It's a bad day for would-be tech watchdogs and gossips.
The tech industry whistleblower and survey site Blind temporarily exposed user data when it left a server functioning without password protection. That's according to TechCrunch, whose new report not only uncovered the server lapse, but also called into question Blind's claims of privacy and complete user anonymity.
SEE ALSO:Blind: The hot app where all the best Silicon Valley gossip is read right nowA South Korean company, Blind is a site that allows tech industry employees to anonymously discuss their companies with colleagues. It also regularly produces surveys about sensitive topics like workplace harassment and diversity that it then distributes to the press. Blind gained prominence when discussions on the platform exposed sexual harassment at Uber. According to TechCrunch, it just secured $10 million in a new round of funding.
Central to Blind's functioning are its claims of privacy and user anonymity. Without this assurance, employees would likely feel uncomfortable discussing their employers.
The unprotected server reportedly showed logins, messages, and interactions,"allowing anyone to read private comments and posts."
Blind responded to the report saying that the unprotected server was an isolated incident that affected users who logged in between Nov. 1 and Dec. 19. Blind said it sent a push notification to affected users within the app.
“While developing an internal tool to improve our service for our users, we became aware of an error that exposed user data,” Blind reportedly wrote.
In addition to account activity, Blind protects its users by disassociating work email addresses from accounts. Blind says that it does not store email addresses, and only creates unique tokens from emails once you sign up.
"Email verification is safe, as our patented infrastructure is set up so that all user account and activity information is completely disconnected from the email verification process," a Blind FAQ reads. "It is impossible to match your user activity to any profile or email information provided upon sign up."
Despite these claims, TechCrunch was able to view emails of Blind users who had not yet posted. The server also contained pairings of these accounts with their unique member IDs, which could reportedly allow for identification if they did post in the future. The report also showed potentially shoddy encryption work for passwords and user tokens.
The server lapse is a potentially huge breach of trust for Blind users. Blind has the potential to be an important whistle-blowing tool for an industry that certainly needs oversight. But without confidence in its security, its users, and its power, could vanish.
CORRECTION: Dec. 21, 2018, 5:16 p.m. PST
A previous version of this article stated that Blind emailed users about the breach. Blind did not email users. It sent a push notification to affected users within the Blind app.
TopicsCybersecurity
(责任编辑：熱點)
Samsung Galaxy Note7 teardown reveals the magic behind the phone's iris scanner
It's time to accept reality Android users. The headphone jack's going away.
Vinci smart headphones have a friggin' screen on them
Netflix knows you like Korean dramas, so it's making an original seriesThis coloring book is here for all your relationship goalsBalloon fanatic Tim Kaine is also, of course, very good at harmonica
You know the old saying: the people want a president they can drink a beer with and they also want a
...[详细]Cher will star in Lifetime's movie about the Flint water crisis
Cher is set to star in Lifetime's original movie Flint, which will tell the ongoing tale of water co
...[详细]'Mass Effect: Andromeda' comes out in March. Here's what we know
Mass Effect: Andromedahas a release date, and it's sooner than you probably thought.The next chapter
...[详细]Prosthesis is a huge, terrifying exoskeleton built for real
LAS VEGAS -- Standing silently on the CES floor, a giant Prosthesis exoskeleton is coiled, ready for
...[详细]Samsung Galaxy Note7 teardown reveals the magic behind the phone's iris scanner
Samsung's Galaxy Note7 is touted by many reviewers as one of the best, if not the best, smartphones
...[详细]Climate activists protested Rex Tillerson’s nomination in T. Rex costumes
With a name like Rex, such a stunt was inevitable.On Wednesday, environmental activists marched arou
...[详细]'The People v. O.J. Simpson' team just gave a super timely speech at the Golden Globes
The People v. O.J. Simpson: American Crime Story continued its getaway with all of Hollywood's brigh
...[详细]Julian Assange says once again that Russia is not Wikileaks' source
Wikileaks founder Julian Assange is claiming again that a Russian-connected source didn't leak hacke
...[详细]Watch MTV's Video Music Awards 2016 livestream
It's MTV Video Music Awards night. Are you ready?Kanye's going to be there, and he's going to say th
...[详细]Dolphins escape from Japanese town made famous by 'The Cove'
Dolphins have gone missing from a recreational facility in the Japanese town of Taiji, which is at t
...[详细]
