A security failure in a safety app creates the opposite of safety (thx 4Chan)

[editor’s note: this is an anonymous submission from an anonymous friend of the Rat. Information is provided as is with no warranty]

What Happened?

Last week one of the more dangerous hacks happened.

Tea, an application used by women to trade information on potential harms and dangers, had a major security lapse.  Their database was left open, and hackers who use 4Chan to communicate now have copies of the drivers’ licenses and selfies used to validate that they were female.

This is likely one of the most consequential security lapses we have ever seen because:

• The lack of security puts the information of over 1 million people in the hands of motivated people with an agenda who will use this information to “dox” and harm.  

• 4Chan is one of the places where people who actively act out against women spend much of their time online.  The users of this site encourage each other to act out.  Giving them the personal information of thousands of women is going to result in continual threats to their identities for the rest of their lives.

• 4Chan is one of many sites where people have been “doxed” over the years.  Kiwi Farms, 8Chan/8Kun, and many others have done this back to the BBS days.

• Many of the 4Chan dwellers align themselves with the current US Presidential administration, which has actively been pursuing an agenda aimed at suppressing LGBTQ+, minorities, women, and their opposition.

• This sends a signal that organizing to protect oneself will make you a target, and that your information will be used against you with little/no recourse against your attackers. Already there’s been many people playing down the effects of this attack and blaming the victims.

• Attacking this site sends a message that defending yourself and speaking your mind will lead to greater harm.

• The attackers are empowered because of who is in power and because they know they will likely get away with it.

Why did this happen?

This happened because the site required a photo ID and selfie, and did not delete them immediately after verifying.  There is no reason to keep this information any longer than needed.  Even GDPR specifically indicates that personal information only needs to be kept for the duration that it is needed.  

Keeping information in a cloud service without security is a broken record at this point.  This has been an issue that has befallen the largest companies.  This does not excuse the owners of Tea for not doing right by their customers and exposing them to significant ongoing harm.

The sites that host the attackers don’t log this info.

How to move forward?

You cannot assume safety whatsoever.  Assume that there will always be people within the communities looking to attack you. Assume you are a target.

• Leverage invite-only communities of interest where people know each other to invite new members in

• Utilize VPNs or proxy servers to access any shared information sites indirectly

• Never use real names in the communities or sites

• Use secure messaging services to contact anyone else directly

• Only give out your personal ID to sites that will delete them immediately after usage

• Leverage two-factor authentication using an authenticator app such as Microsoft Authenticator, Google Authenticator, or Duo everywhere possible.  This means for home phone services, Google Voice, banking, brokerages, utilities, and employee benefits.  Do not use SMS-based authentication whenever possible.

• Use a security key, such as a Yubikey or Google Titan Key for all social media, email, and Google services.  Keep a backup or two.

• Use Google Advanced Protection Program for all Google Services, especially Google Voice and Gmail

• Use a Google Voice or similar phone number to call or text people you do not know, or for services that require SMSfor two-factor authentication

• Leverage Advanced Data Protection for iCloud for all Apple devices

• Use Advanced Protection for Android for all your Android devices

Why am I doing this?

I am doing this because I don’t like seeing people getting hurt because they tried to protect themselves and others and want to assist.  I don’t like that people are using technology as an aid in oppressing others, especially those who have been marginalizedand used as scapegoats to advance hateful agenda.  I am no saintand have been the opposite.  I believe the right way to do so is to give people the means to protect themselves and others who are in bad situations.