“DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!” the thread read before being deleted.

Users from 4chan claim to have discovered an exposed database hosted on Google’s mobile app development platform, Firebase, belonging to the newly popular women’s dating safety app Tea. Users say they are rifling through peoples’ personal data and selfies uploaded to the app, and then posting that data online, according to screenshots, 4chan posts, and code reviewed by 404 Media.

    • Thymos@discuss.tchncs.deEnglish
      6·
      1 day ago

      This is something I worry about all the time as well, especially since I’ve started to learn how to code and experienced how easy it is to mess up and send a list with all registered users to everyone opening a page. (This was in a test environment.)

      As a user, there is no proper way I know of to verify an app’s security. Most apps are closed source, but even if you could view the code, what would you look for?

      Both Apple and Google have a verification process for apps that are published in their app stores, but if these worked, we wouldn’t see this happening.

      There are academic researchers working on apps and privacy as well, but it’s not like you can ask them for a report on an app you’re thinking of installing.

      I think it basically comes down to trust. Check if a developer has messed up in the past and how they dealt with that, that sort of stuff. And for dating apps there is this interesting article: https://www.privacyguides.org/articles/2025/06/24/queer-dating-apps-beware-who-you-trust/#reducing-the-risks-when-using-dating-apps

      It’s a long read (haven’t fully read it myself yet) and it paints a bleak picture, but that’s the world we live in today.

      • troglodyke@lemmy.federate.ccEnglish
        2·
        4 hours ago

        You can pay for a 3rd party to penetration test your app, it’s good practice to do this before you launch an app, after any significant changes, and annually at a minimum.

        There are also a growing number of companies offering continuous penetration testing - basically, automated pen tests - but these are expensive and it’s difficult to convince companies that the cost is worth it

        • Thymos@discuss.tchncs.deEnglish
          1·
          2 hours ago

          Thanks, that’s good to know! If I do ever decide to release an app, I’ll definitely look into this.

    • ByteOnBikes@discuss.onlineOPEnglish
      420·
      2 days ago

      I honestly don’t understand what op is talking about.

      Leaks happen all the time, even in billion dollar companies.

      Their comment is the equivalent like, “This is why you should lock your doors!” Like uh okay.

      • Tlaloc_Temporal@lemmy.caEnglish
        131·
        2 days ago

        This was more like leaving all your valuables in a cardboard box on your front lawn. Anyone can just take it, if they care to look inside the complete unsecured box.

        Someone just drove up and tossed the box in their truck. No lock involved.

      • prof@infosec.pubEnglish
        201·
        2 days ago

        This situation would have been easily preventable with basic understanding of what they’re doing is what OP is saying. This leak is not something highly complex, it is painfully stupid on the side of the developers.

        There’s a difference between a hack, where data is exposed, compared to data exposure due to negligence or ignorance on the development side.

        • Eheran@lemmy.worldEnglish
          5·
          1 day ago

          Again, how should the end use know anything about what is going on at their end? How does anyone “vett” that? It is a nonsense “argument” to put blame on the users.

          • prof@infosec.pubEnglish
            2·
            1 day ago

            Where I’m from there’s certificates a company can get, that confirm a certain level of process and IT security. Also a company existing for at least 5-10 years without incidents is a “vetted” company in my books. At least anything that managed to produce a working IT system before 2021 when AI came around.

            I believe there’s a bit of bad wording going on with the original comment. Take it up with that guy, lol.

      • Eheran@lemmy.worldEnglish
        14·
        1 day ago

        I love how people just jump on whatever they like, instead of actually thinking about the stuff they read/comment on/upvote. Exactly like on Reddit, no difference.

          • Eheran@lemmy.worldEnglish
            1·
            5 hours ago

            The thing is that many here think they are better, they look down on Reddit. There is a certain shift in what demographic switched over but generally it is the same.