Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

41–50 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#41

Post by diafygi »

freeone3000 wrote: post #30
diafygi wrote: post #9

Earlier quoted context omitted.

Hmmmm, I think it's a bit of an unreasonable expectation to think technology should prevent companies from breaking the law. Most meatspace laws are expected to be followed despite there being little to no physical barrier to breaking them (e.g. there's no physical barrier preventing me from throwing a brick through a window, but it would still be vandalism). Why should we expect laws in software to be different? Why…

Because enforcement is effectively impossible. When crime becomes automated, how are humans expected to keep up the pace of enforcement?

Crime isn't automated. Someone has to write the script that commits the crime (or I guess ultimately design the AI framework that generates criminal bots). At the end of the line there's still a human.

Re: Privacy analysis of Tiktok’s app and website

#42

Post by dragonelite »

cubbic wrote: post #15

Even without any analysis it's quite clear what a company based in Beijing who censors everything on the party's whim is doing, though reading about the methods of fingerprinting was quite fun.

Aren't they censoring all political content, not only the china based political content? At least that is what i was told/remembered not sure which source it was.

Re: Privacy analysis of Tiktok’s app and website

#43

Post by samstave »

I posted the following to /r/ but it was removed... (hmmm)

There was a statement that was made that China has been seeking to build the largest face recognition db... (obv FB has that embedded not only in their name, but their userbase -- and what China wants to do is compete with FB on this front for their own means...)

---

TikTok is a face recognition harvesting platform WITH sentiment!

Hear me out.

So TikTok is literally focused (on multiple levels) of the users face being in a very contrived space and detail - its largely wide with younger ppl... however

IT ALREADY HAS 50% of the FB population:

https://www.oberlo.com/blog/tiktok-statistics

https://futurism.com/the-byte/tiktok-facial-recognition

'500 MM users'

in less than a 3rd of the time....

TikTok vs FB combined is the new Digital Cold War.

--

I have recently disabled my phone. But obv - I post to HN and .r. and I will not be able to off-grid without significant effort.

Conclusion: Privacy is not only dead, it has both necromancers and necrophiliacs fucking you in the shadows forever without recourse.

Re: Privacy analysis of Tiktok’s app and website

#44

Post by yding »

The GDPR law is complex, but I'm 99% sure that this guy is misinterpreting it here.

Sending data to Google, FaceBook and AppsFlyer (and other American companies) is generally legal under GDPR.

All three companies are covered under the US-EU Privacy Shield framework: https://www.privacyshield.gov/participant_search

Furthermore, sending PII data to a non-EU country is also allowed under GDPR as long as the company in question obeys the GDPR rules. Like I said, those rules are complex, and there could very well be some technical violations by TikTok, but that's not demonstrated here.

Browser/device fingerprinting for anti-fraud is a well established industry practice. Browser makers don't like this practice and have taken steps to make it harder, but the truth is that it's used across the industry.

The open source license violations could be actual civil, but not criminal, violations. TikTok does maintain a list of open source licenses here: https://www.tiktok.com/legal/open-source?lang=en It looks like it's only for its app and not its website though. Violations of the MIT/BSD license by using a npm package and forgetting to include it in the documentation, unfortunately is pretty common across the industry. That doesn't make it right, and we should hold big companies to a higher standard of compliance, but if anybody wanted to make a complaint it would have to be the copyright holder.

TL/DR: I don't think the author demonstrated anything illegal here or out of line with normal industry practice. You can argue about the morality of certain industry practices (like fingerprinting) but TikTok is far from an outlier here.

Re: Privacy analysis of Tiktok’s app and website

#45

Post by bashinator »

tus88 wrote: post #32
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

They don't if you have JavaScript disabled ;)

Is it even possible to use TikTok with noscript?

Re: Privacy analysis of Tiktok’s app and website

#46

Post by seppin »

colorincorrect wrote: post #3

is there a similar analysis of google/facebook/instagram?

Yes, they don't give the data they harvest to an authoritarian government that already has proven they will use said data to target and ID people for arrest/detention/torture.

Which is an important distinction.

Re: Privacy analysis of Tiktok’s app and website

#47

Post by yding »

JumpCrisscross wrote: post #28
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Can, practically speaking, European governments enforce GDPR with ByteDance?

Yes. ByteDance does business in Europe and therefore is subject to EU law.

Re: Privacy analysis of Tiktok’s app and website

#48

Post by dhimes »

m463 wrote: post #40
the_pwner224 wrote: post #18

Earlier quoted context omitted.

I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.

I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox. Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)

Could there be some way to randomize the canvas and audio fingerprints? An extension that obfuscates them in some sense by sending false signals?

Edit: Perhaps overloading the toDataURL() function to add random noise. https://browserleaks.com/canvas#how-does-it-work

Re: Privacy analysis of Tiktok’s app and website

#49

Post by hoorayimhelping »

sm4rk0 wrote: post #35

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…

These links have android in the url, which makes me think they're for the android version of firefox.

Either way, those links allowed me to install the extensions on desktop Firefox on Windows, so it's all good.

Re: Privacy analysis of Tiktok’s app and website

#50

Post by JimmyRuska »

GDPR allows you to capture logs as long as there's some reasonable business case explanation. Security is the easiest because you can easy all identity tracking is for catching fraud, bots or hackers. The explanation can always be hand-wavy and legislation is not specific on the details.
Post reply on HN