Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

71–80 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#71

Post by yding »

rb808 wrote: post #63
yding wrote: post #61

Earlier quoted context omitted.

It's an arms race, and the problem is that there are two groups of "bad guys." One group of "bad guys" are the ones who want to track what you're doing even after you've cleared your cookies or track you across different domains or different apps. I would argue that this group is the smaller group, but browsers have been taking actions to make their jobs harder, including the "Facebook fence" that Firefox implemented…

You missed the 3rd group, and that is the people who make Android, spending billions to make a great OS, to make sure they can always track you.

Haha, true. If Sundar ever decided to screw somebody and was willing to use all of Google's data without any care of the legal ramifications, that person would be broke and homeless within the hour. For a lot of people, probably in jail within a couple of days.

Re: Privacy analysis of Tiktok’s app and website

#73

Post by rshnotsecure »

lwf wrote: post #70
rshnotsecure wrote: post #66

I think this says all we need to know: http://pro-tiktok.s3.amazonaws.com Notice the file left in there by a previous explorer of the internet. This gentleman has even found RCE exploits with TikTok, and they simply do not and will not respond to their security line. Olivia Newton at NBC I believe even reached out, and she could not get them to get back to her. I forwarded this (really another bucket of equal content…

Just because the bucket says "tiktok" in the name, doesn't mean it's in any way associated with them. This appears to be ~1000 videos, anything particularly interesting about it? (My company gets many such reports; sadly researchers often strongly insist otherwise)

It is associated with name. A domain held by them had a link record that pointed to this bucket. Also previous acquisitions of TikTok have buckets, currently open, and those have metadata which shows ownership.

Either way, TikTok won’t even respond, which is very sad and absolutely deserves a response so the few researchers don’t have to waste time following up.

NOTE: Your point makes sense though and I’ve run into this before. 100% agree with you and I should have mentioned the anchor link found.

Re: Privacy analysis of Tiktok’s app and website

#75

Post by floo »

gambler wrote: post #68

"They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware." Why the fuck does this still work? People are complaining about all those websites that use it, but ignore the fact that it can be mostly fixed by changing 2 applications (Chrome and Firefox).

Well, I don't know the details. But AFAIK canvas drawing is GPU accelerated.

So I would guess you are effectively fingerprinting the combination of browser and GPU. And that does not sound like its easy to fix on the browser side.

Re: Privacy analysis of Tiktok’s app and website

#76

Post by munk-a »

yding wrote: post #65
munk-a wrote: post #58

Earlier quoted context omitted.

As someone who worked in a field that necessitated some significant anti-fraud measures nope to > Browser/device fingerprinting for anti-fraud is a well established industry practice. Browser makers don't like this practice and have taken steps to make it harder, but the truth is that it's used across the industry. If it's that important to you switch off of the web into an App, require sign-ons against an internal s…

I bet you've never worked on an e-commerce system then because none of your suggestions work against e-commerce fraud, and you'd literally lose all of your money: switch off of the web into an App: Can't just shut down your website. Also, device farms and VM farms are super common so it won't even help. require sign-ons against an internal system for authentication: Sure, you can require your users create an account.…

But here's the thing - it does cost money and customers to properly authenticate people. 2FA will lead to less sign ups but it will give you a more secure user base - in a world where DAU is the number to live and die by then security is compromised in order to help float that DAU stat. For sign-ons collect a per account activation fee or subscription fee - if your goal is to only have real users then enforce that with money, if your goal is to allow people to freely browse your site unless they're abusing your site then yea - that's where fingerprinting comes in, and it comes in because that isn't a solvable problem. If you want to know who your users are you need to be upfront about collecting that information securely and if you want any old joe who gets a link to immediately get sucked into browsing your site and looking at ads then just stop basing your business off of dark user patterns - deliver value, charge fairly for that value, realize that lots of potential business ideas would never be profitable because people simply can't be bothered to actually put out money for that service.

This whole fingerprinting debacle is part of the ad-support web assumption, and the assumption that websites can be entirely ad supported is false outside of exceptional circumstance and certainly highly limiting and concerning for free speech - expecting a business to be ad supported, that's pretty much an impossible dream, we're living in a bubble where advertisers and marketers continue to sell lies about the ratios of converting views to actual sales.

Re: Privacy analysis of Tiktok’s app and website

#77

Post by yding »

JumpCrisscross wrote: post #67
yding wrote: post #47

Earlier quoted context omitted.

Yes. ByteDance does business in Europe and therefore is subject to EU law.

> ByteDance does business in Europe and therefore is subject to EU law Legally, yes. Practically, I’m not sure the EU could block a major Chinese app from its market for fear of retaliation.

India banned TikTok for a few months: https://www.cnn.com/2019/05/02/tech/tiktok-ban-india-users/i...

Re: Privacy analysis of Tiktok’s app and website

#78

Post by mmcwilliams »

munk-a wrote: post #54
ldjb wrote: post #34

Earlier quoted context omitted.

I'm guessing they're using the Web Audio API which allows you to generate audio samples: https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_A...

And I assume that different audio drivers and software will produce minutely different outputs. It's also possible that they're queueing a sound to be played then canceling the sound after reading the raw computed signal out of the buffer. Sleezy sleezy crap.

It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.

Re: Privacy analysis of Tiktok’s app and website

#79

Post by yding »

munk-a wrote: post #76
yding wrote: post #65

Earlier quoted context omitted.

I bet you've never worked on an e-commerce system then because none of your suggestions work against e-commerce fraud, and you'd literally lose all of your money: switch off of the web into an App: Can't just shut down your website. Also, device farms and VM farms are super common so it won't even help. require sign-ons against an internal system for authentication: Sure, you can require your users create an account.…

But here's the thing - it does cost money and customers to properly authenticate people. 2FA will lead to less sign ups but it will give you a more secure user base - in a world where DAU is the number to live and die by then security is compromised in order to help float that DAU stat. For sign-ons collect a per account activation fee or subscription fee - if your goal is to only have real users then enforce that wi…

Like many things in life, the fight between good actors and bad actors online is a state of dynamic equilibrium.

Everybody loses money to fraud, but as long as they invest enough money and resources they can keep those fraud losses to an acceptable level. Because criminals are infinitely creative, the problem will never be "solved." There will always be new moves and new countermoves.

Total security is an illusion. Everyone who's worth hacking or worth defrauding will get hacked or defrauded sooner or later. The people who have made the necessary investments are able the contain the damage. The other ones, or the really unlucky ones, end up dying off.

Re: Privacy analysis of Tiktok’s app and website

#80

Post by floatboth »

commoner wrote: post #72

If you're using Firefox, consider using the CanvasBlocker add-on to reduce the effectiveness of canvas fingerprinting. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker https://github.com/kkapsner/CanvasBlocker

Just enable privacy.resistFingerprinting in about:config, no addons needed
Post reply on HN