Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

31–40 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#31

Post by JTon »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

> They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device.

I don't understand. Can anyone unpack this concept for me? How does one generate a sound without a speaker or record without a mic.

Re: Privacy analysis of Tiktok’s app and website

#32

Post by tus88 »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

They don't if you have JavaScript disabled ;)

Re: Privacy analysis of Tiktok’s app and website

#33

Post by qxnqd »

hombre_fatal wrote: post #21
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

Brave blocks cross-site canvas by default under their "Device recognition" option. You can also block first-party canvas access.

Re: Privacy analysis of Tiktok’s app and website

#34

Post by ldjb »

JTon wrote: post #31
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

> They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device. I don't understand. Can anyone unpack this concept for me? How does one generate a sound without a speaker or record without a mic.

I'm guessing they're using the Web Audio API which allows you to generate audio samples:

https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_A...

Re: Privacy analysis of Tiktok’s app and website

#35

Post by sm4rk0 »

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete:

(Canvas|WebGL|AudioContext|Font) Fingerprint Defender

They report and seem to block fingerprinting attempts.

https://addons.mozilla.org/en-US/android/addon/canvas-finger...

https://addons.mozilla.org/en-US/android/addon/webgl-fingerp...

https://addons.mozilla.org/en-US/android/addon/audioctx-fing...

https://addons.mozilla.org/en-US/android/addon/font-fingerpr...

Re: Privacy analysis of Tiktok’s app and website

#36

Post by sillysaurusx »

Jonnax wrote: post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

It exists: https://en.m.wikipedia.org/wiki/Whonix

Whonix is nice. It’s kind of painful to use, but if you need anonymity then it seems to be best in class.

Re: Privacy analysis of Tiktok’s app and website

#37

Post by [deleted] »

JTon wrote: post #31
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

> They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device. I don't understand. Can anyone unpack this concept for me? How does one generate a sound without a speaker or record without a mic.

[deleted]

Re: Privacy analysis of Tiktok’s app and website

#38

Post by tyingq »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

I remember being surprised at etag fingerprinting. http://lucb1e.com/rp/cookielesscookies/

Seems obvious once you read how it works. I suppose once you get your mind around how browsers leak and/or persist info, not much of it is surprising anymore.

Re: Privacy analysis of Tiktok’s app and website

#39

Post by dylz »

hombre_fatal wrote: post #21
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

> What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things?

In my experience, blocking these everywhere globally as a default will result in being banned from websites, trigger bullshit "fraud" invasive analytics, and all sorts of obnoxious fail-closed problems by invasive trackers.

You will also be banned from most Distil-hosted sites for refusing to enable WebGL or return a canvas fingerprint. Ticketmaster, etc.

Re: Privacy analysis of Tiktok’s app and website

#40

Post by m463 »

the_pwner224 wrote: post #18
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.

I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox.

Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)

Post reply on HN