Anonymous bulletin app Yik Yak isn't so anonymous after all

Date:
Mon, 16 May 2022 19:02:58 +0000

Description:
Remember Yik Yak? Turns out it may have been leaking your data.

FULL STORY ======================================================================

If you were a university student a few years ago, chances are you've heard about and maybe used Yik Yak, an anonymous bulletin board app that showed a feed of posts from a specific location.

The app, launched in 2013, was subsequently shut down in 2017 after users pointed out that it could be used to anonymously bully and harass people, among other bad things. Yik Yak made something of a comeback but the core issues remained.

But it turns out that Yik Yak wasn't so anonymous after all, according to a researcher speaking to Motherboard . Yik Yak privacy flaw

Computer science student David Teather constructed a pretty ingenuous way to test out Yik Yak's privacy smarts and found the app was extremely wanting.

Using the open-source mitmproxy tool, Teather intercepted data from and to
Yik Yak by pretending to be the app itself. Each post on the service contains an exact GPS coordinate and a unique ID (such as nrCi213RA3SncY6mVLZzuGUIJ2T2), both of which can be used to de-anonymise Yik Yak users.

In his own blog post , Teather goes into a lot more detail on exactly how and why Yik Yak was doing this, which leaves around two million remaining users
at risk. A silent update

"I disclosed what I found to the YikYak team on April 11, 2022," Teather
said. "Almost a month later on May 8, 2022 (1 day before public disclosure date), they responded by removing the user id being returned for posts and comments however this is not enough to protect privacy as its trivial to regain this information."

But not a lot happened until Yik Yak released version 1.4.3 around May 11, which made some slight adjustments, mostly meaning that the GPS location data was less accurate. I discovered that @YikYakApp is exposing millions of user locations through sending precise GPS coordinates of all posts and comments (accurate within 10-15 feet) to the app, these can be harvested by malicious actors to track users locations.https://t.co/pgT809okv7 May 9, 2022 See more READ MORE

Google claps back at Brave, DuckDuckGo over latest privacy debate

Users of period tracking apps urged to check privacy as Roe vs Wade debate

rages

Your Android phone is about to get a serious security update

While this is almost certainly a positive change, Teather found that it was still possible, albeit slightly harder, to extract precise location data.

Yik Yak did not respond to multiple requests for comment from Motherboard . Browse in private with the best VPNs



======================================================================
Link to news story: https://www.techradar.com/news/anonymous-bulletin-app-yik-yak-isnt-so-anonymou s-after-all/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)