Researchers Crack Yik Yak To Find Users’ Location

The app's a little less private when people can figure out where you're yakking

Illustration: Vocativ
Oct 21, 2016 at 12:36 PM ET

Researchers have figured out how to trick Yik Yak, the messaging application for pseudonymously sharing messages with others in a small area, into sharing a user’s rough location.

“The key selling point of Yik Yak is it’s anonymous,” Keith Ross, Dean of Engineering and Computer Science at NYU Shanghai, who led the team that conducted the study, told Vocativ. “We were sort of surprised it could be done at all.”

The process is rooted in the fundamental way that Yik Yak thinks about geography. In theory, Yik Yak, designed for use on college campuses, pictures users as being in the same area, which, researchers observed, is roughly four square miles. But there isn’t a single boundary for a given campus or city. Instead, every single user is the center of their own two-mile by two-mile square.

For most users, that shouldn’t make a big difference, as most students on a given campus will overlap. But it means that if someone is dogged enough, as Ross’s team was, they could develop a program to spoof hundreds of different GPS coordinates for the Yik Yak app. With enough tries, the program could narrow down where a given message — a Yak, in the app’s parlance — was visible, correctly identifying where it was posted to within 300 feet. Practically speaking, they could figure out which dorm a given user was in when she posted a message.

Yik Yak came into hot water in 2015, when a number of users accused the app of facilitating targeted harassment. Its combination of a local pool of users, plus apparent pseudonymity, made abuse easy. It led to, for example, an outburst of racist comments against professors and sexual harassment towards women on campuses. The app responded by formally “banning” abusive use by requesting its users refrain from such talk.

A spokesperson for Yik Yak said the company was aware of the study and was working on a way to address Ross’s methods. It wasn’t clear if the company would implement Ross’s changes. His team’s paper debuts Nov. 15, when it’s presented at the Internet Measurement Conference.