Get User ID, log in as user (no passwords), check "your" post history.

Let's say you're the NSA. Edward Snowden posts "the NSA is spying on u" on yik yak. You see the yak on the Ft. Meade yak feed.

How do you get Edward Snowden's yik yak userID? This post doesn't show anything that lets you do this from a posted yak.

Deploy the hack on the local network and grab the ID of every user. Then check each ID to see if they made that post. Of course, this requires either foresight or for Edward to keep posting afterwards, but neither is outlandish.

This assumes that Edward Snowden continues posting in the same geofence as well. Using a GPS spoofer, you can just pick a random geofence each time.

Further, you can obtain a new userID just by reinstalling the app, so the information can be totally destroyed by the user as well.

It's very hard to leverage this attack into anything more interesting than getting a userID banned.