If you were a university student a few years ago, chances are you've heard about – and maybe used – Yik Yak, an anonymous bulletin board app that showed a feed of posts from a specific location.
The app, launched in 2013, was subsequently shut down in 2017 after users pointed out that it could be used to anonymously bully and harass people, among other bad things. Yik Yak made something of a comeback but the core issues remained.
But it turns out that Yik Yak wasn't so anonymous after all, according to a researcher speaking to Motherboard.
Yik Yak privacy flaw
Computer science student David Teather constructed a pretty ingenuous way to test out Yik Yak's privacy smarts and found the app was extremely wanting.
Using the open-source mitmproxy tool, Teather intercepted data from and to Yik Yak by pretending to be the app itself. Each post on the service contains an exact GPS coordinate and a unique ID (such as nrCi213RA3SncY6mVLZzuGUIJ2T2), both of which can be used to de-anonymise Yik Yak users.
In his own blog post, Teather goes into a lot more detail on exactly how and why Yik Yak was doing this, which leaves around two million remaining users at risk.
A silent update
“I disclosed what I found to the YikYak team on April 11, 2022,” Teather said. “Almost a month later on May 8, 2022 (1 day before public disclosure date), they responded by removing the user id being returned for posts and comments however this is not enough to protect privacy as it’s trivial to regain this information.”
But not a lot happened until Yik Yak released version 1.4.3 around May 11, which made some slight adjustments, mostly meaning that the GPS location data was less accurate.
I discovered that @YikYakApp is exposing millions of user locations through sending precise GPS coordinates of all posts and comments (accurate within 10-15 feet) to the app, these can be harvested by malicious actors to track users locations.https://t.co/pgT809okv7May 9, 2022
While this is almost certainly a positive change, Teather found that it was still possible, albeit slightly harder, to extract precise location data.
Yik Yak did not respond to multiple requests for comment from Motherboard.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba