Privacy Paradox: Freedom Chat Exposed User Phone Numbers and Secret PINs in Major Security Breach
Freedom Chat, an application marketed as a secure messaging platform, has been exposed to serious risk following the discovery of two critical vulnerabilities. Despite assurances of data privacy—including the concealment of users’ phone numbers—researchers identified flaws that allowed access not only to those numbers but also to users’ PIN codes.
According to researcher Eric Daigle, the vulnerabilities were uncovered last week. He disclosed the findings to TechCrunch after determining that Freedom Chat lacked a public channel for reporting security issues. The publication subsequently contacted the app’s founder, Tanner Haas, who confirmed the incident and outlined the steps taken in response.
One of the flaws enabled bulk verification of phone numbers to determine which ones were registered on the platform. This technique mirrors an approach previously documented by researchers at the University of Vienna in their study of WhatsApp, where billions of number combinations were tested, resulting in the collection of data on billions of accounts.
In addition, a separate vulnerability in Freedom Chat led to the exposure of PIN codes that users had set to protect access to the app. By analyzing network traffic, it was possible to observe that the PIN codes of other users sharing the same public channel were returned in server responses. Although these codes were not displayed in the interface, any channel participant could still obtain them.
Daigle estimates that this flaw could have been used to collect PIN information for nearly two thousand registered users, potentially allowing attackers to bypass app-level protections if a device were stolen.
The company has since released an update, tightened rate limits on server requests, and automatically reset all PIN codes to prevent unauthorized use. Developers also addressed scenarios in which phone numbers could become visible to other users of the service.
Previously, Tanner Haas had faced criticism over another application, Converso, which was removed from app stores after security issues were discovered that exposed users’ private messages.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
