Post

Matt Johansen
@mattjay.com

That viral women's only dating app 'Tea' was hacked by some 4chan users. They didn't phish, social engineer, or use some crazy hacker technique either - the database was just public

Matt Johansen
@mattjay.com

They found the database exposed on Google's Firebase. The app is meant to be basically the "are we dating the same man?" Facebook group in a dating app. In order to verify that the users are women, they ask for photos and driver's licenses.

0 reposts3 likes

Matt Johansen
@mattjay.com

"No authentication, no nothing. It's a public bucket" This is why security and privacy pros hate these ID verification laws that require drivers license uploads - these apps just can't keep this stuff secure.

Enmodo ⇇
@enmodo.bsky.social

How many more exploits like this are we going to see as people use AI to churn out apps with no expertise or discipline to check for errors like this? Not saying AI was used on this but it is exactly the amateur hour problem that would slip through only to be discovered too late.