Next time you make a payment on Venmo, beware: almost anyone can track it.
The popular mobile payments app is sharing users' personal data — including real names, comments sent with the payment, transaction dates, and recipients of the transaction — with the public by default. This information is being exposed through company’s public API, and it can be hidden by adjusting your privacy settings from "Public" to "Private."
Security researcher Hang Do Thi Duc recently discovered this "alarming amount" of information being leaked by examining the public API. The reason its happening, the researcher suggests, is because the Venmo app's default settings are set to "Public" for all users.
Using transaction data made available through the public API, Do Thi Duc downloaded 207,984,218 Venmo transactions, all the public transaction made on the app in 2017, and analyzed them. She has detailed her findings in an aptly named project called Public By Default.
SEE ALSO:Venmo fare-splitting is coming to the Uber appTo show just how much detail you can pull from the public Venmo transaction data, Do Thi Duc’s Public By Default project focuses on on five specific Venmo accounts. The five accounts, whose identities she’s chosen to keep private, include a Cannabis seller in California, a food truck vendor, a married man and woman, a junk food lover, and a fighting couple.
The amount of information Do Thi Duc is able to pull from the transaction data Venmo is sharing is pretty astonishing. For example, she was able to track the food truck vendor’s number one customer and find exactly when she’d go and what she was buying to eat. In the case of the married couple, Do Thi Duc was able to not only tell where they shop but also who was responsible for what bill.
In her report, Do Thi Duc was able to obtain even more information about the people behind these public transactions based on the profile picture they were using. If a Venmo user chose to link up their Facebook account so they can use the same profile picture as their Venmo avatar, Venmo’s public API shares the Facebook picture URL along with the rest of the transaction. This profile picture URL includes a user’s Facebook ID, which in turn will direct you straight to a person Facebook profile.
The fact that Venmo has enabled such easy access to this type of information in the form of a public API is problematic. In the hands of the right – or wrong – person this info is ripe for identity theft. Not only that, but the access to this information by say a stalker or domestic abuser is potentially dangerous.
In a statement, Venmo is quick to point out that while the “safety and privacy of Venmo users and their information is one of our highest priorities,” when it comes to protecting this information, it’s up to each Venmo user to change their default Venmo settings and make it private.
We recommend you do just that.
TopicsCybersecurityPrivacy
(责任编辑：綜合)
Fyvush Finkel, Emmy winner for 'Picket Fences,' dies at 93Google's first VR Doodle celebrates French film legend Georges MélièsWhat's coming to Netflix in May: 'Coco' and moreRobot mascot allows 14This German startup wants to be your bank (without being a bank)How Hyperloop One went off the rails
In December 2014, an engineer with the unlikely name Brogan BamBrogan was in the driveway of his cla
...[详细]The 9 best Samsung Galaxy S9 cases for every situation
With Samsung's brand constantly growing, so in turn do the options for cases to protect its flagship
...[详细]Diamond and Silk get more time in the spotlight thanks to Zuckerberg
Over the past two days, Facebook founder and CEO Mark Zuckerberg has been bombarded with pointed que
...[详细]Someone Photoshopped Mark Zuckerberg as Data from 'Star Trek' and it's incredible
This week on the internet, we've collectively ripped Mark Zuckerberg as he attempts to save Facebook
...[详细]Dressage horse dancing to 'Smooth' by Santana wins gold for chillest horse
Okay forget everyone else -- this horse named Lorenzo is our favorite Olympic athlete now. 。Lorenzo,
...[详细]Windows 10 April 2018 Update review: How an OS grows up
Microsoft must be feeling pretty good about itself.I don't say that because it's just done something
...[详细]World-famous DJ and producer Avicii has died, according a statement provided by his representative t
...[详细]'Tully' writer Diablo Cody talks women in film, on screen and off
It's rare in Hollywood to find authentic, layered stories about multifaceted women, but the good new
...[详细]This weird squid looks like it has googly eyes, guys
Internet, meet your new spirit animal. 。Scientists aboard the research vessel the E/V Nautilus, off t
...[详细]Ultimate 'Star Wars' fan runs Darth Vader
Have you ever liked a movie franchise so much you ran multiple miles for it?Me either. 。But every yea
...[详细]Photos show the Blue Cut fire blazing a path of destruction in California
Watch: 'The Karate Kid' sequel 'Cobra Kai' stars on 'The Today Show'