True, the social networking app that promises to ‘protect your privacy’, exposed private user data

guest · Oct 29, 2020

True, the social networking app that promises to ‘protect your privacy,’ exposed private messages and user locations
October 28, 2020
https://techcrunch.com/2020/10/28/true-social-app-privacy-exposed-data/

True bills itself as the social networking app that will “protect your privacy.” But a security lapse left one of its servers exposed — and spilling private user data to the internet for anyone to find.

The app was launched in 2017 by Hello Mobile, a little-known virtual cell carrier that piggybacks off T-Mobile’s network. True’s website says it has raised $14 million in seed funding, and claimed more than half a million users shortly after its launch.
Click to expand...

But a dashboard for one of the app’s databases was exposed to the internet without a password, allowing anyone to read, browse and search the database — including private user data.
After we reached out, True pulled the dashboard offline.

Bret Cox, chief executive at True, confirmed the security lapse but did not answer our specific questions, including if the company planned to inform users of the security lapse or if it planned to disclose the incident to regulators under state data breach notification laws.
The dashboard also exposed the email and phone contacts uploaded by the user, which True uses to match with known friends in the app.
Click to expand...

None of the data was encrypted.

Hussein said that the dashboard was also leaking account access tokens, which could be used to hack into and hijack any user’s account.
The dashboard also exposed one-time login codes, which True sends to an account’s associated email address or phone number instead of storing passwords.

“This is another example of how mistakes can happen at any organization, even those that are privacy-centric,” Hussein told TechCrunch. “It highlights the importance of not only building secure applications and websites, but also ensuring that proper data security measures are embedded within their internal procedures.”
Click to expand...

Log in or Sign up

True, the social networking app that promises to ‘protect your privacy’, exposed private user data

guest Guest

Log in or Sign up

True, the social networking app that promises to ‘protect your privacy’, exposed private user data

guest Guest

Useful Searches