Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

21–30 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#21

Post by hombre_fatal »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access.

What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things?

I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups mean since so many major websites use these hacks, so the average user is just going to be conditioned to mindlessly click "Allow All" every time they pop up like UAC on Windows Vista, punishing the average person while doing nothing to enhance their security.

Doesn't help that legislators are absolutely clueless here. For example, demonizing cookies when cookies are the most fair and transparent way to implement tracking, and leading to the first wave of pointless opt-in spam that plagues the internet. I'd rather they leave the internet alone and for browser vendors to step up for us.

Of course, the problem also includes native apps like in TFA. I'm just more optimistic about clients that run in web browsers.

Re: Privacy analysis of Tiktok’s app and website

#22

Post by applecrazy »

Jonnax wrote: post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

The sandboxing part exists: https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Not sure if it randomizes things like audio or canvas fingerprints, though.

Re: Privacy analysis of Tiktok’s app and website

#23

Post by the_pwner224 »

Jonnax wrote: post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

These sorts of features are added to JS because they enhance user interaction. The audio API is an obvious example, and one of the big reasons canvas is used is that it has good 2d performance and lets you draw arbitrary stuff easily - good for game. You can't decouple this from the hardware; audio will need to go through the sound card and removing GPU acceleration from canvas kills it. The only thing that can be done is slightly fuzzing inputs the program collects (the saved PNG or the listened audio) - but this again interferes with real use cases, such as web audio editors and image editors, where this method forces lossy editing and importing.

Already I have to use another browser to use games or other 3D content because I have WebGL disabled in Firefox, and for 2d stuff the resistFingerprinting option reduces timer accuracy, which messes with game loop timing and makes the game totally unplayable. Making audio and video even harder to use is not good.

The only solution is to not allow this stuff to happen in the first place by using a permissions system. Adding more permissions popups is bad, so permission needs to be implicitly allowed by the user. Autoplay is a good example of this, calls to play() are blocked unless the call is being made in response to a click handler. Permissions for really recording audio/video through a webcam/mic also work well.

Re: Privacy analysis of Tiktok’s app and website

#24

Post by duxup »

tcd wrote: post #4

As more time passes I begin to fundamentally believe the modern Internet isn't compatible with the GDPR or privacy as a whole. Simply the act of enabling JS within the browser is enough to have your privacy violated in thousands of different ways and data sucked up by everyone who wants it. Simply by installing an app on your smart phone you invite SDK's that are happy to report back all the information the OS freely…

Arguably any programming language allows companies to break the law. It's not a JS thing, and I feel like there is no going back from the world of web applications.

Re: Privacy analysis of Tiktok’s app and website

#25

Post by saagarjha »

cubbic wrote: post #15

Even without any analysis it's quite clear what a company based in Beijing who censors everything on the party's whim is doing, though reading about the methods of fingerprinting was quite fun.

> Those are the PRIVACY problems with Tiktok. Last week Netzpolitik published detailed information about CENSORSHIP problems.

Re: Privacy analysis of Tiktok’s app and website

#26

Post by doh »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

One thing that I can tell you is that they are using this to sign the request to their private API. They might be using for tracking it too (I never looked at that), but it's used to prevent their platform from being scraped.

Re: Privacy analysis of Tiktok’s app and website

#28

Post by JumpCrisscross »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Can, practically speaking, European governments enforce GDPR with ByteDance?

Re: Privacy analysis of Tiktok’s app and website

#29

Post by john37386 »

The other day I saw my young nephew on Tiktok. There is this thing that happens once in a while when you see two pictures of fashion and the child has to point with its finger which one they prefer. This thing goes on for a while. I found it weird and was wondering if other also noticed this?

Re: Privacy analysis of Tiktok’s app and website

#30

Post by freeone3000 »

diafygi wrote: post #9
tcd wrote: post #4

As more time passes I begin to fundamentally believe the modern Internet isn't compatible with the GDPR or privacy as a whole. Simply the act of enabling JS within the browser is enough to have your privacy violated in thousands of different ways and data sucked up by everyone who wants it. Simply by installing an app on your smart phone you invite SDK's that are happy to report back all the information the OS freely…

Hmmmm, I think it's a bit of an unreasonable expectation to think technology should prevent companies from breaking the law. Most meatspace laws are expected to be followed despite there being little to no physical barrier to breaking them (e.g. there's no physical barrier preventing me from throwing a brick through a window, but it would still be vandalism). Why should we expect laws in software to be different? Why…

Because enforcement is effectively impossible. When crime becomes automated, how are humans expected to keep up the pace of enforcement?
Post reply on HN