72,000 Women’s Data Leaked on the Internet

I honestly think there's there's a touch of misogyny in in why this blew up as well. Don't sleep on the fact that there are so many apps being breached. So many massive apps. Someone who was definitely lazy were the developers of the tea app. Oh yes, good segue. A tea app is basically an app where um girls could rate images of guys and write comments and give like green flex, red flags. Um, and basically what they did is an Firebase ops and that opsy leaked um 72,000 information about people including messages and images and location and location pretty much everything I think IDs as well and it what's also really yeah it's really bad because this app was made with the mission to uh help women or like protect women. It's essentially about rating bad guys in a way or like be aware of bad guys in the dating world and talk about them and you you know people have different opinions about it but but it actually hurt them. Yeah, it totally hurts. Yeah, it it's important to say that this is well, first of all, the the uh CEO is a self-proclaimed uh C CEO of a digital company who's only done six months of, you know, coding boot camp, right? So, he wore that with pride on his LinkedIn profile. But this is this is a breach that happened on all accounts that existed before February 2024. So any accounts that were created after that aren't affected by this breach. But ultimately it's the it was two there was actually two breaches. There was it was a two two-step program. The first one was that they found all of just the images the the um the verification images of the people. So when you sign up you have to take a selfie of yourself holding your ID and that verifies that you're actually a girl and that you're actually a human. There were it was promised that those images would be deleted but clearly not. It was a public bucket stored on Firebase and so and because of the way the architecture of Firebase you're able it's kind of like an API and storage system built in. Normally on an app you separate those you have an API layer between the two. you never hit the you never hit the uh database directly. But with Firebase, it allows you to hit the database directly and if you hit a certain URL, it will list out all of the items in that bucket, which is something you can't do or you shouldn't be able to do anyway. So, what's someone done? They found the bucket and then they hit the they found an image, then reverse engineered that to be able to hit the bucket. They got their list of images and then just downloaded all those images. So that was the kind of first step of it. And then someone found the actual um information on these people and there was there was a few apps created. There was a a location app. So they pinned everyone's location in North America to find out where they all live. And there was the funniest one which you know I don't know how I feel about it but there was is a website ranking these women based on how they look and you know using cool man very cool very cool and then there was a demographic one someone I even got a uh I've even got the the tweet here like someone put some demographics um of the people of the women that they uh found you What this means is I'm not too sure, but the point is it's that the internet had a lot of fun. As cruel as it was, the internet had a lot of fun with these. Um, it was a bit of a lame apology saying I've got the apology here as well. Is this a big company or is it just that they happen to have tons of users? Yeah, I don't know the size of the company. No idea. But it was doing okay. I mean like I mean they had a wait list but this is like 15,000 likes. It looks low effort the image. This is their vibe though. This is their vibe. I don't know whether it's like I know what you mean. I I I would tend to agree but you can tell their design is a bit rash or and whatever. But this is the interesting thing. This data was stored to meet law enforcement standards around cyber bullying prevention. It didn't say anything about like data protection or anything like that. So yes, maybe I don't know what how you'd store an image to prevent cyber bullying. Maybe it's maybe that maybe that is simply that another user cannot access your imagery through their account. Maybe that's what that means. But cyber bullying prevention isn't a, you know, wellestablished standard in the internet world which prevents the hacking of data. you know, that's why the ISO standards are in place. So, it's um a bit of a cluster to say the very least. There was speculation as well that it was a vibe coded app obviously because it's like in in the midst of all this vibe coding like slot that's being put out, but again, because this is pre2024, like February 2024, this definitely wouldn't have been a vibe coded app. I would not say this is a specific issue to te I think this is a general issue with Firebase. Um, Theo made once a video about Eva. Uh, she's like a umi cyber like cyber security specialist and she once run a scraper through the entire web and found like 6 million affected Firebase in that sense with some kind of security issues where you could access the data and it's like people just don't know how to use Firebase and Firebase is like a gun which easily lets you shoot in a F. There was a lot of comments as well about the fact that Firebase pesters you because it's it's not trivial. Well, it is trivial, I guess, but like it warns you several times that this is like your this is wide open. You haven't got security rules and things like that. It's it's not a great platform for proper app development. Like I say, it allows you to access the database directly, but there are security rules in place. And this was it last year that there was um because you have to put the API keys in the front end of your website. Yeah. And you have basically like security rules where you write a JavaScript like syntax. It's not JavaScript. It's just a JavaScript like syntax. And then you have to write security rules. And these can be a bit more comp complicated because you have to check I get the user ID and I have to check does you have access to this resource and it's like yeah just have a server. Here's a question I was wondering. Why is Superbase any different? Because I can access the database directly from the front end. I don't need to have some sort of API layer to query the database. Are you have you are you familiar with Superbase? Have you used Superbase? A bit. But the reason why I like Superbase more is generally from what I know I may be wrong on this, but from what I know and you still can easily deploy functions with Firebase. If you want to deploy functions, you have to then go to Google cloud and do everything like it generally doing things properly takes a bit of more work. That's why I first like Firebase more. I don't use Firebase that much. The second thing is um I if I recall correctly in Firebase you have more security like generally and it's like harder to shoot yourself in the foot. I may be wrong at it but from what I recall they generally have just more uh just better security. Um well I you can yes you could you've got the functions aspect but like again I can just query the database um and you use policies to like prevent you know and and Firebase has its own interpretation of policies and things like that but the point is is like I can access superbase in the same way that I can access uh I don't need to go in through any sort of API layer. I think he's taken it down. He had in his in his uh thing here, he said like six months of coding under his belt, which I he probably did not develop this app. Let's be clear. Like I just think that that was just being taken wildly out of context cuz it's whatever. But this is one way of becoming famous. Make a super bad app, not secure at all, and you'll be famous. I mean, there's tons of them out there. And as you as you said like the again last year there was a massive there was so many um breaches from just specifically the ruling around Firebase apps and the databases and object storage and stuff like that is just so clunky and easy to miss. Not easy to miss but just like you know most people just like leave open or whatever. So yeah um there's tons of apps out there. I think this was just I I honestly think there's there's a touch of misogyny in in why this blew up as well cuz first of all it's like with the tech world we're ruled by guys so it was easy for us to you know what you know whether you have your own personal opinions on this type of app but there are don't don't sleep on the fact that there are so many apps being breached so many massive apps it's uh it's a catastrophe this is part of a larger conversation on my show command AI which we stream Live every single week. We discuss the news and all things related to AI in the world of design and web.