[noop2714]

> This is not the bug of the year. Ok, the id is not the encrypted. So encrypt it and next. Nothing to see

The privacy implications of leaking user identifying information are massive. Not something that should be dismissed so quickly as “nothing to see”.

Maybe not interesting for you, but many of us care about holding companies accountable for bad practices. If you don’t, this will become more common as it’s effectively being tolerated.

[polote]

There is no evidence that they tried to hide that. The company was created in 2020 and one of their API is not encrypted, that kind of things has probably happened to most of companies created less than a year ago

[noop2714]

> that kind of things has probably happened to most of companies created less than a year ago

No company gets a free pass on the implications of sacrificing privacy or security. Even if “less than a year old”.

This is serious:

“Any observer of internet traffic could easily match IDs on shared chatrooms to see who is talking to whom. For mainland Chinese users, this is troubling”

[YarickR2]

Like somehow you're the judge the jury and the executioner of said conpanies. Don't use their product.