The more than one million messages obtained by 404 Media are as recent as last week, discuss incredibly sensitive topics, and make it trivial to unmask some anonymous Tea users.
It is negligence, but information workers have very little regulation when it comes to handling personal data (outside of specific fields, like healthcare and finance).
I say this as an information worker who handles a lot of personal data. Worst case scenario, I get fired and can’t use them as a reference. Unless I’m intentionally stealing data and using it for crimes there’s no risk of criminal penalties.
We needed privacy laws 20 years ago but the tech bros assured everyone that it would be fine and for a long time they were mostly responsible with our data. But now we’re well into the enshittification of the Internet and the lack of regulation is allowing these kinds of harms to become common.
Though, in a sane regulatory framework Tea wouldn’t be allowed to exist in the first place. The entire point of the site is to doxx people and share personal details about them without their consent.
At least some of the negligence is on Google, for the atrocious default security settings in Firebase
The vulnerability is called hospital gown because they leave the back end wide open by design. It’s not even a traditional vulnerability, since it’s technically working as intended
In any other engineering discipline this would he negligence.
It is negligence, but information workers have very little regulation when it comes to handling personal data (outside of specific fields, like healthcare and finance).
I say this as an information worker who handles a lot of personal data. Worst case scenario, I get fired and can’t use them as a reference. Unless I’m intentionally stealing data and using it for crimes there’s no risk of criminal penalties.
We needed privacy laws 20 years ago but the tech bros assured everyone that it would be fine and for a long time they were mostly responsible with our data. But now we’re well into the enshittification of the Internet and the lack of regulation is allowing these kinds of harms to become common.
Though, in a sane regulatory framework Tea wouldn’t be allowed to exist in the first place. The entire point of the site is to doxx people and share personal details about them without their consent.
At least some of the negligence is on Google, for the atrocious default security settings in Firebase
The vulnerability is called hospital gown because they leave the back end wide open by design. It’s not even a traditional vulnerability, since it’s technically working as intended
In fairness if you leave Firebase in its default settings it won’t shut up about it.
You get warnings on the website, and constant emails telling you that you’re being a pillocked.