Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Security Privacy

Male-Oriented App 'TeaOnHer' Also Had Security Flaws That Could Leak Men's Driver's License Photos (techcrunch.com) 112

The women-only dating-advice app Tea "has been hit with 10 potential class action lawsuits in federal and state court," NBC News reported last week, "after a data breach led to the leak of thousands of selfies, ID photos and private conversations online." The suits could result in Tea having to pay tens of millions of dollars in damages to the plaintiffs, which could be catastrophic for the company, an expert told NBC News... One of the suits lists the right-wing online discussion board 4chan and the social platform X as defendants, alleging that they allowed bad actors to spread users' personal information.
But meanwhile, a new competing app for men called "TeaOnHer" has already been launched. And it was also found to have enormous security flaws, reports TechCrunch, that "exposed its users' personal information, including photos of their driver's licenses and other government-issued identity documents..." [W]hen we looked at the TeaOnHer's public internet records, it had no meaningful information other than a single subdomain, appserver.teaonher.com. When we opened this page in our browser, what loaded was the landing page for TeaOnHer's API (for the curious, we uploaded a copy here)... It was on this landing page that we found the exposed email address and plaintext password (which wasn't that far off from "password") for [TeaOnHer developer Xavier] Lampkin's account to access the TeaOnHer "admin panel"... This API landing page included an endpoint called /docs, which contained the API's auto-generated documentation (powered by a product called Swagger UI) that contained the full list of commands that can be performed on the API [including administrator commands to return user data]...

While it's not uncommon for developers to publish their API documentation, the problem here was that some API requests could be made without any authentication — no passwords or credentials were needed...

The records returned from TeaOnHer's server contained users' unique identifiers within the app (essentially a string of random letters and numbers), their public profile screen name, and self-reported age and location, along with their private email address. The records also included web address links containing photos of the users' driver's licenses and corresponding selfies. Worse, these photos of driver's licenses, government-issued IDs, and selfies were stored in an Amazon-hosted S3 cloud server set as publicly accessible to anyone with their web addresses. This public setting lets anyone with a link to someone's identity documents open the files from anywhere with no restrictions...

The bugs were so easy to find that it would be sheer luck if nobody malicious found them before we did. We asked, but Lampkin would not say if he has the technical ability, such as logs, to determine if anyone had used (or misused) the API at any time to gain access to users' verification documents, such as by scraping web addresses from the API. In the days since our report to Lampkin, the API landing page has been taken down, along with its documentation page, and it now displays only the state of the server that the TeaOnHer API is running on as "healthy."

The flaws were discovered while TeaOnHer was the #2 free app in the Apple App Store, the article points out. And while these flaws "appear to be resolved," the article notes a larger issue. "Shoddy coding and security flaws highlight the ongoing privacy risks inherent in requiring users to submit sensitive information to use apps and websites,"

And TeaOnHer also had another authentication issue. A female reporter at Cosmopolitan also noted Friday that TeaOnHer "lets you browse through profiles before your verifications are complete. So literally anyone (like myself) can read reviews..."
This discussion has been archived. No new comments can be posted.

Male-Oriented App 'TeaOnHer' Also Had Security Flaws That Could Leak Men's Driver's License Photos

Comments Filter:
  • TeaOnHER??? (Score:4, Interesting)

    by locater16 ( 2326718 ) on Monday August 18, 2025 @03:54AM (#65596710)
    Really, TeaOnHer, excluding gay guys? Where's the progress? I demand an AI coded gossip site for everyone, about everyone! One with a monopoly on gossip that's the result of capitalist ravenings, run by an egomaniacal psychopath as it expands into vague super conglomerate who's only reason not leak all my info is that they can charge for it if they don't; now that's progress!
    • by dfghjk ( 711126 )

      Go ahead and demand it, the people who think these services are a good idea don't care.

      I like how "TeaOnHer" is described as "a new competing app for men", competing with the Tea app? I don't think so, that's not how competition works. It's an escalation app, more fuel for hatred and bad behavior.

      Everything's a game now in the SuperKendall world.

      • Re:TeaOnHER??? (Score:5, Insightful)

        by Ol Olsoc ( 1175323 ) on Monday August 18, 2025 @08:18AM (#65596972)

        Go ahead and demand it, the people who think these services are a good idea don't care.

        I like how "TeaOnHer" is described as "a new competing app for men", competing with the Tea app? I don't think so, that's not how competition works. It's an escalation app, more fuel for hatred and bad behavior.

        Everything's a game now in the SuperKendall world.

        Who could be against safety for women?

        And TeaOnHer is a reaction to the what the Tea app turned into, which was not about safety. It morphed into a #metoo rev1.

        It ended up self - doxxing women. Yikes! But before that, they were doxxing men. And just like what happened with #metoo, some of the accusations were at the level of hurt feelings for a breakup or being pissed at a situationship, not a man who physically assaults women - that should be immediately reported to the police, not some sketchy online group.

        Aside from the leaks, there will probably be lawsuits against Tea and the women posting.

        However, at its deep roots, a Tea app for both sexes cannot be logically argued that one is better than the other.

        Posting and naming someone you don't like for your interpretation of abuse, is equally as valid for men as women. Which is not to make claims that it is valid or smart. It is level 11 stupid.

        • by Anonymous Coward

          males account for 80% of violent crime

          • males account for 80% of violent crime

            Many men are pieces of shit. About what percentage were raised primarily by their fathers? I know you're an AC troll, but I've heard a LOT of misandrist pathological women make this argument...implying men cause all of society's problems. But every misogynistic piece of shit I've ever met was a lot closer to his mom than his dad...in fact she instilled his "values." Society makes people pathological and most pathological males are the product of their families, primarily their mothers, not a product of

            • by Kartu ( 1490911 )
              Dafuq does any of this have to do with violent crimes?

              Shit like that is reported to the police, not posted anonymously on "share your grievances about your ex" platform.

              Anyway, as far as DV goes, the most violent to least violent groups look like this:

              1) Lesbians
              2) Heterosexual pairs (where 70% of non-reciprocal violence is committed by female side)
              3) Gays

              A "fun fact": the founder of the first (western) shelter for the victims of DV, had receive death threats from "radical feminist" for stating that women
              • ... because sexual orientation is data collected when charging violent crimes? I'm not sure whether sucking at thinking prompts a lack of self respect or the other way around but you have a problem with both.
            • Fearing for your safety in general is not an excuse for breaking the doxxing law, privacy laws, digital harassment and other laws.

              You cannot use "feelings of safety" to justify large scale violations of those laws.

              You open the floodgates to licensed professionals who systemically deny access to housing on the basis of unverified data and other discriminatory effects - https://chicagorealtor.com/mem... [chicagorealtor.com]

              "In seconds, with as little information as a phone number or name, you can verify a prospect’s identit

          • by Kartu ( 1490911 )
            Males also account for the majority of the violent crime victims.

            And there is that peculiar bias in the judiciary system, that "for some reason" is more likely to send perpetrator to prison if i tis a man. Oh and the sentence also gets longer.
            • The point is that Tea was a doxxing, online harassment, privacy law violating app used by women who supported an app used for violating laws and harassing men.

              The same criticisms are found for the harassment actions originating from 4chan.

              Avoid the "men commit more" and other deflections. The Tea app was used by women to do online harassment, doxxing and violate privacy laws.

          • And yet when (largely men) want to punish bad actors, it's (largely women) who stop them.

            Men generally favor capital and corporal punishment, women and low-testosterone men generally prefer forgiveness, probation, rehabilitation, counseling.

            You'd think men would be considered to know the best punishments for men?

    • Then why haven't you produced it?

    • by TWX ( 665546 )

      Really, TeaOnHer, excluding gay guys? Where's the progress? I demand an AI coded gossip site for everyone, about everyone! One with a monopoly on gossip that's the result of capitalist ravenings, run by an egomaniacal psychopath as it expands into vague super conglomerate who's only reason not leak all my info is that they can charge for it if they don't; now that's progress!

      Do you think that any of this crap has anything to do with progress?

      You know what this is? This is that scene from Amazon Women on the Moon where Steve Guttenberg's character goes to pick up Patricia Arquette's character for a date and the background-check teletype machine gives her red-flags about him based on input from prior dates. Someone took a joke from a movie and tried to make a real service. Then someone else has reactionarily created a distaff-counterpart to that joke of a real service. And

  • by phantomfive ( 622387 ) on Monday August 18, 2025 @04:10AM (#65596734) Journal
    ...Then asshole things will happen to you.

    The people who make apps treating others badly don't care if their customers get treated badly. Corporate culture tends to treat customers not great, but these kind of people do it on a speedrun.
    • by Shaitan ( 22585 )

      "people who make apps treating others badly"

      That is a fair cut at both the apps. The sour grapes in the Cosmo article over the male counterpart is hilarious though.

      • by phantomfive ( 622387 ) on Monday August 18, 2025 @04:57AM (#65596780) Journal
        Summary of the Cosmo article [cosmopolitan.com]:

        "Women created the Tea app for safety and males created TeaOnHer to talk shit...Naming and shaming key offenders arms women with the information they need to protect themselves...We made an app to protect ourselves, and they made one to violate us."

        I offer no judgement as to whether the app named "Tea" [urbandictionary.com] was designed for gossip.

        • by DarkOx ( 621550 ) on Monday August 18, 2025 @08:30AM (#65596986) Journal

          "safety" should be treated as a watch word at this point. Unless it is in reference to something you might address with proper grounding, a hard hat, seat belt, life jacket, etc.

          "Safety" when used in the context of people boils down to, someone I don't like, a thin excuse for race, age, sex, etc-isms. In all these context the persons saying how they "feel unsafe" is almost always the most venomous serpent in the room. I am not saying the world isn't a dangerous place, it is. Trust

          These "Tea" apps are the perfect embodiment of this culture. Its lets bandy around a bunch of BS about people because they said something that seemed a little off once; behind their backs.

          • by Shaitan ( 22585 )

            ""safety" should be treated as a watch word at this point."

            Right, there is already a place for them to look up information to keep them safe. It's called the sex offender registry but unlike "Tea" people are entitled to due process before you slap their name on the list and destroy their reputation and potential relationships.

        • by Ol Olsoc ( 1175323 ) on Monday August 18, 2025 @08:31AM (#65596990)

          Summary of the Cosmo article [cosmopolitan.com]:

          "Women created the Tea app for safety and males created TeaOnHer to talk shit...Naming and shaming key offenders arms women with the information they need to protect themselves...We made an app to protect ourselves, and they made one to violate us."

          I offer no judgement as to whether the app named "Tea" [urbandictionary.com] was designed for gossip.

          If there are men actually abusing women, what is the rationale to call them out online instead go going to law enforcement?

          One of the key issues with these things is that they use things that happened in past tense. sometimes years.

          SO was sexually assaulted and reported it within hours after consulting with me. When immediately reported, you'd possibly be surprised how quickly law enforcement acts. You'd possibly be surprised at how they believe it when the act and the response is immediate.

          And all that said - yeah, the reports are that it morphed into gossip. the problem is the definition of abuse. There were reports of being in a situationship where after "breaking up", she was angry, so doxxed the guy. Then some others became sexually interested in the guy.

          Point is, if actual abuse happens, there is a solution - immediate reportage.

          • by phantomfive ( 622387 ) on Monday August 18, 2025 @10:23AM (#65597252) Journal
            Yeah, I agree with you here. I'd like to see a scientific analysis of how much it protects people and how much it's just gossip.

            This story suggests that it does actually help some people [usatoday.com], but for other people it's definitely just gossip.

            The name of the app suggests it was primary written as a way to gossip.
            • by Shaitan ( 22585 )

              Zero. They are basically claiming it as a sub for the sex offender registry. Right, one where you can destroy the reputation of anyone you are angry at without due process.

              The platform and the people using it to post negative information should be sued into oblivion.

              • Right, one where you can destroy the reputation of anyone you are angry at without due process.

                It would be interesting to see an analysis of how often that happens, too.

                • We've had 20 years of congressional hearings and government investigations on how Facebook and other social media companies are supposed to protect people from harassment. There are multiple state laws for this as well.

                  Rarely happens, never happens is another deflection.

                  • ok I don't see why you expect congressional hearings to do anything. That's on you.
                  • by will4 ( 7250692 )

                    Simply "rarely happens" and "never happens" are used to deflect, ignore and dismiss issues affecting one group of people.

                    That keeps the conversation, news, government funded programs, and laws focused on correcting perceived, real or imagined issues affecting the favored group of people

          • When an app is used for online harassment, doxxing and privacy law violation of attractive men because they declined a second date, did not text someone back fast enough, declined an interested woman, etc. the app is an online harassment, doxxing and privacy law violation app.

            Simple questions:

            - Ask the Tea app user if it is doxxing, online harassment and violating privacy laws is OK in general.

            - Ask the Tea app user if it is OK for the Tea app to locate the men being harassed, doxxed and disparaged and give

            • When an app is used for online harassment, doxxing and privacy law violation of attractive men because they declined a second date, did not text someone back fast enough, declined an interested woman, etc. the app is an online harassment, doxxing and privacy law violation app.

              This. Some women have some pretty exacting standards, and some of them, like the ones you point out are petty, like demanding immediate response to texts, or simple rejection. That is no reason to Doxx a guy.

              Simple questions:

              - Ask the Tea app user if it is doxxing, online harassment and violating privacy laws is OK in general.

              - Ask the Tea app user if it is OK for the Tea app to locate the men being harassed, doxxed and disparaged and give them the information on all of the women posting against him in case he wants to take legal action against untrue claims and unprovable claims.

              Then it's different somehow... 8^)

              But it is fascinating to see the double standards, people defending Tea as something very important and needed, while going reeeee! about Tea for the oppressor (aka men)

              Meanwhile, I stand by my claim that Tea for women is just an attempted reboot of #metoo. Somethi

        • by ceoyoyo ( 59147 )

          Clearly Cosmo did their background research. The Tea app was created by a guy named Sean.

    • by mjwx ( 966435 ) on Monday August 18, 2025 @08:17AM (#65596970)

      ...Then asshole things will happen to you.

      The people who make apps treating others badly don't care if their customers get treated badly. Corporate culture tends to treat customers not great, but these kind of people do it on a speedrun.

      You reap what you sow.

      The information shared on these platforms is largely written by people with a grudge (against the person or the gender, or both) so the information is inherently untrustworth to begin with. This kind of thing is for people with low EQ, no empathy and far too high an opinion of themselves (erm... well and truly up their own arse). Ultimately it's self destructive.

      However you've got to be pretty dumb just to sign up for it... Using a real driving license, people need to become more weary of who and what they give their PII (Personally Identifiable Information) to... Not just dodgy organisations like this but also organisations who are legitimate but doing security on the cheap... Like loyalty programs. British supermarkets Marks and Spencer as well as the Co-op had their loyalty programs hacked, North American air carriers Hawaiian and WestJet as well as Australian carrier QANTAS had their frequent flyer programs compromised. What do these five have in common, they were believed to have been compromised by the same group. What is fortunate about this is that the loyalty programs were run externally or at least separate from the commerce platform, so if you've flown with QANTAS but weren't a frequent flyer member you're safe... But if you are a member the attackers know your name, address, phone number, email, shopping/flying history as potentially a lot of other PII such as age, gender, birth date, passport number, et al. Things like loyalty programs are cost centres, so they get run as cheaply as possible (also makes it easier to legally sell to advertisers). We need to think about how secure our PII will be before you give it out. It's a pain in the arse to get a new driving license, it's a lot more difficult to get a new postal address, gender, age, name or face.

      • The Tea app only became a problem worthy of media attention when the people being doxxed were women.

        The Tea app being the #1 in the app store with millions of downloads was never a problem worthy of media attention when it was used for online harassment and doxxing of men.

        More generally, the media attention has identified "the favored group (women) whose safety and privacy is important and worthy of legal protection" and "the unfavored group (men) whose safety and privacy are not worthy of legal protection.

  • In fact, its rating system only includes a single question:

    1) Does she put out on the first date?

  • What a shit show (Score:5, Insightful)

    by zawarski ( 1381571 ) on Monday August 18, 2025 @05:47AM (#65596816)
    Dating has become. Glad I don't need to navigate this hellscape.
    • Dating has always been like this, the only difference is with it all being in apps everyone now knows about it. The people who use these apps are in the minority.

  • Re: (Score:5, Insightful)

    by kurkosdr ( 2378710 ) on Monday August 18, 2025 @06:12AM (#65596828)
    I don't believe in Karma, but man, two websites designed to help people dox and gossip others ending up leaking their users' real ID along with recent selfie photos is a fun coincidence.
    • I know the phrase spilled the tea as means gossip but that's not what the app is for. I don't obviously use it so it's possible that's what it's being used for but that isn't its intended purpose.

      The intended purpose of the Tea app is for women to share stories of men they have dated both good and bad.

      I'm guessing that there aren't a lot of girls here. I would frankly be shocked if there were any.

      Try to imagine what it's like to be a girl. You are surrounded everywhere you go by people who are t
      • by Anonymous Coward
        As much as you try, you will *never* know what it's like to be a woman. Embrace your homosexuality, but please, PLEASE do not cross that line.

        ~Laura~
        • I get that you have a complete lack of empathy.

          And yeah you are correct I will never completely know what it's like to be a woman. I'm a big tall guy who despite being harmless looks scary as hell in person.

          I am for example aware that if a woman saw me in a parking lot alone at night she might walk a little faster to her car.

          You're probably a weak ass nerd too if you're hanging around this site because frankly we all are. Big tough alpha males don't much hang around here. It is literally a site
      • Regardless of the tea app, women would do well to get a gun and learn how to use it.

        Self-defense classes wouldn't hurt either.

      • If the app was designed to only allow women to warn other women about men who seem cool up front but you wouldn't want to be alone with (or at least had moderation rules enforcing it), I would agree, but in practice, the app was mainly used to gossip people.
    • I'm surprised both sites weren't put up by the same people/company. Slander as a business model is about making $$$ .. like high level drug dealers ... they don't DO drugs, they just SELL drugs
  • Here, let me show you my shocked face
  • Teabag (Score:5, Funny)

    by too2late ( 958532 ) on Monday August 18, 2025 @06:54AM (#65596886) Journal
    I'm disappointed the male version wasn't called. Teabag. They missed an opportunity there.
    • by TWX ( 665546 )

      I guess "grouseoverabeeraboutbitches.com" was already taken.

      Because I can only expect that's the actual attitude of the majority of those who've signed-up for such forum.

  • by HnT ( 306652 ) on Monday August 18, 2025 @07:24AM (#65596914)

    It is almost unbelievable how in todays world people are gladly and voluntarily leaking their most private data and information, sharing it with everyone and anyone that simply presents them with any kind of web form or file upload.. this must be the StaSi wettest dream, an entire population conditioned to spill all the beans always everywhere and without any limits or restraint fuels by an insane culture war, plus private camera systems supplementing the gov surveillance and everyone is wearing st least one tracker, big and surveillance system in their pocket.

    • Didn't happen by chance, either. If you don't believe me, look up what's happening with age verification laws. Data brokers like Equifax (under the guise of the AV lobby) are lobbying for ID verification on VPN services. The current privacy hellscape is engineered.
  • by bleedingobvious ( 6265230 ) on Monday August 18, 2025 @07:26AM (#65596920)

    Shoddy coding and security flaws

    It's called VIBE CODING. You're just gatekeeping!

  • 4chan is a "right wing web site"?

    • by _merlin ( 160982 )

      It is these days. After m00t quit and reddit banned r/TheDonald, 4chan turned into a Republican echo chamber.

  • You know who feels sorry for men engaging in highly negative feminine behaviors?

    Absolutely nobody.

    They need to stop watching Hollywood/Corporate programming and get right with reality.

  • those that know they've been broken into and those that don't
    • I thought I was in both of those camps with both of my email servers, as most of the email addresses that I've ever used on online services (I have a different email address for every service I use) were getting spam, with the notable exceptions of Slashdot and Soylent News. I even went so far as to wipe and reinstall my email servers as a precaution.

      To be sure, I created new email addresses on my email servers, and those addresses are never used for anything. They exist in /etc/aliases, but that's the exte

  • Is that Apple doesn't have a good (or any?) security scanner for their top apps.
  • It's the only way we will get laws with strong enough punishments that these stupid startups will actually fear launching insecure services. If there are no repercussions then this will keep happening forever.

  • You should be able to sue these people for slander.

    I used to give anybody a try when dating, but after dating a few psycho women who decided they were going to "ruin my reputation" because it didn't work out, I am much more picky now. I also block people these people when I see them online, because of these slandering apps and their ability to maliciously fuck with you by abusing reporting functions.

  • by thecombatwombat ( 571826 ) on Monday August 18, 2025 @02:18PM (#65597880)

    I mean wait, kind of the quiet but most interesting part of this:

    One of the lawsuits names 4chan and X as defendants, *alleging that they allowed bad actors to spread users' personal information*.

    It might be the most ironic lawsuit ever. How many people can turn around and sue . . . Tea . . . *alleging that they allowed bad actors to spread users' personal information*.

    This is truly the most ridiculous timeline.

  • a new competing app

    How are the two apps competing considering they have (almost) completely different user bases?

  • No ody fucking cares. All apps are dogshit. Fuck off
  • Alfalfa and Spanky had the he-man woman-hater's club. We have these two atrocities.
    bleah.

Moneyliness is next to Godliness. -- Andries van Dam

Working...