Anonymous social app Yik Tak left users’ precise locations exposed

Yik Yak’s revived messaging app was supposed to bring back the days of truly anonymous local chat, but it may have inadvertently made life easier for creeps. Computer science student David Teather informed Motherboard that Yik Yak had a flaw that let attackers obtain both the precise location for posts (within 10 to 15 feet) and users’ unique IDs. Blend the two pieces of info and it’s possible to track a user’s movement patterns.

Teather used a proxy tool to determine that YikYak sent both the precise GPS position and user ID with every message, even if users would normally only see vague distances and city identifiers. An independent researcher verified the findings for Motherboard, although it’s not clear if anyone has exploited the flaw so far.

Yik Yak hasn’t responded to requests for comment so far. The developer released three updates between April 28th and May 10th, but it’s not yet certain if they completely address exposed locations. However, it’s safe to say that the issue left users at risk, especially if they shared any sensitive information with local chatters.