If you were a university student a few years ago, chances are you’ve heard about – and maybe used – Yik Yak, an anonymous bulletin board app that showed a feed of posts from a specific location.
The app, launched in 2013, was subsequently shut down in 2017 after users pointed out that it could be used to anonymously bully and harass people, among other bad things. Yik Yak made something of a comeback but the core issues remained.
But it turns out that Yik Yak wasn’t so anonymous after all, according to a researcher speaking to Motherboard.
Yik Yak privacy flaw
Computer science student David Teather constructed a pretty ingenuous way to test out Yik Yak’s privacy smarts and found the app was extremely wanting.
Using the open-source mitmproxy tool, Teather intercepted data from and to Yik Yak by pretending to be the app itself. Each post on the service contains an exact GPS coordinate and a unique ID (such as nrCi213RA3SncY6mVLZzuGUIJ2T2), both of which can be used to de-anonymise Yik Yak users.
In his own blog post, Teather goes into a lot more detail on exactly how and why Yik Yak was doing this, which leaves around two million remaining users at risk.
A silent update
“I disclosed what I found to the YikYak team on April 11, 2022,” Teather said. “Almost a month later on May 8, 2022 (1 day before public disclosure date), they responded by removing the user id being returned for posts and comments however this is not enough to protect privacy as it’s trivial to regain this information.”
But not a lot happened until Yik Yak released version 1.4.3 around May 11, which made some slight adjustments, mostly meaning that the GPS location data was less accurate.
I discovered that @YikYakApp is exposing millions of user locations through sending precise GPS coordinates of all posts and comments (accurate within 10-15 feet) to the app, these can be harvested by malicious actors to track users locations.https://t.co/pgT809okv7May 9, 2022
While this is almost certainly a positive change, Teather found that it was still possible, albeit slightly harder, to extract precise location data.
Yik Yak did not respond to multiple requests for comment from Motherboard.
