Security Flaws Exposed 100,000 Users' Phone Numbers and PINs

According to Daigle, the first vulnerability allowed him to enumerate the phone numbers of close to 100,000 users by exploiting a weakness in the app's server-side logic. The second flaw exposed user-set PINs to others on the app, which could be used to gain unauthorized access to the app. Daigle published his findings in a blog post and told TechCrunch that it was possible to exploit the vulnerabilities using publicly available tools. Freedom Chat founder Tanner Haas confirmed to TechCrunch that the app has now reset user PINs and released a new version. Haas added that the company is removing instances where users' phone numbers were occasionally visible and has implemented rate-limiting on its servers to prevent mass-guess attempts. Haas stated that the security of users' data is the company's top priority and that they are committed to ensuring the integrity of their app. Freedom Chat bills itself as a secure messaging app, claiming on its website that users' phone numbers stay private. However, the recent security flaws have raised concerns about the app's ability to protect user data. The incident highlights the importance of robust security measures in messaging apps, particularly those that claim to prioritize user privacy. The security flaws in Freedom Chat are a reminder that even well-intentioned companies can make mistakes. As the messaging app market continues to grow, it is essential for companies to prioritize security and transparency in their development processes. Freedom Chat's response to the security flaws is a step in the right direction, but the company must continue to work towards ensuring the security and integrity of its app. Freedom Chat has not commented on the exact number of users affected by the security flaws. However, the company has stated that it is committed to keeping users informed about any security issues that may arise. As the company continues to work on improving the security of its app, users can expect to see updates and patches in the coming weeks.