Teaonher is an app designed to share photos and information about women who dated for men, and TechCrunch can confirm that it publishes user personal information, including government IDs and selfies.
Launched on the Apple App Store earlier this week, the app is a response to another viral app that women can post about men they date. Tea is advertised as a safety app for women with over 6 million users, similar to “Do we date the same guy?” Facebook Network. However, the app is controversial as many of the claims that women post are not validated.
The backlash surrounding tea escalated last week after 404 media reported that 4Chan users had retaliated with discovering a public database belonging to the app. Later hacks published over a million private messages to the app, prompting the app to disable messaging functionality.
Currently ranked 2nd among iOS lifestyle apps, Teaonher appears to be directly rebutting the Tea app, copying the language from Tea's App Store description into its own list.
But like the app it was trying to emulate, Teaonher contains its own security flaws.
TechCrunch has discovered at least one security flaw that allows access to data belonging to Teaonher app users, such as usernames and associated email addresses, and driver licenses and selfies that users upload to Teaonher. The image of these driver licenses is a public web address and anyone with the link can access it using a web browser.
In one case, TechCrunch displayed a list of posts shared with Teaonher added by each user's email address, display name, and self-report location.
TechCrunch withheld some of the bug details so that malicious actors can access someone's data. The app manufacturer did not respond to emails from TechCrunch. Therefore, TechCrunch has published this report with a limited detail on this issue, taking into account the current popularity of the app and the risks facing app use.
Teaonher was uploaded to the iOS App Store by a developer named Newville Media Corporation. According to LinkedIn, the company's founder and CEO is Xavier Lampkin.
TechCrunch has identified at least one Teaonher record related to Lampkin's own data.
Security revocation can affect people who signed up or shared their identity document with the app. This bug also reveals the number of users the Teaonher app has. This was around 53,000 users at the time of publication.
TechCrunch has identified a potential second security issue that left the email address and plaintext passwords that belong to the app creator Lampkin remained exposed to the server. The credentials appear to grant access to the “Admin” panel of the app. TechCrunch did not use the credentials, but it is illegal to do so, highlighting the risk of inadvertently leaving administrator credentials exposed to the web.
In addition to the security flaws, the content drawn within Teaonher is bothering itself. The app asks the user for an ID and selfie and checks the user to see a non-automatic process, but the user can access the “guest” view of the app without signing in.
As soon as I opened the “Guest” view, TechCrunch saw several images of the same naked woman. This was posted under a different name in the form of spam. It is not clear whether this woman agreed to the fact that this photo was shared. Other posts accused him of spreading sexually transmitted diseases, sharing the woman's name with photos and comments that they call “easy.”
With all free apps, Teaonher ranks 17th, higher than apps like Instagram, Netflix, Uber, Spotify and more. Tea is currently ranked 2nd.