TeaOnHer, a rival Tea app for men, is leaking users' personal data(techcrunch.com)
techcrunch.com
TeaOnHer, a rival Tea app for men, is leaking users' personal data
https://techcrunch.com/2025/08/06/a-rival-tea-app-for-men-is-leaking-its-users-personal-data-and-drivers-licenses/
89 comments
It was a bad idea to create an app like that in the first place, it is a bad idea to have the corresponding man-version of the same thing
Gender war can't be a sign of a healthy society.
To be sure. Thankfully, I don't see a "gender war" — just the usual sensational headlines.
The last decade has been various flavors of gender war.
A common symptom of Internet poisoning tbh
Dating and marriage are way down, politics are increasingly polarized by gender, and the original Tea app was hacked because men were angry about it... sounds a bit like gender war.
The existence of the Tea app in the first place sounds like a gender war.
... in the same way that women's shelters are common but men's shelters are rare looks like a gender war.
Politics is only polarized by gender in the US because US men are ignorantly supporting anti women This is a very one sided war on women by conservative men.
Time to start paying attention
It is not just a gender wars that is an indicator of health. We have quantitative metrics correlating that the more modern a society is the slower the population grows. Negative population growth is an actuality, especially with Asia. If Americans didn’t have immigration we’d be going into the negative too. So immigration is a temporary reprieve. Overall the population of the world is going down, though so some countries are still going up (even with no immigration) like India.
The difference between modern society and the past is women have more power.
One theory is that Millions of years of evolution have conditioned the balance of power to be this way. So women gaining total equal rights is experimental and new in human civilization in general. Such changes in behavior cause unforeseen side effects even if those changes are morally correct. Population growth is one possibility here.
What changed is technology. Technology has enabled women to gain more power. It made life in Mother Nature easier by allowing women to operate on the same level as men. Things like greater strength and speed were no longer relevant because things like manual farming or manual hunting were no longer part of human life.
Once this happens the only barrier was culture and women easily fought for their rights and overcame it.
But the behavioral changes it enables like the tea app or tea on her app or gender wars is something we’ve never seen before.
The population is crashing and lowering and we don’t know why. There is a correlation between how modern a society is and how slow the population is growing. But is it causal?
Is it because women have changed their behavior so much? Although there is a correlation We don’t know for sure.
Qualitatively we do know that women date up. They want to date men who are more powerful and men they respect. But when they have greater choice in getting what they want (no arranged marriages in modern society) and when their own rising power makes the pool of available men who are more powerful than them much smaller… it seems that a possible logical conclusion is that more women will be willingly single and the population will shrink.
So humanity faces a dilemma. Do we go with biology or do we go with what’s morally right? Like if you look at India. The woman still lacks a huge amount of power but the population is expanding. The conditions in which women suffer under are horrible. They lack many freedoms and it’s not morally right. So it’s a hard question not only to answer but to face head on.
There is another freedom modern society enables that fully contributes to the problem as well. This freedom is enabling to both men and women and that is the freedom to fuck without having kids. Birth control. Another experiment in modern society.
China just needs to ban all forms of birth control and abortion and I’m very sure it will solve the population problem. But of course doing so banishes a basic human right that should be morally a universal human right.
I know tons of people disagree with me. And that’s fine. I posted here because I want to hear that disagreement and discuss it. I don’t want to start a gender war and the only way we can avoid that is to take stuff like this impartially. We need the freedom to criticize either gender, men and woman and not take it personally because real negative generalizations of either genders are real and those generalizations may very well be causing general macro impacts to society at large.
The difference between modern society and the past is women have more power.
One theory is that Millions of years of evolution have conditioned the balance of power to be this way. So women gaining total equal rights is experimental and new in human civilization in general. Such changes in behavior cause unforeseen side effects even if those changes are morally correct. Population growth is one possibility here.
What changed is technology. Technology has enabled women to gain more power. It made life in Mother Nature easier by allowing women to operate on the same level as men. Things like greater strength and speed were no longer relevant because things like manual farming or manual hunting were no longer part of human life.
Once this happens the only barrier was culture and women easily fought for their rights and overcame it.
But the behavioral changes it enables like the tea app or tea on her app or gender wars is something we’ve never seen before.
The population is crashing and lowering and we don’t know why. There is a correlation between how modern a society is and how slow the population is growing. But is it causal?
Is it because women have changed their behavior so much? Although there is a correlation We don’t know for sure.
Qualitatively we do know that women date up. They want to date men who are more powerful and men they respect. But when they have greater choice in getting what they want (no arranged marriages in modern society) and when their own rising power makes the pool of available men who are more powerful than them much smaller… it seems that a possible logical conclusion is that more women will be willingly single and the population will shrink.
So humanity faces a dilemma. Do we go with biology or do we go with what’s morally right? Like if you look at India. The woman still lacks a huge amount of power but the population is expanding. The conditions in which women suffer under are horrible. They lack many freedoms and it’s not morally right. So it’s a hard question not only to answer but to face head on.
There is another freedom modern society enables that fully contributes to the problem as well. This freedom is enabling to both men and women and that is the freedom to fuck without having kids. Birth control. Another experiment in modern society.
China just needs to ban all forms of birth control and abortion and I’m very sure it will solve the population problem. But of course doing so banishes a basic human right that should be morally a universal human right.
I know tons of people disagree with me. And that’s fine. I posted here because I want to hear that disagreement and discuss it. I don’t want to start a gender war and the only way we can avoid that is to take stuff like this impartially. We need the freedom to criticize either gender, men and woman and not take it personally because real negative generalizations of either genders are real and those generalizations may very well be causing general macro impacts to society at large.
We have enough people. We would be better served by maintaining or even decreasing population. The fact that the economic health in the short term relies on unlimited growth doesn't mean the earth can sustain it long term.
it's not black and white. Unlimited growth is bad but negative population growth unchecked means the end of modern civilization as we know it.
Right now we have negative population growth and it is not controlled negative growth. We did not intend for this to happen nor does anyone know how to stop it. So logically speaking; If the background context and status quo remains the same expect this trend to continue past criticality.
Even before that imagine not being able to find a job, product prices rising. Hardships, starvation. Ever watch the movie Children of men?
Right now we have negative population growth and it is not controlled negative growth. We did not intend for this to happen nor does anyone know how to stop it. So logically speaking; If the background context and status quo remains the same expect this trend to continue past criticality.
Even before that imagine not being able to find a job, product prices rising. Hardships, starvation. Ever watch the movie Children of men?
Imagine not being able to find a job because there are not enough people? Seems unlikely. I have watched the movie (and read the book) but I don't think that's a good place to look for economic analysis.
Yes because there's not enough people to run the systems that create jobs.
For example an airline without enough people to hire to maintain a plane, then the plane can no longer fly and everyone associated with the plane no longer has a job.
There's a small period of time where it's easier to find a job but eventually that blows past criticality and the jobs start shrinking faster than available people.
For example an airline without enough people to hire to maintain a plane, then the plane can no longer fly and everyone associated with the plane no longer has a job.
There's a small period of time where it's easier to find a job but eventually that blows past criticality and the jobs start shrinking faster than available people.
You could just train people people on the more critical jobs. No, I would prefer not to get into a detailed discussion of how long aircraft maintenance in particular requires training for or why anyone would wait until their back was against the wall to start reorienting around that need, and would rather address the subject from a higher statistical vantage point.
There is a point in population loss where the industry cannot be supported by the amount of available people and the industry is thus destroyed.
OK, so what? Some industries are more essential than others. I'd be more receptive if you leavened the alarmism with links to some statistical references or economic projections. I personally think much smaller populations (like globally 50% of current) would be a good thing for both the environment and humanity in general.
You don't need scientific evidence for everything. These are logical and self evident conclusions. In fact your own conclusion that declining population is good isn't even evidence based. You derived it from common sense, but the missing part is the nuance.
Either way Japan, China and Korea are all in panic mode right now. This is not some speculative issue I'm making up. It's deadly real and there is tons of evidence. Look it up. You're mostly treating it like it is because you're not as informed about the issue.
https://www.cbsnews.com/news/japan-population-decline-60-min...
half of the men in japan are virgins. Entire towns are about to disappear.
Either way Japan, China and Korea are all in panic mode right now. This is not some speculative issue I'm making up. It's deadly real and there is tons of evidence. Look it up. You're mostly treating it like it is because you're not as informed about the issue.
https://www.cbsnews.com/news/japan-population-decline-60-min...
half of the men in japan are virgins. Entire towns are about to disappear.
> We have quantitative metrics correlating that the more modern a society is the slower the population grows.
... and, worse, we have loonies out there who think that indicates a problem with the "health" of anything.
... and, worse, we have loonies out there who think that indicates a problem with the "health" of anything.
It is. Historically health in economics is associated with growth and Population growth is part of economic growth.
Additionally the trendline of negative population growth is 0 population. The conclusion of what’s happening is the end of civilization itself. While it may be possible we are oscillating, we can’t know for sure.
I'm not sure you're aware of the criticality of negative population growth that japan/china/korea are all facing.
Thus it is reasonable to say it is unhealthy but it is also reasonable to say that it is possibly natural as unlimited growth also leads to an end.
Can you not call anyone a loonie? It’s this type of attack and personalization that adds barriers to actual critical debate.
Additionally the trendline of negative population growth is 0 population. The conclusion of what’s happening is the end of civilization itself. While it may be possible we are oscillating, we can’t know for sure.
I'm not sure you're aware of the criticality of negative population growth that japan/china/korea are all facing.
Thus it is reasonable to say it is unhealthy but it is also reasonable to say that it is possibly natural as unlimited growth also leads to an end.
Can you not call anyone a loonie? It’s this type of attack and personalization that adds barriers to actual critical debate.
Assuming negative population growth ends in a total world population of zero is as insane as thinking positive population growth ends in people stacked ten deep in Antarctica.
The maths works out, but the reality doesn’t.
The maths works out, but the reality doesn’t.
It seems that way and of course it likely won’t get that extreme but the scenarios aren’t symmetric.
Extinction is a real phenomenon. There have been many extinctions is your life time. It is directly a physical possibility both from a logical standpoint and an evidence based standpoint point. Like this isn’t just math it’s reality.
People stacked 10 deep is not a physically possible scenario. There aren’t enough resources on earth to sustain that level of population.
Extinction is a real phenomenon. There have been many extinctions is your life time. It is directly a physical possibility both from a logical standpoint and an evidence based standpoint point. Like this isn’t just math it’s reality.
People stacked 10 deep is not a physically possible scenario. There aren’t enough resources on earth to sustain that level of population.
> Historically health in economics is associated with growth and Population growth is part of economic growth.
If you measure "health" by growth, then you'll get an association between "health" and growth. This means nothing.
You haven't even tried to give any other definition of "health".
> Additionally the trendline of negative population growth is 0 population.
... and any positive growth tends toward infinity. Furthermore any fixed positive growth rate ends with a spherical mass of flesh expanding at the speed of light, and that happens in finite time. After that you have to slow your growth to cubic, though.
Neither projection will actually come true. Neither prediction will come close to coming true.
You can't extrapolate anything forever. Furthermore there are obvious mechanistic reasons to expect the "demographic transaction" to be a bobble that will last at most a few centuries. Suggesting that it'll lead to human extinction is, um, loony.
And you haven't said why zero population would even be a problem. If everybody at every step along the way chooses not to reproduce, that means everybody got what they wanted. Well, OK, you may have not gotten what you want with respect to other people's reproduction, but you know what? That's none of your business.
> I'm not sure you're aware of the criticality of negative population growth that japan/china/korea are all facing.
I'm aware of all the people who think it's critical. I do not find their claims very compelling.
The best they seem to be able to come up with is that there aren't, or won't be, enough young people to do the work to support all the old people. That probably isn't even true, given that it's a global economy, and we're also on track to replace all human labor, long before there's a global population "shortage".
But if it is true, well, who are they that other people should exist to work for them?
Most of the the other reasons for claiming things like that are "critical" tend to come down to nationalism, which is anti-compelling.
> Can you not call anyone a loonie? It’s this type of attack and personalization that adds barriers to actual critical debate.
This was a thread about privacy issues in a phone app. When you drag in your personal obsessions in the context of something totally unrelated, people are going to call you a loony.
If you measure "health" by growth, then you'll get an association between "health" and growth. This means nothing.
You haven't even tried to give any other definition of "health".
> Additionally the trendline of negative population growth is 0 population.
... and any positive growth tends toward infinity. Furthermore any fixed positive growth rate ends with a spherical mass of flesh expanding at the speed of light, and that happens in finite time. After that you have to slow your growth to cubic, though.
Neither projection will actually come true. Neither prediction will come close to coming true.
You can't extrapolate anything forever. Furthermore there are obvious mechanistic reasons to expect the "demographic transaction" to be a bobble that will last at most a few centuries. Suggesting that it'll lead to human extinction is, um, loony.
And you haven't said why zero population would even be a problem. If everybody at every step along the way chooses not to reproduce, that means everybody got what they wanted. Well, OK, you may have not gotten what you want with respect to other people's reproduction, but you know what? That's none of your business.
> I'm not sure you're aware of the criticality of negative population growth that japan/china/korea are all facing.
I'm aware of all the people who think it's critical. I do not find their claims very compelling.
The best they seem to be able to come up with is that there aren't, or won't be, enough young people to do the work to support all the old people. That probably isn't even true, given that it's a global economy, and we're also on track to replace all human labor, long before there's a global population "shortage".
But if it is true, well, who are they that other people should exist to work for them?
Most of the the other reasons for claiming things like that are "critical" tend to come down to nationalism, which is anti-compelling.
> Can you not call anyone a loonie? It’s this type of attack and personalization that adds barriers to actual critical debate.
This was a thread about privacy issues in a phone app. When you drag in your personal obsessions in the context of something totally unrelated, people are going to call you a loony.
It’s against the rules to call people that here
TFR should be considered the basis of economics rather than GDP. It’s no longer difficult to imagine a society in which GDP is growing year over year through an automated economy of AI and robotics. But the humans who are supposedly consuming its goods and services are so miserable they can’t even be bothered to reproduce themselves.
What if people are more happy not having kids? TFR is a poor metric in this regard.
The genetic basis of sexual reproduction means that over a long enough time span the people who are happy not having kids become irrelevant because they no longer exist.
Kin selection, inclusive fitness, and group selection all beg to differ. Some form of these will be introduced in any evo bio 101 class.
I find this hand-wavy "I am smart and you are dumb" argument to be lazy and too common on HN. What if I told you I've taken intro to evolution? What if I told you I'm an expert in human evolution? What would you have to say then?
I would be very surprised if a paleoanthropologist said that individual selection was the only thing that mattered. A geneticist maybe, but I'd look at them funny. The only ones I can imagine saying that earnestly are all like 60+ years old.
[deleted]
I'd say you should like a bullshit artist, because you are just making assertions rather than providing people with information that supports your assertions (based on this whole sub-thread).
People who are happy having kids also no longer exist over time.
So? They lived happy lives, that's all that matters. We're all irrelevant eventually due to death. Over a long enough time period, the Earth is cooked by the Sun and this all is gone. Enjoy the ride, in a century you'll be long forgotten.
>What if people are more happy not having kids?
Not sure what the point of this question is. If what you were supposing had any truth to it, then this is equivalent to wanting humanity to become extinct. I will concede that many people are dim enough that they can't follow through and therefor don't realize that it's equivalent, but there are a minimum number of children that must be born or our species is gone someday (soon).
If you somehow wish to hold the contradictory views that you both are unhappy with and do not want children, and you wish humanity to continue indefinitely, then what this would say is that your some sort of parasite that does not want to contribute your fair share to the continuation of the species. Let someone else do the work, you'll just benefit from it. At minimum, if such people were to be tolerated they must come to understand that they should have little say in policy, especially those policies dealing with the future.
Not sure what the point of this question is. If what you were supposing had any truth to it, then this is equivalent to wanting humanity to become extinct. I will concede that many people are dim enough that they can't follow through and therefor don't realize that it's equivalent, but there are a minimum number of children that must be born or our species is gone someday (soon).
If you somehow wish to hold the contradictory views that you both are unhappy with and do not want children, and you wish humanity to continue indefinitely, then what this would say is that your some sort of parasite that does not want to contribute your fair share to the continuation of the species. Let someone else do the work, you'll just benefit from it. At minimum, if such people were to be tolerated they must come to understand that they should have little say in policy, especially those policies dealing with the future.
It's concerning that these type of leaks keep happening. Outside of the damage from leaking personal information, they also lower public confidence in trying out new apps. Vibe coding is making it more difficult for app makers in general when users can't trust that their personal information is protected.
Is that a new thing, though? I feel like there's been a new leak every week for years now.
It's not new, but I believe vibe coding is going to make it more common. Both this app and Tea's data breaches could have been avoided with basic web dev security.
Exactly, why would security and privacy be ever considered when time and time again, it has been proven to companies that they will face no consequences for their actions.
We have had so many catastrophic breaches and leaks that I've lost count by now, from Equifax to AT&T to Lastpass. The consequences? at worst, the companies were forced to give people a 5$ credit or discounts and at best a few angry written articles.
Our elected representatives fail to serve the public and punish these corporations.
We have had so many catastrophic breaches and leaks that I've lost count by now, from Equifax to AT&T to Lastpass. The consequences? at worst, the companies were forced to give people a 5$ credit or discounts and at best a few angry written articles.
Our elected representatives fail to serve the public and punish these corporations.
Granted that these particular apps require personal information, but why should a general-purpose app ever need it in the first place?
A few weeks ago, I wanted a walk-tracking app that would show me a map of where I'd been, the distance, not much else (maybe the time it took to walk it). Looks nice, download the first one I find... wants me to register and sign in. Why? This should all remain local on my iPhone. I think I went through 5 of them before I realized they were all junk. It's bad enough that I'd consider a monthly subscription (none were "it costs this much, once" up front), but the idea that I want them data-mining me trying to be a little less fat was absurd to the point of lunacy.
This was all thoroughly broken long before "vibe coding".
A few weeks ago, I wanted a walk-tracking app that would show me a map of where I'd been, the distance, not much else (maybe the time it took to walk it). Looks nice, download the first one I find... wants me to register and sign in. Why? This should all remain local on my iPhone. I think I went through 5 of them before I realized they were all junk. It's bad enough that I'd consider a monthly subscription (none were "it costs this much, once" up front), but the idea that I want them data-mining me trying to be a little less fat was absurd to the point of lunacy.
This was all thoroughly broken long before "vibe coding".
No, in an accelerationist sense this is good. People should not be trusting SaaS apps with their data. Even huge "trusthworthy" companies like Google and MS have had leaks over the ages. This is a learning opportunity.
Why would you not want people trusting their data with SaaS apps? Smaller developers building software benefits users assuming their data is protected with basic security implemented.
>Why would you not want people trusting their data with SaaS apps?
Mainly because after years and years (and hundreds and hundreds) of data leaks & breaches... every single person would be significantly better off by defaulting to not blindly trusting companies & applications with their data.
>Smaller developers building software benefits users assuming their data is protected
That assumption is simply incorrect. As has been proven literally thousands of times now.
Ideally, apps would be built to purposefully reduce the amount of data collected to the greatest amount possible (and only hold data for the shortest amount of time possible). Rather than now, where they collect as much data as possible, hold on to it forever, and then inevitably leak it.
Mainly because after years and years (and hundreds and hundreds) of data leaks & breaches... every single person would be significantly better off by defaulting to not blindly trusting companies & applications with their data.
>Smaller developers building software benefits users assuming their data is protected
That assumption is simply incorrect. As has been proven literally thousands of times now.
Ideally, apps would be built to purposefully reduce the amount of data collected to the greatest amount possible (and only hold data for the shortest amount of time possible). Rather than now, where they collect as much data as possible, hold on to it forever, and then inevitably leak it.
People shouldn't be benefiting from those assumptions, especially flawed assumptions positing basic competence and good faith.
Governments, agencies, organizations, and companies are dealing in personal, valuable information that they have no clue how to handle or secure, and we keep seeing massive leaks and breaches, incompetence, lack of care, apathy, and even outright malice.
You shouldn't be trusting your data with anyone, short of NASA, probably (and they won't be asking for it.)
You shouldn't be trusting your data with anyone, short of NASA, probably (and they won't be asking for it.)
It is quite concerning because SaaS isn't going away, (putting aside the questionable ethical side of an application like this) an application like this just is not possible outside of SaaS. It needs a server to centrally store information like this. If as a society we decide that something like this is valuable, there just is not another way to do it.
Sure before there would be leaks that would break trust, but generally it seems most of the time the basics were taken care of and often those leaks were because of phishing employees or other means of getting the information vs really basic security issues. Not a hard rule obviously, but still.
Now we have seen time and time again that these vibe coded systems lack even the most basic security fundamentals. That will continue to erode trust.
Sure before there would be leaks that would break trust, but generally it seems most of the time the basics were taken care of and often those leaks were because of phishing employees or other means of getting the information vs really basic security issues. Not a hard rule obviously, but still.
Now we have seen time and time again that these vibe coded systems lack even the most basic security fundamentals. That will continue to erode trust.
Do you think enough leaks like this could ever make the App Store untrustworthy and harm Apple?
I'm wondering who would fall for this after what happened to the original tea app!? Terrible apps anyway.
> Images of these driver’s licenses are publicly accessible web addresses, allowing anyone with the links to access them using their web browser.
> TechCrunch also identified a potential second security issue, in which an email address and plaintext password belonging to the app’s creator, Lampkin, was left exposed on the server
> While the app requests IDs and selfies from its users to verify their identities — a process that is not automatic — users can access a “guest” view of the app without signing in.
Is this just bad development? Are these just things could be missed by any developer or team?
I'm curious as someone who would like to create side projects with users (albiet not dubious ones these like apps) but I'm always afraid of a glaring security flaw that would be basic 101 of web development.
> TechCrunch also identified a potential second security issue, in which an email address and plaintext password belonging to the app’s creator, Lampkin, was left exposed on the server
> While the app requests IDs and selfies from its users to verify their identities — a process that is not automatic — users can access a “guest” view of the app without signing in.
Is this just bad development? Are these just things could be missed by any developer or team?
I'm curious as someone who would like to create side projects with users (albiet not dubious ones these like apps) but I'm always afraid of a glaring security flaw that would be basic 101 of web development.
> Is this just bad development? Are these just things could be missed by any developer or team
This couldn't be missed by competent developers, in both cases (tea and teaonher incidents). I'm not trying to be harsh, but i wouldn't call such teams competent and i'm fully aware that such bad teams exist. Also with the advent of a.i./vibe coding, people with no qualifications and/or experience in software development are now trying to sell / fake themselves as professional developers which also leads to such catastrophic security situations. You wouldn't hire a barista to build a bridge from a 2-week bridge building bootcamp but a licensed civil engineer, yet in software world this idea doesn't seem out of the order.
This couldn't be missed by competent developers, in both cases (tea and teaonher incidents). I'm not trying to be harsh, but i wouldn't call such teams competent and i'm fully aware that such bad teams exist. Also with the advent of a.i./vibe coding, people with no qualifications and/or experience in software development are now trying to sell / fake themselves as professional developers which also leads to such catastrophic security situations. You wouldn't hire a barista to build a bridge from a 2-week bridge building bootcamp but a licensed civil engineer, yet in software world this idea doesn't seem out of the order.
> Is this just bad development? Are these just things could be missed by any developer or team?
As the saying goes, "Human error is not a root cause". A good Five Whys would eventually hit something:
Why did the DL pictures leak? Because the images were accessible via public URL. Why were they accessible that way? Because nobody on the team checked they were not. Why did nobody check?
Maybe not enough red team thinking was employed. It's easy to make an app and say "Look we have a sign-in screen, it's secure", but you need to think from the attacker's perspective and make sure every route to every piece of sensitive data is actually secure.
As the saying goes, "Human error is not a root cause". A good Five Whys would eventually hit something:
Why did the DL pictures leak? Because the images were accessible via public URL. Why were they accessible that way? Because nobody on the team checked they were not. Why did nobody check?
Maybe not enough red team thinking was employed. It's easy to make an app and say "Look we have a sign-in screen, it's secure", but you need to think from the attacker's perspective and make sure every route to every piece of sensitive data is actually secure.
> ... you need to think from the attacker's perspective and make sure every route to every piece of sensitive data is actually secure.
This is almost "paralyzingly" scary but to not think about it at all is something I cannot fathom from the developers who made these apps.
Doing some more digging into these two "CEOs" of Tea and TeaOnHer. The TeaOnHer CEO is a Criminal Justice graduate from UMD with some comments about using claude.ai and the Tea CEO looks like he took a 6 month coding bootcamp at UC Berkeley. I don't want to dog on their background because I also don't have a CS degree but man...
This is almost "paralyzingly" scary but to not think about it at all is something I cannot fathom from the developers who made these apps.
Doing some more digging into these two "CEOs" of Tea and TeaOnHer. The TeaOnHer CEO is a Criminal Justice graduate from UMD with some comments about using claude.ai and the Tea CEO looks like he took a 6 month coding bootcamp at UC Berkeley. I don't want to dog on their background because I also don't have a CS degree but man...
Your explanation is too simplistic. I've found magazine subscription pages where the link to the pdf is display:none in css. (I downloaded their entire back catalog.) This isn't that they missed a few routes to files when securing things, but that they are utterly clueless. Invariably, such software projects employ a number of contractors who for whatever reason can barely cobble together the functionality that is repeatedly demanded by the clients, let alone any of the common-sense features that these people fail to realize that they must also nag for.
>> Images of these driver’s licenses are publicly accessible web addresses, allowing anyone with the links to access them using their web browser.
Not justifying it, but many applications consider the uniqueness of the URL enough protection to prevent discovery.
> Is this just bad development? Are these just things could be missed by any developer or team?
It's not knowing them. And when you vibe-code something, and don't prompt for it, it's not gonna do it.
Not justifying it, but many applications consider the uniqueness of the URL enough protection to prevent discovery.
> Is this just bad development? Are these just things could be missed by any developer or team?
It's not knowing them. And when you vibe-code something, and don't prompt for it, it's not gonna do it.
> Not justifying it, but many applications consider the uniqueness of the URL enough protection to prevent discovery.
Yes, that's why it's the #1 most common web security vulnerability in production code:
https://owasp.org/Top10/A01_2021-Broken_Access_Control/
"Permitting viewing or editing someone else's account, by providing its unique identifier (insecure direct object references)"
What vibe coding promoters don't understand is that the average web developer hasn't learned web security 101. Proof: HN commenter points out that "A01:2021 – Broken Access Control" is completely normal in production code.
Yes, that's why it's the #1 most common web security vulnerability in production code:
https://owasp.org/Top10/A01_2021-Broken_Access_Control/
"Permitting viewing or editing someone else's account, by providing its unique identifier (insecure direct object references)"
What vibe coding promoters don't understand is that the average web developer hasn't learned web security 101. Proof: HN commenter points out that "A01:2021 – Broken Access Control" is completely normal in production code.
Clearly vibecoding is the future.
> TechCrunch has found
Interesting that they've gone from reporting about flaws others found to hunting and hacking themselves.
Interesting that they've gone from reporting about flaws others found to hunting and hacking themselves.
That’s a form of (investigative) journalism that the world could use more of.
I wonder whether they’re just looking at the exploits that worked against Tea (sounds like it could be the same from their description), or if they have staff that can find their own exploits.
Both of these apps are awful so seeing them both leak their user data seems like ironic justice.
Anybody who'd use an app like that is in a poor position to complain about any privacy problems. I mean, fuck those people.
Of course, it's also probably leaking information about the victims of the gossip as well. Shame about that.
Of course, it's also probably leaking information about the victims of the gossip as well. Shame about that.
Headline should be "Tea app spills the tea on users"
Part of me wonders if this was deliberate.
I wondered the same until the section near the end of the article that mentions that the app creator's email address and password were left unsecured leaving his admin panel exposed.
Seems to me if this was deliberate that the creator would have gone to greater lengths to protect themselves.
Seems to me if this was deliberate that the creator would have gone to greater lengths to protect themselves.
Exactly, color me skeptical. I'd never heard of this app, but now there's a headline about it. Users are so numb to data breaches, it probably won't hurt them.
Aren't they worried about getting sued/pulled from the app store for appearing to be affiliated with Tea, as a trademark issue?
How about just not creating doxxing as a service apps?
Fool me...twice?
Has anybody tried a GDPR request against either this app or tea? My name, or any personally identifiable data is PII by definition, and GDPR gives me an absolute right to view anything they've got associated with my PII, which would include any posts
[deleted]
I mean ... it is a competitor ...
What in the world is a "rival tea app for men?"
literally the first two sentences of the article:
> TeaOnHer, an app designed for men to share photos and information about women they have supposedly dated, has exposed users’ personal information, including government IDs and selfies, TechCrunch can confirm.
> The app, which launched on the Apple App Store earlier this week, is a response to another viral app Tea that allows women to post about the men they date.
> TeaOnHer, an app designed for men to share photos and information about women they have supposedly dated, has exposed users’ personal information, including government IDs and selfies, TechCrunch can confirm.
> The app, which launched on the Apple App Store earlier this week, is a response to another viral app Tea that allows women to post about the men they date.
RateMyProfessor for dating (DateMyProfessor?). Yelp for Tinder. Amazon Reviews for Match.
It helps the argument that anyone you’d want to meet is not on a dating app.
It helps the argument that anyone you’d want to meet is not on a dating app.