Women dating safety app 'Tea' breached, users' IDs posted to 4chan

https://jarv.is/notes/cloudflare-dns-archive-is-blocked

I linked the plain HTTP version... which seems to rely on a series of redirects; potentially TOR:

    ~ $ curl -vLsq http://archive.today/U5Tah |& grep -Ei 'location:|title'
    < Location: https://archive.today/U5Tah
    < onion-location: http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/U5Tah
    < location: https://archive.ph/U5Tah
    <title>archive.ph</title>

1. To prove that the factual claims made by the defendant were false, and that the defendant should have known they were false

2. That you suffered actual damages from those claims

Very hard to make happen on a dating app.

What happened on the tea app were probably not knowable, observable or refutable for those actually being doxxed or slandered.

That isn’t me saying 4chan is absolutely morally in the clear, but it’s still quite a significant distinction.

It was only anonymous for the women speaking there, but not for the men they were speaking about, hence the justified outrage, since anonymous strangers are gossiping/slandering you in a public online space behind a 2$ entry fee.

Would you also support if men had their own such public "safe spaces" to gossip anonymously about real women with their names? I can assure you it would be shut down immediately.

So then why do we allow double standards where only one sex should loose their right to online privacy?

That's Pure. And they have more than 5$ I believe.

Have you seen who has the blue checkmarks on Twitter/X now? I'll give you a hint, it's not the people who argue in good faith.

You've never visited X (formerly known as Twitter)?

The issue is they decided to roll their own extremely questionable service and insecurely store sensitive images in a public bucket

Multiple SAAS vendors provide ID verification for ~$2/each. They should have eaten that fee when it was small and then found a way pass it onto the users later

Even the open platforms creep me out. I don’t like seeing unverified accounts of crime in Nextdoor, I think if you see some crime you go to the police. I had a series of in person interactions with a woman which seemed creepy in retrospect, her Nextdoor was full of creepy stuff including screenshots of creepy online interactions. At least this gives everyone clear evidence they should keep away.

Or in this case, sharing personal information about yourself...

Where you come from, people arent allowed to share their own experiences interacting with third parties without the third parties consent?

Sounds pretty oppressive, but there are absolutely many jurisdictions where that is not the case.

…is clearly not the US, which has probably the most expansive understanding of “freedom of speech” in the world.

Men's driver licenses were not distributed online. Only women's driver licenses were distributed online.

The problem is the demand is there for such groups and I see posts that range from, “this guy tried to get me to get in his car”, or “man exposed himself to me”, to “man has twice approached children at my child’s school” or “I was drugged and raped after meeting with X on Y dating app”.

Lots of sexual attackers are known to multiple women.

Fact is that in lots of countries rape kits don’t get processed, it’s hard to secure a conviction, many serial sex offenders walk free and many women don’t want to go through a reliving of their trauma in court.

As a result these kinds of groups are very useful, not just for women who are actively dating, but for women who are simply existing in day-to-day public life. We have a president and a supreme court judge who both have been accused of serious sex offenses and nothing happened.

Is there a chance that some man who has done nothing wrong, gets accused by a woman in these groups? Yes of course there is a chance that could happen, but many would prefer to not take the risk of dating someone that has been accused of being a sex offender and the vast majority of posts with confirmation by multiple women confirm that bias.

These groups help keep women safer than without them. There’s a good reason why many women just don’t date at all any more. Covid lockdowns reminded them that they don’t really need it and it’s more hassle than it’s worth.

Sadly the vast majority of men are fine (not all men), but not enough call out the bad and dangerous behavior of a minority of their friends and peers. Until that happens women will be drawn to these apps and groups to try to be safer and not be a part of a sex crime statistic.

2020 USA Per Capita Count of Mortality Event: Assault(Homicide), Female: 0.00139%

https://datacommons.org/tools/visualization#visType%3Dtimeli...

Edit: 100% are murder victims

https://bjs.ojp.gov/female-murder-victims-and-victim-offende...

I think this is called "the police"

To me this feels as if people widely thought that the Apollo Program was intended to prevent people from traveling to the moon, or Magna Carta was meant to prevent barons from limiting the king's power, or Impressionism was all about using technical artistic skills to depict scenes in a realistically detailed way.

I think sometimes confusion about Section 230 maybe points to some legal soft spots.

I think there's a trend — good or bad — for courts to see websites as accountable for users' activities on the site when those activities are systematic and collectively illegal or jeopardized, when the website is seen as encouraging the activity.

It's not hard for me to imagine a court deciding that the intrinsic nature of the website encourages systematic libel, and is therefore is somehow involved in the creation of post content.

Even more specifically, I'm not sure the "good faith" clause of Section 230 even applies to something like Tea in the case of libel, should libel be there.

Now, actually showing libel is another thing, but that's also easier for me to imagine today than even a year ago, especially in the presence of a data breach where posters are exposed.

I guess I don't see Tea as being held legally responsible for anything about the content of user posts, in the US at least, for the reasons outlined in that article. But I also wouldn't be surprised if it did happen.

Link to the related web standard https://www.w3.org/TR/vc-data-model-2.0/

Here's a few relevant statistics, which I hope you and all the people who failed to downvote you might consider:

* Out of every 1,000 sexual assaults, approximately 310 are reported to the police.

* Of those reported, only about 13 cases are referred to a prosecutor.

* Ultimately, only about 7 cases lead to a felony conviction.

* For every 100 rapes reported, only 18 result in an arrest.

* Fewer than 7% of reported rape cases lead to a conviction.

* In some studies, the conviction rate for rape has been reported as low as 3.2% in certain jurisdictions.

Sources:

https://rainn.org/articles/what-expect-criminal-justice-syst...

https://www.uml.edu/news/stories/2019/sexual_assault_researc...

Joining in with some other comments on this thread, if the stamp of a certified person was required to submit/sign apps with more than 10K or 100K users and came with personal risk and potential loss of licensure, I imagine things would change quickly.

I'm personally not for introducing more gatekeeping and control over software distribution (Apple/Google already have too much power). Also not sure how you'd make it work in an international context, but would be simple to implement for US based companies if Apple/Google wanted to tackle the problem.

I think the broader issue is that we as a society don't see data exposure or bad development practices as real harm. However, exposing the addresses and personal info of people talking about potentially violent, aggressive or unsafe people seems very dangerous.

You could: - make Software Engineer a protected title that requires formal engineering education and mentorship as well as membership to your country's professional engineering body (Canada already does this) - make collecting and storing PII illegal unless done by a certified Software Engineer - add legal responsibility to certified Software Engineers. If a beach like this happens they lose their license or go to jail. And you easily know who is responsible for it because it's the PEng's name on the project - magically, nobody wants to collect PII insecurely anymore or hire vibe coders or give idiots access to push insecure stuff - bonus: being a certified Software Engineer now boosts your salary by 5x and the only people that will do it actually know WTF they are doing instead of cowboys, and that company will never hire a cowboy because of liability. The entire Internet is now more secure, more profitable for professionals, and dumb AI junk goes in the trash

Its not like anyone intentionally posts their entire DB to the internet.

> We can reduce the latency of discovery and resolution by adding software protocols.

Can we? What does this even mean?

[Edit: i guess you mean the things in your parent comment about requiring including some sort of canary token in the DB. I'm skeptical about that as it assumes certain db structure and is difficult to verify compliance.

More importantly i don't really see how it would have stopped this specific situation. It seems like the leak was published to 4chan pretty immediately. More generally how do you discover if the token is leaked, in general? Its not like the hackers are going to self-report.]

even the most savvy consumers slip up, or are in a hurry. it's impossible to make a perfect security decision every time

Presumably the risk/reward still favors risky practices.

There will always be lowest-common-denominator users, but there is clearly some demand for an alternative to the biggest 5 websites...

The idea has merit. You have to relinquish some control to establish security. Look at App Store, Microsoft Store , MacOS App store -- they all sandbox and reduce API scope in order to improve security for consumers.

I'm more on the side of autonomy and trust, but then we have reckless developers doing stuff like this, putting the whole industry on watch.

We could do better in our trade at encouraging best practices in this space. Every time there's a breach , the community shames the publisher . But the real shame is on us for not establishing better auditing protocols. Security best practices are just the start. You have to have transparent, ongoing auditing and pen-testing to sustain it.

Just look at Facebook. Users with real names sharing all kinds of inane schizo nonsense, extremism, building echo chambers without realizing it, becoming completely divorced from reality as perceived by the majority of people around them in meatspace, because they section themselves off in cyberspace.

That's becoming the norm now, presumably because of concern that people are taking leaked scans from one site, and using it to commit identify fraud (eg. getting KYC scans from crypto exchanges and using it to apply for accounts at other crypto changes, for money laundering purposes).

My driver's license is scanned every time I buy beer. I'm under no illusions that it's not quite readily available in any number of leaks or disclosures.

If that sounds defeatist, maybe it is. Nothing online is private. Once it's in a database, it's only a matter of time before it's exposed. History has proven this again and again.

That's precisely my point.

> Most (by far) CVE's are not 'honest mistakes' or missed corner cases because rocket-science; they are just sloppy programming.

This is actually true, but it's true because we have way better tooling and safer languages, which means we don't see nearly as many buffer overflows or memory management issues.

It's not that you didn't have negligent programmers back then.

> Something that should never pass review. We DO know better but people ship things and hope for the best (including the case in this post etc).

That's not new though. We've seen similar things happen in the past multiple times.

20 years ago code review was literally a bunch of meetings in a room or talk with another developer in person. Having something like github where you make a pull request, passes the automated test suite and requires a code review, etc. simply wasn't done. If in 2005 that already existed it was extremely bleeding edge.

I do have concerns about the code quality issues introduced by the abuse of LLMs, but until right before that was a thing, definitely the code quality in general has improved a lot.

Just as Parieto indicates that the bulk of male sexual assaults are done by a few, also indicates that the bulk of female assaults and claims of sexual assault are also done by a few.

Apps like Tea only paint all men as abusive thugs. If this were done, say to black people, this app would have been shut down and a lawsuit in federal court filed. But men are OK to harass, libel, and demean.

Good on anonymous for exposing this obvious double standard. And I hope they get sued by everyone.

So much for the "anonymous" app.

What's the bar they cannot clear?

But regardless i do understand the appeal. Dating apps suffer from basically being a low-information market place. There are of course the malicious people, which everyone has an interest in removing from the app. However even ignoroing that its a bit of a lemons market (if you excuse how dehumanizing the metaphor is). Its very hard to tell if someone is a good date just from their profile, and people who are good dates end up in relationships and exit the market quickly while bad dates stay in the market for a much longer time. Allowing some sort of review system does solve that problem - its worked in other domains, like uber drivers or what resturant to go to. So i certainly understand the appeal of why people would want this.

"Don't let Toyota's 'reliable car at a reasonable price' marketing fool you, they're all about money." Yeah, but does that preclude them from selling me an actually reliable car at a reasonable price?

https://www.bet.com/article/pe65fc/apple-s-black-diversity-c...

In some cultures, mentioning dating apps will immediately lead to negative assumptions and connections are done through vetted networks and specific establishments where "hunting" activity is allowed, some with even more boundary pushing that would be impossible in Western culture.