Women dating safety app 'Tea' breached, users' IDs posted to 4chan
404media.co
404media.co
Freewalled
How is Tea even legal? Isn't this just a legal libel timebomb waiting to happen?
"This guy is a creeper and treats romantic partners terribly" is pure opinion, and cannot be defamatory. The (rare) kinds of opinion statements that can be defamatory generally take the form of "I believe (subjective thing) about this person because I observed (objective thing)", where "(objective thing)" is itself false. "The vibe I get about this person is that they hunt humans for sport" does not take that form and is almost certainly not defamatory.
Under US law, providers are generally not liable for defamatory content generated by users unless you can show they materially encouraged that content in its specifics, which is a high bar app providers are unlikely to clear.
Standard disclaimer that law varies by jurisdiction. However, that limited list typically includes claims that the person committed a crime. Many juristictions also include accusing someone of having a contagious disease, engaging in sexual misconduct, or engaging is misconduct that is inconsistent with proper conduct in their profession.
In other words, the types of things I would expect people to be talking about on tea overlap heavily with defamation per-se.
If the users were careful to make all of their statements opinions, that defense would work. However, I doubt that is the case. Instead, I expect many users to include example of what their ex did that led to their opinion; which gets directly into the realm of factual statements.
The provider protections are real, and likely protect the app from direct lawsuits (or, at least from losing them), but do not protect the app's users. A few news stories about an abusive ex going after their former partner based on what they posted in the app could be enough to scare users away. You don't even need to win the lawsuit if your goal is to harass the other person.
That is true. But i think untrained and emotionaly involved individuals will have trouble navigating the boundaries of defamation. Instead of writing opinions like “treats romantic partners terribly” they will write statements purporting facts like “this creep lured me to his house, raped me, and gave me the clap”. This is not an opinion but three individually provable statements of facts. Plus the third would be considered “defamation per se” in most jurisdictions if it were false. (The false allegation that someone has an STD is considered so loathsome that in most places the person wouldn’t need to prove damages.)
Unles specifically coached people would write this second way. Both because it is rethoricaly more powerfull, but also because they would report on their own personal experience. To be able to say “treats romantic partners terribly” they would need to canvas multiple former partners and then put their emotionaly charged stories into calm terms. That requires a lot of work. While the kind of message i’m suggesting only requires the commenter to report things they personaly know about. And in an emotionaly charged situation, like a breakup, people would be more likely to exagarate in their descriptions, making defamatory claims more likely.
> Under US law, providers are generally not liable for defamatory content generated by users…
This is true, and i believe this is the real key. Even if the commenters would be liable, the site themselves would be unlikely to become liable with them.
"Cofee App" for males only, that allows them to post pictures of woman they have dated, rate them and include green/red flags.
"She is not good enough in bed", "She is too fat", "She has a high body count",..
Arguing over the legal definition of the word "Defamation" is missing the forest for the trees.
The claim that it provides safety really is just that, an empty claim.
A better way would have been to charge a small subscription fee - like $2/month or something. The fee filters out 99% of the trolls out there (who wants to pay to troll) and also gives the app/website admins access to billing info - name, mailing address, phone number, etc - without the need for a full ID scan. So the tiny amount of trolls that do pay to troll would have to enter accurate deanonymizing payment information to even get on the system in the first place.
And it can be made so only admins know peoples' true identities. For the user facing parts, pseudonyms and usernames are still very possible - again so long as everyone understands up front that such a platform would ultimately not be anonymous on the back end.
But oh no, that won't hypergrow the company and dominate the internet! Think of all the people in India and China you're missing out on! /sarcasm
By this logic: I suppose glassdoor, yelp, or Google reviews aren't legal either?
What about identity verification as part of any employment offer?
Imagining a future where I have to pay Tea to promote and astroturf my profile or they lower my rating, and pay bot farms to post glowing reviews
Yes, as far as I understand, you upload pictures of men, either taken in the wild or from dating sites (Tinder) against their will. I am pretty sure that this would be illegal in some jurisdictions. Especially EU.
It gets shut down, everyone forgets, then someone eventually has a brilliant idea...
It come from a place of sincerity but defenders imagine everyone would use it for the same reasons they would: Warning people of genuine threats in the dating world. They would never use it for gossip, or revenge, or creative writing, etc. so they don't imagine others would.
But at scale, if generously only 0.1% of women in America are bad actors that would weaponize this app, that's over 150k people (not to mention men slipping past security). And the thing about bad actors is that one bad actor can have an outsized effect.
Without bias and gossip, who would even want to use the app?
The answer to your last two questions is found within section 230 of the Communications Decency Act.
It's only not a thing because, in the U.S., it's redundant. In other jurisdictions, it might be a thing, because there are places where a claim can be both defamatory and true.
If such a service exists and isn’t being too effective, shouldn’t that be worked on?
My guess is that there’s more to the reasons for why Tea is popular but the safety argument is largely being used to defend it
A narrowing of section 230 would not be good for Apple or Google, though they wouldn’t face any liability for the Tea apps conduct.
https://www.techdirt.com/2020/06/23/hello-youve-been-referre...
Facebook shouldn't legally be allowed to demand an ID any more than this disaster of an "app."
Now tens of thousands of people will be subject to identity theft because someone thought this was a neat growth hacking pattern for their ethically dubious idea of a social networking site.
https://theconversation.com/porn-websites-now-require-age-ve...
It can be done with fairly basic cryptography. But the infrastructure around it would grow only if there's a demand. Otherwise people go with lowest denominator.
Simple solution: decriminalize uttering to any person who is not an employee of the government or a regulated bank.
Ideally you'd see fines in the 10%s of revenue. In egregious cases (gross negligence) like this, you should be able to go outside the LLC and recoup from equity holders' personal assets.
Alas, if only we had consumer protections.
They don't seem to value privacy.
How was this app going to monetize?
I'm guessing by selling user data, namely drivers license info to phone number.
Nothing happens to these companies if there are no laws to keep them accountable, most companies I've worked with store everything forever because it's cheap and you never know what might become useful or what you might be able to sell to third parties later
>DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!
>Tea App uploads all user verification submissions to this public firebase storage bucket with the prefix "attachments/": [link, now offline]
>Yes, if you sent Tea App your face and drivers license, they doxxed you publicly! No authentication, no nothing. It's a public bucket. I have written a Python script which scrapes the bucket and downloads all the images, page by page, so you can see if you're in it: [pastebin link]
>The censoring in picrel was added by me. The images in the bucket are raw and uncensored. Nice "anonymous" app. This is what happens when you entrust your personal information to a bunch of vibe-coding DEI hires.
>I won't be replying to this or making any more threads about it. I did my part, God bless you all. Regards, anon
Being so careless with people's personal data should be a major crime, tbh. If I manipulated thousands of people to let me scan their passports and various other bits of personal info, then just left the copies around the city for people to find, I'd be prosecuted, and rightfully so.
If they find any driver license photo copies, even turned over inside an unlocked desk drawer, the fine to a dealership is $10k per occurrence.
Good analogy. Also, this is the main point of the EU GDPR.
Deleted comment
Although undeniably, the data being mostly women does bring in the chuds so it's not entirely wrong, I think this is a shallow take for a couple of reasons:
1. If any app stored user data this freely, it would be stolen and gloated over on 4chan.
2. This app, which I'm learning about just now, seems deeply problematic. It's a place for people to publically share and shame other people that they don't like. The genders of the people doing this doesn't matter, this is called doxxing and it's not ok, no matter how it gets dressed up (women's safety, children's safety, anti-terrorism, anti-drugs, whatever)
Any bad behavior should be legal if the victim should have realized the warning signs.
People should not have to understand every technical field in order to participate in society. This is what regulatory bodies are for.
You upload other people’s personal information on it to run background checks on them.
So, many of the victims probably haven’t heard of the company.
> The app aims to provide a space for women to exchange information about men in order to stay safe, and verifies that new users are women by asking them to upload a selfie.
What exactly does this mean? Which information is exchanged without consent of these people? This seems to me more problematic than the actual topic of the data breach.
1) you dated a guy on tinder, he became all pushy on your first date, touched you inappropriately even though you said no. Or some guy became violent during your relationship and you even found out he has a history of that.
2) you dated a nice guy but he dumped you for whatever reason, and now you want to get back at him so you make up stuff like mentioned above, and post it there.
This case couldn't be more clear cut. It's horrid, and the people running the sites should be held accountable. Two wrongs don't make a right, especially when it will inevitably cost innocent lives, sooner or later.
Now if someone says something online it can be read for years and often without context of when it was originally written.
That said, you;re right to raise concerns about consent and the ethics of sharing information about people without their knowledge. These systems inherently involve trade-offs. When the risk is violence or death, the cost of a false negative (saying nothing) is obvious. So people naturally lean toward maximizing sensitivity, even if that means lower specificity. That;s not ideal, but it's understandable in a world where formal accountability is inconsistent at best, and finding out after the fact isn't an option.
Their existence reflects a failure elsewhere. If we want to reduce the need for them, the solution isn't to shut them down but to make them obsolete. The solution is building systems and cultural norms where violence and coercion are reliably called out and acted upon.
If that idea feels scary or unfair, that's the emotional context many women are already living in. Understanding that is the first step toward addressing why these networks exist in the first place.
* App Store review requires a lightweight security audit / checklist on the backend protections.
* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached.
* Publisher is required to include their own sensitive records ( access to a high-value bank account) within their backend . Apple audits that these secrets are in the same storage as the consumer records.
If you want companies to care about security then you need to make it affect their bottom line.
This wasn't the work of some super hacker. They literally just posted the info in public.
My SSN / private information has been leaked 10+ now. I had identify fraud once, resulting in ~8 hours of phone calls to various banks resulting in everything being removed.
What are my damages?
This won't be enough, you have to make PEOPLE liable for breach.
Making a corporation being liable is useless, it's a legal Person and it can simply declare bankruptcy and move on.
The onus is on users to protect themselves, not the OS. As long as the OS enables the users to do what they want, no security policy will totally protect the user from themselves.
Now that's a creative solution! Every admin must have a table called `MY_PERSONAL_INFO` in their DB.
* App publishing process includes signatures that the publisher must embed in their database. When those signatures end up on the dark web, App Store is notified and the App is revoked
How do you enforce the token actually exists? Do app developers have to hire some auditing firm to attest all their infra actually have the token available? Seems expensive.
1st sentence: "exposed database"
We need a more nuanced headline here. They did nothing responsible. 404 should title this story with something that will blame them first and the 'hackers' 2nd.
If i leave my house unlocked and someone walks in and takes my TV, they still committed a crime!
Just because it was irresponsible of me, they still BREACHED MY PRIVACY.
The correct ethical behaviour in situations like this is to report to the site that this information is exposed, not download it and archive and repost it.
EVEN IF you believe that the app is itself unethical, you cannot tell from just the drivers licenses of the users who signed up that they have themselves done anything unethical justifying reprisal.
Drivers licenses can be faked. Moreover, someone can just pretend to be someone else on this app with real drivers licenses.
The whole premise, implementation and process of Tea as a social media app is flawed, and a legal liability for the devs.
The internet went from 'YouTube asking users to never use your real name' to 'you have to submit your ID to some random app' in 10 years. Crazy!
It's the only way they will push companies to STOP storing them long term.
I've been in several companies (mostly FinTech) that store personal sensitive documents "just in case". They should be used for whatever is needed and deleted. But lazy compliance and operations VPs would push to keep them... or worse, the marketing people
This absolutely should not be normalized. If I'm ever prompted to submit photos of a government ID to some service, I'm turning heel. I'll try to use their phone service (which I just did successfully this week), correspond via mail or maybe, as you've said, handle it in person but I'm probably content to go without.
Because we couldn't get anyone to take the internet seriously if it was just a bunch of anonymous pseudonyms trolling each other. And maybe that was a mistake.
If they have a problem with it then I will gradually remove pieces until they’re okay. But I haven’t had to do this the few times I’ve used this tactic – it causes issues with automated scans but eventually some human manually reviews it and says it’s okay.
What I don’t like is the “live verification” apps that leave me no choice but to take a photo of it.
These are actually still very hard to do. I don't know anyone who would let me use their license for this purpose.
I take doxing, stalking, revenge porn and cyber bullying very seriously! And I would pay good money for a background check, to stay away from such people.
* Out of every 1,000 sexual assaults, approximately 310 are reported to the police.
* Of those reported, only about 13 cases are referred to a prosecutor.
* Ultimately, only about 7 cases lead to a felony conviction.
* For every 100 rapes reported, only 18 result in an arrest.
* Fewer than 7% of reported rape cases lead to a conviction.
* In some studies, the conviction rate for rape has been reported as low as 3.2% in certain jurisdictions.
Sources:
https://rainn.org/articles/what-expect-criminal-justice-syst...
https://www.uml.edu/news/stories/2019/sexual_assault_researc...
If you could imagine what girls and women go through, some on a daily basis, for years, since childhood, I think you might have a better understanding of why a "gossip app" might actually be a pretty sensible option for avoiding sexual assault and worse.
You get laughed at. Hard.
So yeah, I'd like to see these broken down between cis-, hetero-, homo-, and trans-.
And why are cis-lesbian-women also reporting higher numbers of sexual assault than man/woman relationship? No men in that relationship.
https://pmc.ncbi.nlm.nih.gov/articles/PMC5511765/
The rainn articles are propaganda with a specific slant.
There is a much higher concern for data validation and no one used HTTPS 20 years ago. Literally there were social networks with people uploading photos and personal stuff which didn't even have HTTPS.
I check all CVE's of the software my clients use because we need to figure out why things are broken and often this is a start -> unpatched CVE's. Most (by far) CVE's are not 'honest mistakes' or missed corner cases because rocket-science; they are just sloppy programming. Something that should never pass review. We DO know better but people ship things and hope for the best (including the case in this post etc).
It's not just that this database was accessible via the internet. It was all public data. Storing people's IDs in a public database is just... wow.
Yeah, we’ve finally, nearly, just got to the point where realizing that treating IT and security and such as simply a cost centre to be minimised maybe quite wasn’t leading to optimal security outcomes - to throwing it all away again.
We have a couple of decades more until we lock tech up, up until now it was all fun and games, but now and in the future tech will be everywhere and will be load bearing
https://www.bleepingcomputer.com/news/security/misconfigured...
Why do people want to live in a panopticon of their own creation, with random anonymous strangers morally policing, judging each other with zero consequence to them?
Don't think we'll ever learn our lesson when it comes to privacy, it will be Eternal September forever.
The irony in this case being that this app operates like a lot of creep subreddits and forums out there with people posting photos of other people without their permission and gossiping / telling stories about them...
Witch Hunt as a Service, with a delightful UX, a little gamification, and soon integration with your favorite apps. Coming to an App Store near you.
However there is something to be said about the crowd you find yourself with. If you assume this app to be necessary, I would assume your social standards are not high enough.
I don't have a fix for this, it is entirely fair to want justice for the defenseless. At the same time I have a strong hunch that there is no problem-solution fit here, at least not with this sort of app.
Women are anonymously spilling tea about men in their cities on viral app - https://news.ycombinator.com/item?id=44682914 - July 2025 (17 comments)
This has evolutionary origins. A man can, theoretically, father around a thousand children or more in the time it takes a woman to bear one. Sperm are cheap so those who need sperm (i.e. women) don't need to fight with each other. There's plenty to go around. Eggs are scarce so males of myriad species fight each other to the death over them.
It's just biology.
It's funny because many people, even some women would say you have the genders flipped here
Apple had no issue mass censoring Parlor and others, how is an app like this able to reach #1 under all?
Truth.
That seems about right.
But then again, can't convince people as a whole that men are, on average, good and decent people with normal flaws just like women, and therefore deserve to be protected, loved, and appreciated equally.
This app operates just like an app some creep online would use, people post pictures (permission or not) and gossip about them.
This will prove security in IT coding is necessary, so enjoy watching the drama unfold.
IT security bonanza time. It wont be long.
The first sentence is already a lie as there was never authorization in place followed by more lies.
No it ain't.
RIP
- This creates distorted market supply and demand where those small group of men/women become sought after and its only human nature in that they value their supply less than the rest.
- Toxic behavior is expected from that small group of highly attractive people that do all the dating.
- It was only a matter of time before such app would run into legal issues or attract angry individuals. Now the damage to the leaked identities will be prolonged. With the AI tech today, the extent to which a damage can be done is unknown (ex. deepfake, impersonations, further doxxing).
- Tea user's driver licenses as well as selfies, usernames, emails, posts about their dates will drastically increase the surface area for lawsuits, fraud and exploitation by malicious agents.
- The users of this site and those that have directly posted images, details have opened themselves up to significant legal and criminal liability. Given these apps were probably popular in large city centers like California, NY have heavy punishment for digital harassment and privacy violations on top of the damages that can be claimed against them by the men who's information and details were posted.
- Tea is largely insulated from what the users post which means that their biggest exposure might be just neglect and failure to secure data which comes with a slap on the wrist. Which will make it harder for Tea's userbase to claim large damages against it.
I read more details about this case and its beyond egregious. Unencrypted firebase and full public buckets. There is no hacking involved, the tokens were being used to pull data from roughly all 30,000 users of Tea and were only blocked short while ago.
Allegedly, 60GB of photos, user personal information, driver license, gps data being shared on torrent. A map of all 30,000 users tied to GPS data is being posted as well.
Given the extreme neglect to secure their data, I now believe Tea will be open to even bigger legal liability possibly criminal even.
Yeah, I wouldn't worry about the allegedly part, 4chan is dissecting that torrent as we speak, it's quite the party.
Let me share a message I got from a woman I met a couple years ago on a dating site: "Just a side note about the dating thing on here. I get very annoyed with how horribly men take care of themselves or even try to communicate. Most men today on these sites are repulsive. It was refreshing to see you smile, and look nice. Thank you for that."
So it's not a bunch of red-pill alpha guys. I'm an average guy with basic manners and a lack of creepiness. Heck I was near my all time high weight at the time. Every single woman on those things has at least one story about a guy she met that will make you cringe from his behavior. My fav was the guy who sent a woman flowers before even meeting her - at her workplace! Dude the cyberstalking you need to do to pull that off is CREEPY AF - not romantic.
If you want to be in that top 10 percent of men the bar is incredibly low.
Let ladies have some of their own medicine.
Edit: Nevermind, looks like Tea has been around for quite some time already. But it kinda flew under the radar with a fairly small user base.
Not a great look here.
However, Tea could have done a modicum of cybersecurity work (or hired an outside firm) to prevent this. If they are claiming to want to keep women safe (and not just running a gossip board) then this should be a red alert for them. No public acknowledgement is concerning...
I don't know how can anyone feel wrong about this without feeling even worse for what was already taking place.
I have no doubt in my mind that this is what they did. An "outside firm" vibe coded this and delivered the results.
Ugh. I’m clearly getting old. I don’t even remember the last time I went to 4chan.
https://support.google.com/googleplay/android-developer/answ...
So...they were storing people's information long term in a publically accessible bucket when users did not know. In fact, I believe users were told their IDs/selfies were immediately deleted(not stored), then Tea turned around and says they were legally required to store those photos. Tea had to address this in their press release, apparently.
Conceivably these storage endpoints might’ve never been directly exposed to mobile clients, instead going through other proxies or CDNs.
Not that apple should enforce minimum security, but that the app shouldn't be allowed on the App Store in the first place. For obvious reasons.
Supposedly, if your photo is posted on Tea you can contact Apple. Then Apple will force Tea to take your information down.
Violence again women is very real and men have been the main inflictors of it. However violence against men isn't physical because just biology. So it takes more insidious forms which combined with expectations of masculinity makes it so much more worse.
If we chose to selectively condemn the former kind of visible violence without protesting the more hidden kind, it is equally toxic as condoning violence against women.
Proudly lauding an app that enables scaling up of this kind of toxicity without any recourse by giving women carte blanche is another form of extremism.
But yeah please tell me how "we care about your privacy"
I mean, it's fun to throw baseless accusations around, but do you have any actual reason to suspect this?
They have geo-mapped all the users - https://imgur.com/bRAJ2nU
Some of the users photo's are AI, which is interesting.
They got all the chat logs - https://x.com/NEElimit/status/1948766332503130562
60 Gig torrent said to be out with all the data - https://x.com/cremieuxrecueil/status/1948787086493901097 data structure - https://files.catbox.moe/c6ej81.json
For those who wish for the old days - "Vibe Coding" - shonky websites with shonky security, doxxing on all sides, 4chan pops back into relevance. You get your early internet redo.
HN 'Tea' thread discussing the ethics of the doxxing app - https://news.ycombinator.com/item?id=44682914
I just hope they can pursue legal action for this, whether it was a deliberate trap or not.
- The fact that this app exists solidifies the data that a small group of men/women do most of the dating on tinder etc while the vast majority land dates far less if none at all.
- This creates distorted market supply and demand where those small group of men/women become sought after and its only human nature in that they value their supply less than the rest.
- Toxic behavior is expected from that small group of highly attractive people that do all the dating.
- It was only a matter of time before such app would run into legal issues or attract angry individuals. Now the damage to the leaked identities will be prolonged. With the AI tech today, the extent to which a damage can be doned with the information from the leaks is unknown.
- As for the company behind Tea, they are done. They face a monumental class action lawsuit as well as ongoing individual civil/criminal cases that will arise from the leaked identities, in particular the photo of driver licenses as well as selfies, usernames, emails drastically increase the surface area for damages.
- The users of this site and those that have directly posted images, details have opened themselves up to significant liability from not only the men they have targeted but from law enforcement.
- We'll see some new laws being formed from this case. Once again, we see the hidden dangers of blindly trusting large popular platforms with sensitive data but the twist with Tea here is the defamation activity that opens up its users to both civil and criminal liability.
I don't follow.
> This creates distorted market supply and demand where those small group of men/women become sought after
Isn't that true in the real world as well? I'm not exactly a hunk; people weren't tripping over themselves to ask me out, whereas some of my friends and acquaintances did have to figuratively beat people off with a stick.