Privacy analysis of Tiktok’s app and website • Hacker News Board

Re: Privacy analysis of Tiktok’s app and website

#11

Post by jandrese » Fri, Dec 06, 2019, 8:23 PM UTC

Wowfunhappy wrote: post #6

tcd wrote: post #4

As more time passes I begin to fundamentally believe the modern Internet isn't compatible with the GDPR or privacy as a whole. Simply the act of enabling JS within the browser is enough to have your privacy violated in thousands of different ways and data sucked up by everyone who wants it. Simply by installing an app on your smart phone you invite SDK's that are happy to report back all the information the OS freely…

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites). That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet. It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for peop…

Are cookies violating if they don't leave the website? It doesn't seem to be a problem as long as the cookie is only used within the context of your site. It's when they're used on other websites that the tracking capabilities exceed what you can otherwise glean from the server logs.

Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookies.

Re: Privacy analysis of Tiktok’s app and website

#12

Post by harryf » Fri, Dec 06, 2019, 8:23 PM UTC

Three of the main things he calls out are caused by embedding of the Facebook SDK, the Google Analytics SDK and AppsFlyer SDK. The most worrying one IMO is actually AppsFlyer - I doubt they have the resources to properly protect the data they're collecting.

It might be more effective to go after the companies providing the SDKs rather than individual apps, to have a real impact. But OK this was for a news story about TikTok and that's what readers can relate to.

Re: Privacy analysis of Tiktok’s app and website

#13

Post by graposaymaname » Fri, Dec 06, 2019, 8:28 PM UTC

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware.

> They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device.

This really blew my mind. Correct me if almost all of them are doing this. If it is so, the congress hearing last year, all those privacy suits, all went into vain didn't they. (PS. bad english)

:/

Re: Privacy analysis of Tiktok’s app and website

#14

Post by Wowfunhappy » Fri, Dec 06, 2019, 8:31 PM UTC

jandrese wrote: post #11

Wowfunhappy wrote: post #6

Earlier quoted context omitted.

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites). That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet. It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for peop…

Are cookies violating if they don't leave the website? It doesn't seem to be a problem as long as the cookie is only used within the context of your site. It's when they're used on other websites that the tracking capabilities exceed what you can otherwise glean from the server logs. Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookie…

Cookies aren't inherently against GDPR if they're used explicitly for necessary site functionality—you don't even need to tell users about them in that case.

What's not allowed is user tracking.

Re: Privacy analysis of Tiktok’s app and website

#15

Post by cubbic » Fri, Dec 06, 2019, 8:35 PM UTC

Even without any analysis it's quite clear what a company based in Beijing who censors everything on the party's whim is doing, though reading about the methods of fingerprinting was quite fun.

Re: Privacy analysis of Tiktok’s app and website

#16

Post by Jonnax » Fri, Dec 06, 2019, 8:43 PM UTC

Sandboxing with randomisation is what we need.

Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

Re: Privacy analysis of Tiktok’s app and website

#17

Post by Aperocky » Fri, Dec 06, 2019, 8:43 PM UTC

jandrese wrote: post #11

Wowfunhappy wrote: post #6

Earlier quoted context omitted.

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites). That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet. It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for peop…

Are cookies violating if they don't leave the website? It doesn't seem to be a problem as long as the cookie is only used within the context of your site. It's when they're used on other websites that the tracking capabilities exceed what you can otherwise glean from the server logs. Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookie…

By the same logic, are cookie violating if they are stored _somewhere else_ but the service provider are not selling those cookies to other people? what if the service provider have another service provider that provide analytic services to help with serving the website in question?

What's the difference of say, a dedicated cookie storage service company storing the cookie vs. an internal IT team that builds the wheel and store the cookie with analytic services? Especially when the usage of the cookie in both case being limited to the site in question?

This seem to negate the entire idea of programming - do one thing well, and have another thing to another thing well. Which applies to the business world at large.

Re: Privacy analysis of Tiktok’s app and website

#18

Post by the_pwner224 » Fri, Dec 06, 2019, 8:44 PM UTC

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.

Re: Privacy analysis of Tiktok’s app and website

#19

Post by baybal2 » Fri, Dec 06, 2019, 8:47 PM UTC

harryf wrote: post #12

Three of the main things he calls out are caused by embedding of the Facebook SDK, the Google Analytics SDK and AppsFlyer SDK. The most worrying one IMO is actually AppsFlyer - I doubt they have the resources to properly protect the data they're collecting. It might be more effective to go after the companies providing the SDKs rather than individual apps, to have a real impact. But OK this was for a news story about…

Going back to Google's knowing and willing abetting of hardware ID abuse.

I heard it many times that Google knows that a lot of Chinese companies violate their play store policy against using hardware IDs for advertising purposes.

If they stand against it, why they added APIs for accessing them in the first place?

I thought about that for a long time, and finally it struck me: Google very well knows that GDPR prohibits them IDing people if they refuse, so they just added those APIs to let other companies do it for them!

Re: Privacy analysis of Tiktok’s app and website

#20

Post by applecrazy » Fri, Dec 06, 2019, 8:48 PM UTC

I'm curious what device data is sent from the app. Are they using any private APIs to extract data from mobile users as well? That would be even more insidious, since it's hard to analyze that.

I tried decompiling the Android version of the app, but I'm not a mobile dev and don't know where to look to analyze its data collection behavior.

I also considered using mitmproxy (like the OP) to analyze transmitted data from the app on my phone, but I'm on a university network that blocks inbound connections to devices (so I can't connect to my laptop from my phone). Hope somebody else can publish an analysis.