Comment by gaiagraphia | Hacker News Reader

Comment by gaiagraphia | Hacker News Reader

Not sure, but think this may have been the original thread: https://archive.4plebs.org/pol/thread/511313558

>DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!

>Tea App uploads all user verification submissions to this public firebase storage bucket with the prefix "attachments/": [link, now offline]

>Yes, if you sent Tea App your face and drivers license, they doxxed you publicly! No authentication, no nothing. It's a public bucket. I have written a Python script which scrapes the bucket and downloads all the images, page by page, so you can see if you're in it: [pastebin link]

>The censoring in picrel was added by me. The images in the bucket are raw and uncensored. Nice "anonymous" app. This is what happens when you entrust your personal information to a bunch of vibe-coding DEI hires.

>I won't be replying to this or making any more threads about it. I did my part, God bless you all. Regards, anon

Being so careless with people's personal data should be a major crime, tbh. If I manipulated thousands of people to let me scan their passports and various other bits of personal info, then just left the copies around the city for people to find, I'd be prosecuted, and rightfully so.

The irony of a doxxing app being wrecked by the anonymous is too much for me!

This is not irony.

California car dealerships are sometimes visited by the DMV inspector, an actual officer of some kind technically.

If they find any driver license photo copies, even turned over inside an unlocked desk drawer, the fine to a dealership is $10k per occurrence.

Is it weird that internet companies do not have this kind of oversight?

how much money can their lobbiests throw at the gub'mnt compared to the US car dealership associations?

Car dealership associations have pretty impressive lobbying capabilities. In many (most?) states you must buy a new vehicle from a dealer - it's against the law to buy direct from the manufacturer.

FYI the original post of the thread is now "This post is not available at this time."

> Being so careless with people's personal data should be a major crime, tbh. If I manipulated thousands of people to let me scan their passports and various other bits of personal info, then just left the copies around the city for people to find, I'd be prosecuted, and rightfully so.

Good analogy. Also, this is the main point of the EU GDPR.

It is, in the EU.

Are you being serious right now? No one forced those people to upload their data to this sketchy site. Everyone with one brain cell would know the repercussions of uploading IDs to a no-name site

Exactly, this is why if I walk down a street that looks sketchy and I get assaulted/robbed, it’s not a crime and no one can be charged!

Any bad behavior should be legal if the victim should have realized the warning signs.

i think you are assuming a level of computer literacy that doesn't exist in the general population. most people seem to not actually know where data goes when they put it in their phone, how that data is used, or what actually happens on computers in general. They mostly appear as magic to them.

I am being downvoted for being real. How is the general populous not aware of it? That's wild. Again, you have to be aware of this. It's like privacy 101

The general population hasn't taken privacy 101. They get asked to email their id to their doctor. If turns out the doctor also hasn't taken privacy 101.

Naw. That’s victim blaming. People have a right to believe that if an online service or app requires identify verification that the data will be protected. If you provide your credit card to uber you assume they put a password on the database and do the things required to protect it.

The idiot no-technical founder failed to do even the most simple and obvious data protection.

Vibecoding is not an excuse. Ask how to secure the data and the AI will answer.

The problem is as follows: There is a subset of the population that tends to trust things you say, and this subset is fairly large.

The solution is that we need to make it so that the majority no longer trusts anything people say.

There will be no negative knock-on effects for this, I'm sure.

--

To be less glib, I don't really see a good outcome of this in the long term. If everyone developed the right level of op-sec given the amount of bad actors on the internet, we'd effectively never communicate with another person again.

"Do not share personal information online" is a warning that has been heeded since the internet was created. You don't need tech savvy to understand that message, just as you don't need to know anything about zoos to understand "Do not enter the lion cage".

With tech savvy it is possible to understand the dangers well enough to dismiss the common advice in certain cases, but if you don't have it — you had better listen to what others are telling you. If you wish to dismiss it, you are on your own.

I can totally imagine our intel agencies and foreign state actors having a field day with this, as mirrored here: https://www.youtube.com/watch?v=bWTyvvb8GFs

Victim blaming isn't right. Yes, they could have exhibited more caution. No, it's not their fault.

It's the only way people learn. Real world is not going to hold your hand, real world is full of facebooks, not signals

Vigilante justice is wrong, but at the same time, I have a hard time calling registered users of a Kiwi Farms clone "victims."

Of course it is right. Victims need to be blamed, else they'll just stupidly do it again. That’s what “blame” is for. But, sure, if 'Tea' snuck up behind these people then there would be some room for sympathy.

But this case is more like you sticking your fingers into an electrical socket, after being warned continuously not to do that, and then crying that it was the utility company's fault for putting something dangerous in your face.

We've been told since the advent of the internet to not share personal information online. If you want to take the risk, you have to accept the consequences. However, in this case the story is even worse as the intent of these people was to violate that rule not just for themselves but for other people as well.

If I lend you my car, and you park in Berkeley leaving your laptop open on the passenger seat... Yes it's your fault my window got smashed and I'd like you to pay for it. Is it your fault your laptop got stolen? Maybe, that's just semantics. But my window being broken is your fault because we all know thieves exist and look for items on seats.

So if you upload your id to a flash in the pan website, who's fault is it when the rookie website turns out to have expectedly low security?

The car was at least be locked and have windows closed. In this case, it was an unlocked car with doors and windows open.

Look at what this site does.

You upload other people’s personal information on it to run background checks on them.

So, many of the victims probably haven’t heard of the company.

"No one forced these people to get on that non-airworthy airplane."

People should not have to understand every technical field in order to participate in society. This is what regulatory bodies are for.

Reply on news.ycombinator.com