Anonymous #1 19h

https://pomf2.lain.la/f/ffzxch3v.pdf For sure! Here’s the example I got from my university in case yall are curious what the program spits out if you decide to run it.

13

Anonymous #3 19h

Computer. Hits the api instead of using the actual app which would be way slower. So you just type in your phone number after running the program, then the side chat verification code, then it starts the capture.

13

Comment Deleted

0

Yeah ntm this is some anonymous legion megahacker edgy shit. No one wouldve actually taken the time out of their day to do this unless they don’t have anything better to do. This just gives everyone an easy opportunity to access the problem that he deems serious

7

Anonymous OP 11h

It's basically doing what I already do myself, it just organizes it in a program, l already do this by saving posts and cross referencing by blocking and seeing what dissapears.

4

Anonymous #5 9h

Sure you could find my number, backtrace a lot. And YY should be aware of this, the main issue is that YY allows anyone to join a school thread. Getting into yy college is easy and tbh there should be more security check points to get into them like Snapchat and Instagram has

1

Anonymous #5 9h

Granted those aren’t safe too due to bc you can just use someone active email or spam different school emails till you get in

1

Anonymous OP 3h

Did this get taken down? The GitHub link is dead

1

Anonymous robert_zemekis 2h

Both are still up, you just can’t hyperlink in a comment

1

Anonymous #4 2h

It groups all posts from a timeframe by post author. Yikyaks FAQ says you can’t be tracked through the app, this provides a way to by linking posts to the same author.

2

Anonymous #4 2h

Yeah hence the psa in the GitHub README and me calling for the release of the actual files.

0

Anonymous #5 2h

I completely agree. That’s why I released it. Yikyak doesn’t care about safety or vulnerability management. So I made a tooled release so instead of kicking the ice cube under the fridge, they’ll implement my proposed mitigation which would protect student safety from a deanonymizing attack.

3

Anonymous OP 1h

Oh it makes it all ok because you said you wanted them released. I don’t think they were trafficked and raped repeatedly with the intent of making a joke about it and calling something they made the “Yikstein files”

0

Anonymous OP 1h

YOUR Identifying information cannot be tracked through the app. If you have a disgusting amount of free time and want to try and find who wrote what, thats up to you and your lack of busywork.

-3

Anonymous #4 1h

If the name bothers you that much, you’re more than welcome to submit a pull request changing the PDF output name and I’ll merge it. It’s open source, after all. Personally, I’m more concerned about the anonymity vulnerability than what the report is called.

1

Anonymous #4 1h

Right there in black and white broski. Question 28 in the FAQ. 🫶

0

Anonymous #5 1h

How so? You have to have a school email, then you need to put in a verification code sent to that exact email, you can’t exactly just fake it

1

Anonymous #3 1h

Yup Exactly! It just does it on a mass scale, and to every user in a community. Because it creates a state change in the DB, it’s measurable and you can extrapolate through differential analysis between captured DBs. I have a proposed fix in the repo, that would protect student safety and the ability to block/hide posts, but in a way that doesn’t create that change state that can be measured.

1

Anonymous OP 1h

They are tracking messages not giving out the names of who is making them fuckhead

0

Anonymous OP 1h

Hehe if ur that bothered by me making light of the epstein files u change it!! Not me ! You change it!!! Stupid bitch woman!!! BTW, still anonymous!!!!! Do you know the names of everyone who posted the particular messages? The emails??

-1

Comment Deleted

0

Yes he did go about it the right way, but YikYak refused to act. When the company won’t act in private then they better act in public P.S. a bad actor would have figured this out and abused it already, the only difference is now normal people know about it

5

Anonymous #4 47m

You’re missing the distinction between identity disclosure and authorship correlation. YakTrace links posts made by the same anonymous account across weeks of activity. Once those posts are grouped, identifying details can be pieced together. You don’t need someone’s name handed to you for their anonymity to be compromised. Why are you so bitchmade lol?

3

Anonymous #4 45m

You’re still confusing anonymity with the absence of a name or email. The vulnerability links posts from the same account, allowing people to piece together identifying details across weeks of activity. That’s the entire point. And yes, the project is open source. No pull request to change the name yet, though, so I guess it stays.

1

You’re confusing responsible disclosure with permanent silence. I reported the vulnerability privately, waited the full 90-day disclosure period, and received no response. Public disclosure after that window is an established industry practice. Stop tarding out and familiarize yourself with coordinated vulnerability disclosure before lecturing me.

4