Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

61–70 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#61
post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

It's an arms race, and the problem is that there are two groups of "bad guys."

One group of "bad guys" are the ones who want to track what you're doing even after you've cleared your cookies or track you across different domains or different apps. I would argue that this group is the smaller group, but browsers have been taking actions to make their jobs harder, including the "Facebook fence" that Firefox implemented.

There's a second group, which is the cybercriminals (or maybe just grey-market). Think Russian bot farms and purchase fraud bots, but also the guys who sell clicks and followers and rankings, and the ticketmaster bots and black friday bots and such. Those guys do their business by creating thousands or millions of fake accounts, and then funneling their transactions through them. They generally use scripts and cloud farms (sometimes even physical device farms). So app makers and websites need a way to detect when they're being attacked by one of those guys, and the way they do it, is more and more, through fingerprinting.

So every step browser and OS makers take to make the first group of "bad guys" jobs harder also makes the second group of "bad guys" jobs easier, because it makes it easier for them to pretend to be legitimate users.

Re: Privacy analysis of Tiktok’s app and website

#62
post #61
post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

It's an arms race, and the problem is that there are two groups of "bad guys." One group of "bad guys" are the ones who want to track what you're doing even after you've cleared your cookies or track you across different domains or different apps. I would argue that this group is the smaller group, but browsers have been taking actions to make their jobs harder, including the "Facebook fence" that Firefox implemented…

[deleted]

Re: Privacy analysis of Tiktok’s app and website

#63
post #61
post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

It's an arms race, and the problem is that there are two groups of "bad guys." One group of "bad guys" are the ones who want to track what you're doing even after you've cleared your cookies or track you across different domains or different apps. I would argue that this group is the smaller group, but browsers have been taking actions to make their jobs harder, including the "Facebook fence" that Firefox implemented…

You missed the 3rd group, and that is the people who make Android, spending billions to make a great OS, to make sure they can always track you.

Re: Privacy analysis of Tiktok’s app and website

#64
post #16

Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.

These sorts of features are added to JS because they enhance user interaction. The audio API is an obvious example, and one of the big reasons canvas is used is that it has good 2d performance and lets you draw arbitrary stuff easily - good for game. You can't decouple this from the hardware; audio will need to go through the sound card and removing GPU acceleration from canvas kills it. The only thing that can be do…

> You can't decouple this from the hardware; audio will need to go through the sound card and removing GPU acceleration from canvas kills it.

What you can do is require that the hardware produce bit-identical output for given input no matter how it's actually implemented, a bit like how HTML5 exactly defines rendering for any stream of input characters nowadays. Sure, this level of exactness might impose a performance cost, but it would improve privacy.

OTOH, you still have timing fingerprinting, so maybe you just can't win.

Re: Privacy analysis of Tiktok’s app and website

#65
post #58
post #44

The GDPR law is complex, but I'm 99% sure that this guy is misinterpreting it here. Sending data to Google, FaceBook and AppsFlyer (and other American companies) is generally legal under GDPR. All three companies are covered under the US-EU Privacy Shield framework: https://www.privacyshield.gov/participant_search Furthermore, sending PII data to a non-EU country is also allowed under GDPR as long as the company in q…

As someone who worked in a field that necessitated some significant anti-fraud measures nope to > Browser/device fingerprinting for anti-fraud is a well established industry practice. Browser makers don't like this practice and have taken steps to make it harder, but the truth is that it's used across the industry. If it's that important to you switch off of the web into an App, require sign-ons against an internal s…

I bet you've never worked on an e-commerce system then because none of your suggestions work against e-commerce fraud, and you'd literally lose all of your money:

switch off of the web into an App: Can't just shut down your website. Also, device farms and VM farms are super common so it won't even help.

require sign-ons against an internal system for authentication: Sure, you can require your users create an account. Accounts can be created by the thousands by bots. Even if you use captchas, captchas don't work, and even if they did I can find you 100 people who will sign up for accounts manually and sell them to you for 10 cents a piece.

policy people actively: I assume you mean police people effectively. Kind of hard to "police" your customers when a huge percentage of them sign up once, buy something, and maybe only come back 3 years later. In the meantime, their super simple passwords may have been hacked and leaked 10 times already. Maybe you should require your customers all use 2FA. Let's see how many customers you have remaining once you turn that on.

Re: Privacy analysis of Tiktok’s app and website

#66
I think this says all we need to know: http://pro-tiktok.s3.amazonaws.com

Notice the file left in there by a previous explorer of the internet. This gentleman has even found RCE exploits with TikTok, and they simply do not and will not respond to their security line. Olivia Newton at NBC I believe even reached out, and she could not get them to get back to her. I forwarded this (really another bucket of equal content still lurking out there) several times to Brian Krebs but he never responded. I only mention his name because it has happened before and find it somewhat damaging to the community and it needs to be called out (with fill acknowledgement that journalists get hit up by PR ppl all the time and it’s a tough job).

Re: Privacy analysis of Tiktok’s app and website

#67
post #47

Earlier quoted context omitted.

Can, practically speaking, European governments enforce GDPR with ByteDance?

Yes. ByteDance does business in Europe and therefore is subject to EU law.

> ByteDance does business in Europe and therefore is subject to EU law

Legally, yes. Practically, I’m not sure the EU could block a major Chinese app from its market for fear of retaliation.

Re: Privacy analysis of Tiktok’s app and website

#68
"They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware."

Why the fuck does this still work? People are complaining about all those websites that use it, but ignore the fact that it can be mostly fixed by changing 2 applications (Chrome and Firefox).

Re: Privacy analysis of Tiktok’s app and website

#69
post #35

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…

I may be wrong, but these add-ons seem shady to me. The website pointed to as the homepage is an add-ridden site that is supposedly a community for open-source development, but all the links to 'fork me on GitHub' don't go anywhere. I can't find the source at all. This topic comes up often but these have never been posted and the add-ons have relatively few users (4k, 1.5k, 2k and 0.7k).

I don't know anything about browser add-ons. Perhaps someone who does could take a look and see what's up?

Re: Privacy analysis of Tiktok’s app and website

#70

I think this says all we need to know: http://pro-tiktok.s3.amazonaws.com Notice the file left in there by a previous explorer of the internet. This gentleman has even found RCE exploits with TikTok, and they simply do not and will not respond to their security line. Olivia Newton at NBC I believe even reached out, and she could not get them to get back to her. I forwarded this (really another bucket of equal content…

Just because the bucket says "tiktok" in the name, doesn't mean it's in any way associated with them. This appears to be ~1000 videos, anything particularly interesting about it?

(My company gets many such reports; sadly researchers often strongly insist otherwise)

Post reply on HN