Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

91–100 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#91

Post by inetknght »

commoner wrote: post #85
floatboth wrote: post #80

Earlier quoted context omitted.

Just enable privacy.resistFingerprinting in about:config, no addons needed

privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects. https://wiki.mozilla.org/Security/Fingerprinting For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.

That shouldn't be necessary if the browser didn't report accurate window sizing information

Re: Privacy analysis of Tiktok’s app and website

#92

Post by kbenson »

ehsankia wrote: post #88
hombre_fatal wrote: post #21

Earlier quoted context omitted.

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

> And the few websites that do can explain why you should click "Allow" when they prompt you for access. You missed it, this doesn't require an Allow, because it's not actually accessing the microphone. It's using the audio APIs to generate a waveform, and depending on your computer/DSP, the waveform will be slightly different. It's not using any of your computers sensors https://news.ycombinator.com/item?id=21436414

> You missed it, this doesn't require an Allow, because it's not actually accessing the microphone.

Presumably, without an allow the API doesn't function at all, so it works perfectly well. When denied access, the API should either not exist, or (more appropriately) just return errors.

Re: Privacy analysis of Tiktok’s app and website

#93

Post by bredren »

humaniania wrote: post #82
stfwn wrote: post #69

Earlier quoted context omitted.

I may be wrong, but these add-ons seem shady to me. The website pointed to as the homepage is an add-ridden site that is supposedly a community for open-source development, but all the links to 'fork me on GitHub' don't go anywhere. I can't find the source at all. This topic comes up often but these have never been posted and the add-ons have relatively few users (4k, 1.5k, 2k and 0.7k). I don't know anything about b…

I am extremely cautious about installing any sort of browser extension; especially ones that request such intrusive permissions that could so easily be severely exploited with any given update.

Particularly an extension that wants access to all websites an d their data. Since the browser has very open permissions from the firewall, and these run under those rules it is open season for an extension dev to send out data.

Re: Privacy analysis of Tiktok’s app and website

#94

Post by rasz »

dhimes wrote: post #48
m463 wrote: post #40

Earlier quoted context omitted.

I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox. Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)

Could there be some way to randomize the canvas and audio fingerprints? An extension that obfuscates them in some sense by sending false signals? Edit: Perhaps overloading the toDataURL() function to add random noise. https://browserleaks.com/canvas#how-does-it-work

    window.HTMLCanvasElement.prototype.toDataURL = undefined;
    window.CanvasRenderingContext2D.prototype.getImageData = undefined;
kills canvas fingerprinting

Re: Privacy analysis of Tiktok’s app and website

#95

Post by kbenson »

dylz wrote: post #39
hombre_fatal wrote: post #21

Earlier quoted context omitted.

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

> What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? In my experience, blocking these everywhere globally as a default will result in being banned from websites, trigger bullshit "fraud" invasive analytics, and all sorts of obnoxious fail-closed problems by invasive trackers. You will also be banned from most Distil-hosted sit…

If a large enough chunk of people do it, then it becomes unfeasible to block them all. If Safari, Firefox and Internet Explorer all implemented a block, it doesn't really matter that Chrome doesn't. That's ~30% of browsing traffic, and no sane company with a large web presence is going to throw away 30% of their traffic.

Re: Privacy analysis of Tiktok’s app and website

#96

Post by rasz »

jrcii wrote: post #84
stfwn wrote: post #69

Earlier quoted context omitted.

I may be wrong, but these add-ons seem shady to me. The website pointed to as the homepage is an add-ridden site that is supposedly a community for open-source development, but all the links to 'fork me on GitHub' don't go anywhere. I can't find the source at all. This topic comes up often but these have never been posted and the add-ons have relatively few users (4k, 1.5k, 2k and 0.7k). I don't know anything about b…

I unpacked the XPIs and inspected the JavaScript source. Nothing suspicious (remote URLs, obfuscated code, etc) looking in there.

Do firefox extensions auto update? This is the type of extension I rewrite into my own private Tampermonkey script.

Re: Privacy analysis of Tiktok’s app and website

#97

Post by kbenson »

yding wrote: post #51
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which i…

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.).

Processor performance is variable based on the particular instance you are running on and how much load it is handling. At least at the level the remote side can see.

Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values.

Plugins reported or actually allowed to run can be changed per instance.

All this stuff is trivial with headless chrome and puppeteer, and even abstracted away using the stealth plugin for puppeteer[1]. And headless firefox through puppeteer is experimental

All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat.

1: https://www.npmjs.com/package/puppeteer-extra-plugin-stealth

Re: Privacy analysis of Tiktok’s app and website

#98

Post by Nas808 »

commoner wrote: post #85
floatboth wrote: post #80

Earlier quoted context omitted.

Just enable privacy.resistFingerprinting in about:config, no addons needed

privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects. https://wiki.mozilla.org/Security/Fingerprinting For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.

The only side effect I really notice in everyday browsing with privacy.resistFingerprinting enabled is time. It spoofs the system time zone as UTC which makes it a bit confusing looking at things like sports and TV schedules.

Re: Privacy analysis of Tiktok’s app and website

#99

Post by saagarjha »

kbenson wrote: post #97
yding wrote: post #51

Earlier quoted context omitted.

This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which i…

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

> Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values.

I don't want my browser to keep changing its screen size.

> All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat.

I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it says volumes about how difficult of a problem this is.

Re: Privacy analysis of Tiktok’s app and website

#100

Post by jrcii »

rasz wrote: post #96
jrcii wrote: post #84

Earlier quoted context omitted.

I unpacked the XPIs and inspected the JavaScript source. Nothing suspicious (remote URLs, obfuscated code, etc) looking in there.

Do firefox extensions auto update? This is the type of extension I rewrite into my own private Tampermonkey script.

Auto-update is configurable per extension, so you could shut it off.
Post reply on HN