violence with zero checks and balances, clear examples of lynching the wrong people, then running and hiding back behind "civilized society" when your inept violence backfires.

You are no different to Kiwi Farms, I suggest you look to their site for tips on how to protect yourself while being violent on others.

Kiwi Farms also has a list of sexual abusers they have helped stop, some really horrific people.... but like "Tea" that's not the full story.

Until then it is "ironic"

[flagged]

how much money can their lobbiests throw at the gub'mnt compared to the US car dealership associations?

"Do not share personal information online" is a warning that has been heeded since the internet was created. You don't need tech savvy to understand that message, just as you don't need to know anything about zoos to understand "Do not enter the lion cage".

With tech savvy it is possible to understand the dangers well enough to dismiss the common advice in certain cases, but if you don't have it — you had better listen to what others are telling you. If you wish to dismiss it, you are on your own.

The problem is as follows: There is a subset of the population that tends to trust things you say, and this subset is fairly large.

The solution is that we need to make it so that the majority no longer trusts anything people say.

There will be no negative knock-on effects for this, I'm sure.

--

To be less glib, I don't really see a good outcome of this in the long term. If everyone developed the right level of op-sec given the amount of bad actors on the internet, we'd effectively never communicate with another person again.

I can totally imagine our intel agencies and foreign state actors having a field day with this, as mirrored here: https://www.youtube.com/watch?v=bWTyvvb8GFs

I am being downvoted for being real. How is the general populous not aware of it? That's wild. Again, you have to be aware of this. It's like privacy 101

It's the only way people learn. Real world is not going to hold your hand, real world is full of facebooks, not signals

Of course it is right. Victims need to be blamed, else they'll just stupidly do it again. That’s what “blame” is for. But, sure, if 'Tea' snuck up behind these people then there would be some room for sympathy.

But this case is more like you sticking your fingers into an electrical socket, after being warned continuously not to do that, and then crying that it was the utility company's fault for putting something dangerous in your face.

We've been told since the advent of the internet to not share personal information online. If you want to take the risk, you have to accept the consequences. However, in this case the story is even worse as the intent of these people was to violate that rule not just for themselves but for other people as well.

If I lend you my car, and you park in Berkeley leaving your laptop open on the passenger seat... Yes it's your fault my window got smashed and I'd like you to pay for it. Is it your fault your laptop got stolen? Maybe, that's just semantics. But my window being broken is your fault because we all know thieves exist and look for items on seats.

So if you upload your id to a flash in the pan website, who's fault is it when the rookie website turns out to have expectedly low security?

Vigilante justice is wrong, but at the same time, I have a hard time calling registered users of a Kiwi Farms clone "victims."

[flagged]

Regulate software development. Other industries already do this.

You could: - make Software Engineer a protected title that requires formal engineering education and mentorship as well as membership to your country's professional engineering body (Canada already does this) - make collecting and storing PII illegal unless done by a certified Software Engineer - add legal responsibility to certified Software Engineers. If a beach like this happens they lose their license or go to jail. And you easily know who is responsible for it because it's the PEng's name on the project - magically, nobody wants to collect PII insecurely anymore or hire vibe coders or give idiots access to push insecure stuff - bonus: being a certified Software Engineer now boosts your salary by 5x and the only people that will do it actually know WTF they are doing instead of cowboys, and that company will never hire a cowboy because of liability. The entire Internet is now more secure, more profitable for professionals, and dumb AI junk goes in the trash

I think fines are very reasonable. If you can’t safely do the thing, you should be punished for doing it. If you can’t safely safely do the thing then there is no issue.

Certification is essentially "don't fuck up or we'll fine you to death" with extra steps. Especially because it mostly comes down to the company self-verifying (auditors mostly just verify you are following whatever you say you are following, not that its a good idea).

Its not like anyone intentionally posts their entire DB to the internet.

Professional Engineer (PE) certification for cyber security professionals would help.

Without personal and professional consequences, the default 1 year of credit monitoring for weak security is just the cost of doing business.

I would suggest that damages should be punative, not to make the victims whole. So i dont think it matters.

Having the threat of lawsuits is not really about the actual lawsuit, its about scaring people into being more careful. If you actually get to the lawsuit stage, the strategy has failed.

> We can reduce the latency of discovery and resolution by adding software protocols.

Can we? What does this even mean?

[Edit: i guess you mean the things in your parent comment about requiring including some sort of canary token in the DB. I'm skeptical about that as it assumes certain db structure and is difficult to verify compliance.

More importantly i don't really see how it would have stopped this specific situation. It seems like the leak was published to 4chan pretty immediately. More generally how do you discover if the token is leaked, in general? Its not like the hackers are going to self-report.]

The fact that UK politicians cannot use their brains is a separate issue. May I interest you in a VPN?

You only require ID verification for NSFW subreddits, right?

[flagged]

education is helpful, but it's also inadequate. we need good drivers, and good driver safety systems. they go hand in hand.

even the most savvy consumers slip up, or are in a hurry. it's impossible to make a perfect security decision every time

I think iOS and Android already holds the threat of app store removal over developers' heads.

Presumably the risk/reward still favors risky practices.

This is the kind of thing government regulation is useful for, when it works.

also i remember maybe Facebook trying to do this when they acquired Parse. For a while they were promoting developers host their backends on Parse / FB .

The idea has merit. You have to relinquish some control to establish security. Look at App Store, Microsoft Store , MacOS App store -- they all sandbox and reduce API scope in order to improve security for consumers.

I'm more on the side of autonomy and trust, but then we have reckless developers doing stuff like this, putting the whole industry on watch.

thanks. Yeah I think there are a lot of ways to decouple App store from publisher and auditor . That way the publisher can retain autonomy / control , while still developing trust with the consumer.

We could do better in our trade at encouraging best practices in this space. Every time there's a breach , the community shames the publisher . But the real shame is on us for not establishing better auditing protocols. Security best practices are just the start. You have to have transparent, ongoing auditing and pen-testing to sustain it.

So like those EV certs that turn the address bar green.

Linux is up to 5% of the desktop. Gog and Itch.io are DRM-free, and are slowly gaining ground against Steam. Fediverse networks are slowly gaining ground against traditional social media. Signal is more popular then ever.

There will always be lowest-common-denominator users, but there is clearly some demand for an alternative to the biggest 5 websites...

It's perfectly possible to point out a flaw without suggesting a replacement.

That still doesn't make sense. How does the ACL work? What prevents the usual shenanigans like cloaking to prevent legitimate detection from working? Moreover what secrets are you even trying to detect? The app API token?

To be fair to the FinTech companies and their leadership, banking and finance laws are so draconian to the point where you'd rather store (and risk leaking) sensitive data than face even bigger fines from the government overlords. If you want that to stop, get rid of the PATRIOT Act and reform the KYC insanity.

The sad part is that your government ID is about as likely to be leaked by the government agency itself than it is by any third party that has an scan of it.

My driver's license is scanned every time I buy beer. I'm under no illusions that it's not quite readily available in any number of leaks or disclosures.

If that sounds defeatist, maybe it is. Nothing online is private. Once it's in a database, it's only a matter of time before it's exposed. History has proven this again and again.

You need to do this for background checks for employment, even though the employees for the background check service might be outsourced to a different country, and your government data had no protections in their jurisdiction.

I always do. I would have never made social media accounts if it required phone or ID. Thankfully I'm old so my accounts were made before normies flooded the net and started trusting everything.

Every hotel and his dog takes a copy of my passport, it’s basically public domain.

It was definitely a mistake. The internet was not meant to be taken seriously. Measures like real name policies are designed to make people take it seriously but that is to the detriment of the users who do.

Just look at Facebook. Users with real names sharing all kinds of inane schizo nonsense, extremism, building echo chambers without realizing it, becoming completely divorced from reality as perceived by the majority of people around them in meatspace, because they section themselves off in cyberspace.

When I started on the internet it was common to use real name, and indeed include things like addresses and phone numbers in usenet .sigs

>What I don’t like is the “live verification” apps that leave me no choice but to take a photo of it.

That's becoming the norm now, presumably because of concern that people are taking leaked scans from one site, and using it to commit identify fraud (eg. getting KYC scans from crypto exchanges and using it to apply for accounts at other crypto changes, for money laundering purposes).

You can use OBS to overlay your watermark on your webcam feed, then expose the composited output as a virtual camera that you select in the browser.

This is a really useful practice, going to implement it as well.

You have a choice of not using such apps.

It's concern trolling, they don't sincerely believe it, they're trying to make the people they don't like stupid.