The Tea Breach Just Keeps Getting Worse

0:00YubiKeys are made by Yubico, a company with Swedish roots and HQs and manufacturing centers in both Sweden and the United States. YubiKeys come in a variety of small form factors with Lightning and USB-C connectors. They're small, sturdy, and easy to use. They stop phishing attacks and account takeovers before they start using modern phishing-resistant multi-factor authentication, or MFA, which is just a fancy way of saying they're a proven security solution that cannot be bypassed by hackers or other malicious actors. Unlike basic forms of MFA, such as SMS, which is text messages, one-time passcodes, and mobile authenticator apps, YubiKeys help businesses of all sizes stay ahead of evolving cyber threats and regulatory requirements, protecting some of the world's largest banks, telcos, and tech companies, critical manufacturers and energy concerns, and government agencies and non-governmental organizations.

0:51YubiKeys are also great for regular people and everyday users. YubiKeys help people protect their email, financial and social media accounts, password managers, productivity tools, developer tools, and so much more. Learn more about how YubiKeys secure the applications, services, and accounts that people and businesses of all sizes rely on every day at yubico.com. That's Y-U-B-I-C-O.com.

1:20Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds both online and IRL. 404 Media is a journalist-founded company and needs your support. to subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph. And with me are 404 Media co-founders, Sam Cole. Yep. Emmanuel Mayberg. Hey. And Jason Kebler. Hello, hello. Okay, final reminder. Last chance. literally because it's i mean if you're a subscriber you get this early i think you get this on tuesdays if you're a free listener you get this the day after that's another benefit of subscribing you actually get it early and everybody else july 30th wednesday 6 p.m at rip space in los angeles we are having a live event um it's going to be uh me sam jason and then we're also going to be joined, I believe, by Dexter Thomas.

2:29Right, Jason? Do you want to explain what we're going to be talking about and what we're doing briefly? Yeah, so we're going to be talking about our reporting on the technology that powers ICE. We felt that was appropriate to do in Los Angeles because a lot of this technology is being deployed in LA. And so our friend Dexter Thomas, who used to work with us at Vice and now has a podcast called Killswitch, but also is an independent journalist like us, will be with us and talking about his reporting on the ground because he went to a lot of the protests and filmed at a lot of the protests in LA.

3:06So we're going to do that for like an hour-ish. And then the rest is going to be a party with a DJ and beer and wine and just hanging out. And it should be fun, should be a good time. So if you're on the fence, please come. It will be fun. You can find tickets at bid.ly slash 404 rip space or on our website. And again, if you're a subscriber, you get free tickets. So on our website, there's a code. Just scroll back to where we posted about the event. You can find the code. Yes. All right. That all sounds good. Looking forward to seeing everybody there. Let's get straight into this week's stories.

3:48The first one, Emmanuel's the first byline, and I helped out on it as well. But Emmanuel, the headline is, Women Dating Service App T Breached Users' IDs Posted to 4chan. I guess, first of all, Emmanuel, how did you get this tip? This was on Friday, I believe, and it was pretty fast moving. Can you walk us through when and how you got that tip and what happened next? Yeah, sorry, I have to correct you. You call it a dating service app, I think. It's a dating safety app, which is an important distinction. It's like an app where women are invited to, they thought, safely exchange information about men that they want to date or are dating.

4:41and the way this happens I believe this was Friday morning and I just get a call on my phone and I can see that it's to my Google voice number which is kind of the number that I've shared previously for people who want to send us tips and I don't always pick that up but I picked it up for whatever reason that morning and it was like a good Samaritan I would say somebody who is his day job is IT adjacent. And he sounded pretty frazzled and panicked. And he was like, Hey, there's something going on in 4chan. You have to see it. I'm sending you some links. And I was like, I couldn't really understand.

5:22But then I went to 4chan. And by the time I got there, it was obvious that this app called T had a major breach that people could get users' images which the app asks people to upload selfies or previously photos of their ID in order to prove that they're women because it's an app for women. And people could get their hands on thousands and thousands of those images, some messages, and some other data. We can get into all of that. And not only was it clear that it was available, people were already making it available off their app. So it's like when I got there, people like anybody could go there, could get into the cloud computing.

6:18It was a Google service that the app used to deploy the app. People could like write through that. Because it was exposed. It was fully exposed, yeah. But people were already archiving it and using the images and mocking these women. It was like, the vibe was like, oh my god, this is really bad. And it's already way too late. It's like, as you know, Joe, you can discover a hack at several stages. It's like, it could be a researcher and they disclose it responsibly and then the company closes it. Or you can find it as a journalist because of a tip. And then you tell the company. or it could be a little-known vulnerability or one that only certain hackers are exploiting.

6:58This was open season. Everybody was in there and kind of gleefully taking advantage of it and making fun of the users. Yeah, I mean, one of the quotes, maybe from the original poster, I believe, yeah, I think it was them. I mean, their direct quote was in all caps saying, drivers licenses and face pics, get the F in here before they shut it down. It was, as you say, open season. And it wasn't just a quietly posted link. It was people explaining to one another, hey, here's a script to rifle through the metadata of the files. It's just a series of attachments and that sort of thing. And then people were using scripts to download those images in bulk and then making them available.

7:47And of course, I ended up downloading some of these, or I think all of them. I downloaded the entire dump once it was made available so I could verify. And I mean, it's a lot of data. It's a lot of images. And T later confirmed it was tens of thousands of people's selfies and their identity documents. Just to back up a little bit, Emmanuel explains what the app is. But Sam, you've covered these Are We Dating the Same Man Facebook groups. And this essentially is the appified version of this, or it came from this. Is that fair? And can you tell us sort of what those groups are a little bit more broadly?

8:32Because it's kind of the same thing, right? Yeah, I mean, I didn't get to use T before it went down. um so i don't know exactly what like the if it's exactly one-to-one the same thing but it's the same idea um it's definitely like so the are we dating the same guy groups women would post a picture of a guy usually or maybe a description of a guy but usually a picture and say hey i'm going on a date for example i'm going on a date with this guy tonight does anybody have any red flags and it's like red flags are like the code for like don't go or like we have information for you um on facebook this was happening with full names obviously people attached to it so um more risky but the groups were closed so ideally you wouldn't be able to get in if you were a bad actor but um yeah it's like a vetting thing where like you know you could say oh yeah this this guy i've been on four dates with does anybody else know him and someone's like that's my husband you know it's like that's an extreme case but like that does happen plenty um and that's the idea with the are we dating the same guy ones and then and men get super super pissed about the existence of those um those groups themselves and just are enraged that they're on them um and then obviously I think a lot of that rage is what we saw happen with the TAG.

10:01Yeah, I mean, can you just briefly elaborate on that? And I know I'm not really asking you to put yourself in the mind of a 4chan user necessarily, but you see I mean, it's an obvious question, but I'm going to ask it anyway. You see a correlation there between some men getting very, very angry when say their face is posted into one of these Facebook groups and 4chan users rifling through this database is that sort of like one in the same thing almost obviously one's a lot more extreme than the other ones but is it sort of the same sort of behavior what do you think yeah and i don't i mean it's it's just different it's not really more extreme i mean it's what's extreme is like guys suing these groups and like the administrators of these groups on facebook and saying you know i'm suing you for libel or whatever like defamation of which they've done my image which they've done um which is obviously uh a pretty serious reaction to having your picture put on facebook by someone else um but yeah i mean it's we saw like with tea in general people were like if tea went a little bit viral earlier in the week last week and people were talking about it even though it's been around for a while um and then a lot of people were like posting like these like satire or like maybe they were real.

11:20I don't know. Like fake apps that were like, like the flip side, like really being like really derogatory toward women and like saying like, we're going to put, um, you know, your faces in here. And after the tea hack, we saw like tea spill, which is like a hot or not game based on the hack images. It's just, it's all like, um, proving the point a little bit. It's like, yeah, like, Like, you know, women were warning each other about you. And this is your response to be, you know, horrible back at them. It's just like, that's, it's kind of like, okay, no wonder. But that was, I do feel like it's, it's all kind of connected.

12:04And it's all coming from like this online dating world of like, you know, guys that are dangerous to go on dates with very often. And women are the victims of violence on online dates quite often. So it's understandable that this exists. But the hack is definitely, I feel, a response to that. Yeah. And that website you mentioned, somebody had taken those exposed tens of thousands of images and you're shown two images, I think, and you have to select one based on their perceived attractiveness, like as you sort of hinted at, almost like the very early Facebook site from Zuckerberg, right? And that's got tens of thousands of rankings or something like that.

12:54So already the information is being abused in various ways. So that all happens. There's the media firestorm. We reveal and first report this data exposure. Then it gets worse. And the headline of this one is a second T breach reveals users DMs about abortions and cheating. Jason, it was actually you that got this tip. How did that come about? Yeah, so a researcher who we had done a story with back at Motherboard all the way back in 2016 reached back out to me and was like, it's not just this initial hack or this initial exposed database. The actual main database of T was exposed as well, which included presumably or seemingly all of the DMs, including things like usernames.

13:56It was searchable to some extent. So they were able to show us, there was like women talking about abortions that they had sought or that they had had, talking about, you know, cheating situations, like really intense situations that they had with their partners. Like it was very, very, very sensitive information. And so, you know, since you and Emmanuel had been reporting on this for a while, I passed it off to you to actually do the reporting and confirm the story because you've already very deep in it. But basically, this person is really good at decompiling information and sort of found that there was an exposed database, like a further exposed database that made the hack way worse than we initially thought.

14:43Yeah, whereas the first one was a Firebase instance. Again, while Emanuel was talking about Firebase, it's like app development platform by Google. And it seems that you didn't need any sort of real authentication to go in and get those selfies and id photos that sort of thing uh the way it was described to us by this researcher for this second data exposure was that any user's api key you know you make an account with a username and password or whatever and you're given an api key that's just how apps generally work right the way it was described was that any user's api key could query the entire database so basically you had almost like admin level access even though you're a random person who just downloaded the app and that's not good obviously that's really really not ideal when anybody can access all of that sort of information so the researchers sent us over all these screenshots and they were very interesting um but we need the data you know to verify what is going on here um of their own accord they had already downloaded um this information uh sent over to us and um kind of selfishly i very much enjoy these like reporting puzzles of we have this data we have to figure out and verify and prove it came from a certain service.

16:13For the first one with the driver's license photos, I downloaded the APK, I decompiled the Android app, and I found that, oh yeah, that exposed database in there, the same URL is in the app. So that was pretty good verification. For this one, with the more than 1 million messages, we went through, did get some phone numbers, texted some alleged users in there. One eventually got back to me and confirmed, yes, I am a user of T, but that was actually after we published. How we verified this one was that we took the usernames from the million messages, not all of them, just a random snapshot, and then I tried to make accounts on T with those usernames.

17:01And in every single case, that was not possible because their username was already in use, indicating that yes, these a million messages have come actually from the T app. So whenever we get data like that, and whenever we can verify it like that, I'm always supremely confident in the veracity of what we've got. Jason touched on this, but Emmanuel, you also went through some of the messages and we didn't quote really any um directly can you just explain a little bit more about why we didn't do that and maybe just a bit more on the sensitivity of these messages that you saw when you were scrolling through so we didn't quote anything because it is possible to word search the data that we got.

17:58And I was trying to explain this to my wife because I was talking to her while we were reporting the story. And she was like, who hacked into T? And that's an understandable question. And I guess the answer is like nominally, I don't know, some bad people who have 4chan accounts. But that is not the question or like that is not the problem. It's not that somebody, the story is not that somebody broke into T. It's that, I don't know, if T was a bank, they just like left the vault door wide open. And that's the real, that's the real offense here. And because of that, we don't know who else got their hands on this information.

18:40And we don't want to give specifics because we don't want to make that stuff easy to find. And we don't want to have that stuff easy to find because my poking around the messages, it took me like two minutes to identify someone because people are DMing each other. That's the kind of conversation that's in the data. And they're being very real and they're sharing real names and phone numbers and social media handles. So somebody is talking about the person they're dating being someone else's husband and them cheating. And some people were talking about abortions. And it was incredibly easy to find those people in the real world, just given the context of the conversation.

19:32Yeah. And so we do that. uh i contact t for comment about the exposed direct messages on saturday i tell them explicitly hey this research has found this um also found uh apparently the ability to send push notifications to more than a million people um which is kind of crazy that's like we don't even we barely even mention that but that's also wild um and i contact t as i said on saturday they don't comment specifically, just like we're continuing to investigate and we're not going to share more information at this time. We then publish on Monday and then very soon after they make a post on Instagram saying, we've just learned actually the direct messages were exposed, we're turning off DMs now and then send that statement to CBS News or various other people as well.

20:27To be clear, they did know since at least Saturday and And also to clarify, the researcher said their access to that database was cut off sometime late last week. If the access was still live, at least to our understanding, you know, we may not have published at that time. We don't just find a vulnerability or get told about a vulnerability and then go, okay, cool, and then just publish an article. Because that's going to potentially actually lead to more data exposure. as the best, to our knowledge, it was closed. And I think T just turned off DMs as an extra precaution as well. Very briefly, just last thing, Emmanuel, just before we were recording, I think we just published about a class action lawsuit.

21:17Do you just want to mention what that is briefly? I feel like that just happens now, right? That's just normal. Yeah, unsurprising, I think. but a law firm that specializes in data breaches has reached out and told us that they filed a class action against T. And yeah, I think that doesn't guarantee that that will go anywhere or that they'll be successful, but I'm not at all surprised that the complaint has been filed. They're expecting other complaints to be filed and they hope to kind of take the lead on that and have all those other lawsuits join them in the class action. Yeah, very, very standard.

21:59All right, we'll leave that there. I'm sure we'll continue to cover T, even though none of us had heard of this app until last week. It's a really significant data breach, so we'll definitely be following that. We'll leave that there, and we'll be right back after this to talk about... I mean, it's complicated. You're just going to see. Okay, we'll be right back after this.

22:36We all spent years working for a big company where we had no control over the business, its priorities, or whether we'd have a job that next week. We all took a big step by striking out our own, and now we couldn't be happier. We thought starting our own business would be overwhelming and confusing. But we found smart tools like Shopify, which have made things easy along the way. Shopify is the commerce platform behind millions of businesses around the world and 10 % of all e-commerce in the US. From household names like Mattel and Gymshark to brands that want to be household names like 404 Media.

23:10Shopify has got you from the get-go with beautiful ready-to-go templates to match your brand style. Their easy-to-use backend helps you manage your store's inventory and makes creating an attractive shop for your customers really simple. They also help you find your customers with easy-to-run email and social media campaigns. And if you get stuck, Shopify is always around to share advice with their award-winning 24-7 customer support. Turn those dreams into... And give them the best shot at success with Shopify. Sign up for your$1 per month trial and start selling today at shopify.com slash media.

23:46Go to shopify.com slash media. Shopify.com slash media. This limited edition inbound, September 3rd through 5th, brings attendees to San Francisco for a one-time only West Coast event with insights they won't find anywhere else. Just revealed, the Inbound 2025 agenda is now live. From the Agent.ai workshop, From Idea to Agent, and Dwarkesh on AI's Future, Research-Backed, Bold Predictions with Dwarkesh Patel, explore 200-plus sessions, all created for your growth. Get fresh perspectives on innovation from a dynamic lineup, including Sean Evans, the host of Hot Ones, Creative Force Amy Poehler, tech reviewer Marcus Brownlee, and AI pioneer Dario Amadei.

24:33They'll bring their unique approaches and expertise to Inbound 2025. Cut through the noise with focused, actionable takeaways on the latest marketing, sales, and AI trends that give businesses a competitive edge in today's rapidly changing landscape. Network with decision makers in San Francisco's AI-powered ecosystem, where innovative technologies are creating entirely new approaches to business. Experience firsthand how San Francisco's technology ecosystem is revolutionizing content creation, distribution, and monetization through AI and innovative tech solutions. Secure your spot at inbound.com slash register.

25:10And if you want the VIP experience at inbound, don't wait. VIP tickets are almost sold out. Get exclusive perks that help you make the most of every moment, including a welcome party, exclusive networking opportunities, and early registration access to limited capacity sessions. Registration for limited capacity sessions begins in August. Don't miss this opportunity to secure your ticket in advance. Start favoriting your must-sees and be ready when reservations open. Session reservations for VIP ticket holders begin August 5th and GA opens August 12th.

25:57All right, and we're back. Um, honestly, okay, I'm going to read out the first headline, then I'm going to go to Sam and ask her about the UK age verification law. And then I think Emmanuel has some sort of weird diagram that he's going to like describe or something and maybe we'll upload it. in the show notes or something. But okay, so the headline is UK users need to post selfie or photo ID to view Reddit's r slash Israel crimes r slash Ukraine war footage. This is about the UK's new age verification law and some unintended but maybe foreseen consequences of that. Sam, what is this law that just passed in the UK about age verification?

26:51Yeah, so this passed or it went into effect last week, which is why we're talking about it. And everyone's talking about it this week and last week. It's called the Online Safety Act. It's really similar to a lot of the age verification laws that we've talked about on this podcast a thousand times and written about quite a bit in the US. basically it's like a protect the children type law it requires so it does a lot it does a handful of things including like like adjusting algorithms so that kids can't see you know things organically in their feed that would be harmful or like considered harmful and a bunch of different regulation requirements for platforms.

27:35But the big one is that it's requiring platforms to get to keep operating in the UK. They have to implement age verification to check whether users are 18 and over. So far, we've seen that mostly look like selfies or IDs, which is very coincidental, I guess, considering what we just talked about, that all these platforms will be holding IDs. Or, you know, I think in most cases, third parties will be handling the verification. So on Reddit, it's like something called Persona, I think. And there are a bunch of different third-party age verification platforms that will do this. But at the end of the day, you're going to have to show...

28:27And you currently, if you're in the UK and not using a VPN, you have to show that you're 18 using like a valid driver's license or some kind of like a government issued ID or like biometric data. So it would like scan your face and determine whether or not you're 18 or like use these things in conjunction with one another. And not complying is like an$18 million fine or something. It's huge to not comply with this. It's not a risk that platforms are going to take. So already we're seeing lots of different subreddits, which we'll get into, going behind an age verification wall. Foreign sites that want to comply with the law are doing it this way.

29:14Certain Discord communities are requiring age verification. I think Xbox just announced today that they're going to start doing this too. It's just like... Oh no, the gamers. Yeah, the gamers. Yeah. Yeah, which actually is, I would assume, probably quite a bit of harmful content. Roblox and Minecraft, not the best places all the time. Yeah, exactly. So yeah, that's in a nutshell what it is. And obviously it has these massive repercussions that I'm sure we'll get into. Yeah. So it's mostly, I mean, in my eyes, it's mostly about porn. It's mostly about online pornography, sites like Pornhub, that sort of thing.

29:53but then as Emmanuel's story gets into it is impacting all these other websites Emmanuel how do you want to do this? Do you want to talk about this Reddit one first then get into the payment processes? Is that what you want to do? Here's what we'll do Good because I don't know Yeah no I don't either It's really complicated I don't usually feel very strongly about what we talk about in the podcast but I really wanted to talk about this because, I don't know, I wanted everyone to check in and I want to see how everyone else is thinking about this. I find this to be one of the most complicated subjects that we cover and I kind of switch how I feel all the time.

30:42And like surprise, surprise, censorship and platform governance is like a very complicated subject. We all know that, but it is changing and evolving now in a way that we've talked about for years but is now actually happening. And it's just a mess. It's a huge mess. So Sam, I don't know if you saw in the podcast room, I just posted this word cloud of all the different entities that are involved in this. So I guess I'll back up. There's some white wall craziness happening right here. To back up, just to run through a few things that have happened in the past month or so, So we talked about Civitai, this AI model sharing platform that was used to create non-consensual pornography.

31:29They got pressured by credit card companies to change their policy in a way that completely changed the nature of the platform and remove a bunch of those models that we found were really harmful. Then a few weeks later, Steam, which is the default way of buying PC games online, they changed their policy. They said explicitly to come in line with what credit companies want and removed a bunch of sex games on Steam. Steam, in case you didn't know, for years has allowed sexually themed games. And there's been a lot of spam and low-quality games flooding the platform every day since they've done that.

32:15And they didn't remove all of it, but they removed a bunch of incest-related games. And very violent, very graphic games. And that happened. And then I think later that week or the week after, itch.io, which is this huge platform mainly for independent game developers and students to share their work because it's easier to upload your games there. And you can also be more flexible about how you charge for the game. So you can charge nothing. You can decide what the split is between your game and what itch.io makes as a platform. and they just took this really radical action, probably because the credit card companies were threatening to shut them down any minute and just de-indexed all their not safe for work games, all their sex games, made a few of them unavailable in a way that people found really shocking.