• pivot_root@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    2 months ago

    Tea was storing its users’ sensitive information on Firebase, a Google-owned backend cloud storage and computing service.

    Every time. With startups, it’s always an unsecured Firebase or S3 bucket.

    • NeilBrü@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      2 months ago

      I’m certainly no web security expert, but shouldn’t Tea’s junior network/backend/security developers, let alone seniors, know how to secure said firebase or S3 buckets with STARTTLS or SSL certificates? Shouldn’t a company like this have some sort of compliance department?

      • gian @lemmy.grys.it
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        I am not sure, but I read somewhere that the developer(s) used vibe coding to create the app so…

      • zqps@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        2 months ago

        It’s a little more complex than that. If you want the app on the user device to be able to dump data directly into your online database, you have to give it access in some way. Encrypting the transmission doesn’t do much if every app installation contains access credentials that can be extracted or sniffed.

        Obviously there are ways around this too, but it’s not just “use TLS”.