Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

101–110 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#101

Post by namelosw »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Not defending anyone but I have to point out that fingerprinting sounds like finding a fingerprint that could identify an individual, but that not true.

AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual. A most common use case is like 'Remember me' option when logging in if they haven't switched their device, but they actually can find other devices that have the same fingerprint.

For example, the most widely used library Fingerprintjs2 uses all the factors that can be grab from the browser (Browser agent, CPU, OS, resolution, etc), and generate a hash from those factors. Even their 'pro' version can only claim 99.5% accuracy, though I doubt the number is actually even lower. For 1M people userbase, it's 5000 people for 0.5% of the population.

[0]: https://github.com/Valve/fingerprintjs2

Re: Privacy analysis of Tiktok’s app and website

#102

Post by quotemstr »

commoner wrote: post #85
floatboth wrote: post #80

Earlier quoted context omitted.

Just enable privacy.resistFingerprinting in about:config, no addons needed

privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects. https://wiki.mozilla.org/Security/Fingerprinting For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.

I'm using a 1920x1080 monitor with default panel sizes. So are tens of millions of other people. I totally understand fingerprint resistance, but the maximization restriction is silly in a lot of cases and should be controllable separately.

Re: Privacy analysis of Tiktok’s app and website

#103

Post by Nextgrid »

namelosw wrote: post #101
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Not defending anyone but I have to point out that fingerprinting sounds like finding a fingerprint that could identify an individual, but that not true. AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual.…

Combined with other data points like usage patterns (how the user behaves on the site, which features they use, etc), IP address I'd be confident the resulting fingerprint can be unique.

Re: Privacy analysis of Tiktok’s app and website

#104

Post by Nextgrid »

JumpCrisscross wrote: post #28
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Can, practically speaking, European governments enforce GDPR with ByteDance?

In practice they can't even be bothered to enforce it on EU and US companies so this is a lost cause.

Re: Privacy analysis of Tiktok’s app and website

#105

Post by driverdan »

floatboth wrote: post #80
commoner wrote: post #72

If you're using Firefox, consider using the CanvasBlocker add-on to reduce the effectiveness of canvas fingerprinting. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker https://github.com/kkapsner/CanvasBlocker

Just enable privacy.resistFingerprinting in about:config, no addons needed

Unfortunately this sets the timezone to UTC which breaks calendar alerts and all timestamps.

Re: Privacy analysis of Tiktok’s app and website

#106

Post by _lqaf »

yding wrote: post #71
rb808 wrote: post #63

Earlier quoted context omitted.

You missed the 3rd group, and that is the people who make Android, spending billions to make a great OS, to make sure they can always track you.

Haha, true. If Sundar ever decided to screw somebody and was willing to use all of Google's data without any care of the legal ramifications, that person would be broke and homeless within the hour. For a lot of people, probably in jail within a couple of days.

That's why I consider Google, FB, and these other surveillance-capitalists data-Superfund sites.

There are massive amounts of jail sentences, international incidents (probably including potential wars), murders, divorces, and destroyed relationships in those silos just waiting to come out.

Re: Privacy analysis of Tiktok’s app and website

#107

Post by judge2020 »

ChaseT wrote: post #86

Does this violate any of the Google or Apple's Play Store TOS? People are calling for the government to step in but a quicker move would be to remove them from the app store; at least if there's a violation.

All SDKs should be respecting 'limit ad tracking' and should respect when you reset the advertising ID, but these fingerprinting techniques are fishy.

Re: Privacy analysis of Tiktok’s app and website

#108

Post by 1f60c »

sm4rk0 wrote: post #35

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…

The problem with that, though, is that you are one of the few people doing that, which makes you easier to target, which defeats the purpose.

I guess a real solution would have to come from a collaboration between all browser vendors, like always returning a fixed value when these tricks are detected.

Re: Privacy analysis of Tiktok’s app and website

#109

Post by dasil003 »

kbenson wrote: post #97
yding wrote: post #51

Earlier quoted context omitted.

This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which i…

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

The fingerprinting signal does not necessarily need to be revealed to the fraudulent actor in order to be useful. It’s a cat and mouse game, but it’s worth it because of the cash at stake.

Re: Privacy analysis of Tiktok’s app and website

#110

Post by billfruit »

"Personal Identifying Information (PII) is transfered to a server that is under control of a company in an unsecure noneuropean country. The server location doesn’t count, it is about where the company deciding about the data resides."

I find problematic that such a restriction is in place, what of PII was sent to a European company, is that a problem? What if the ownership of the company changes?

This kind of data localization requirements go against the concept of an open internet.

Post reply on HN