Your account isn't yet verified in any way, though.

#Mastodon #MastodonSocial #MastodonOnline

Your profile neither have a "badge" nor a verified domain.

Ladies and gentlemen we got him.

Tacking on this sentence was irresponsible and unnecessary:

"Real staff accounts either have a special role badge on their profile or are verified through the joinmastodon.org domain."

The potential victims of this scam don't understand how to verify those conditions and it just gives the scammers a way to trick them ("see here for the role badge we told you to look for when warning you about scams").

The responsible thing to say is "Real staff accounts will NEVER DM you asking you to click a link, disclose private information, or verify your account. Any such request is a scam."

Well i'll stick with Misskey forks* and occasionally Akkoma thanks.

*At this rate you might as well fork Misskey, there'll come a point you can't add the features we have without breaking it completely.
Not so "frivolous" now.

And Mastodon AntiSocial stays muted.
I saw yours in a boost by a mutual.

#mastodon #misskey #SignUpApprovalByDefault

Mastodon needs a way to "verify" that doesn't require having some other website

If I could follow "Real people only" I absolutely would.

Btw, the site claims woman can check things on guys like criminal record, sex offender etc

But the thing is..

They do not verify this info! It's in their terms: they do NOT check any given info

Yo two things, who the fuck trusts any app to scan your driver's license, shit I refuse to get booze delivered cause I'm like, fuck you door dash you ain't getting that.

Second thing, the f is the tea app and what scam are they saying their app does?

@lunch I said it before and I'll say it again:

Any sufficiently advanced negligence is indistinguishable from malice.

I don't think it was strictly malice on Tea app's side. But it was negligence of the level that is indistinguishable from actual malice.

@tek

So let us get this right.. Tea forced people to upload personally identifiable information to prove they were "real women"???

Reminds us of that notoriously transphobic dating app, Giggle, which also used "AI" to "work out" if you were a "real woman"...

there is absolutely zero reason to store insecure, unencrypted, information in a bucket, s3 or otherwise.

Corporations/Institutions need to start being held accountable when PII is leaked due to shoddy and insufficient security practices are being implemented

If they can't secure their data infrastructure, then they shouldn't be asking for such sensitive information.

#DataPrivacy #EncryptEverything #BestPractices

@Lydie @solitha do we *know* it was vibe-coded? Is there any link you can share?

Don't get me wrong, I would not be surprised, but I also want to make sure this was the case first.

@Lydie right. So:

> People over the internet assume that the app's storage mechanism was "vibe-coded" but that's just pun-intended for now.

Seems like this is just based on the rumor mill and nothing more…

If you do see something that substantiates this in any way, I'm all ears!

@solitha

Thanks for posting this, it makes me sad every time I see a leak like this. And it's only going to be happening more frequently as age verification gets normalized

If anyone's looking for a direct link on the Tea hack, here's an article

nbcnews.com/tech/social-media/…

archive.is/H5XM8

Goddamn, I need all the people who are completely missing the point to think of it this way:

Imagine your bank leaves everything unlocked at night and doesn't even post a guard. Anyone can walk in and take whatever they want after hours.

When, not if, someone stole everything, do you think the appropriate headline would be, "Daring bank robbers clean out vault?" Or would you want the story to be about how your bank was criminally negligent with your stuff?

Yes, the people who did the stealing are bad and they should be punished, but is that really the top story there?