Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

111–120 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#111

Post by sudosysgen »

saagarjha wrote: post #99
kbenson wrote: post #97

Earlier quoted context omitted.

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

> Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. I don't want my browser to keep changing its screen size. > All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it s…

The attacker would be shifting screen sizes, in the given justification of bots.

Re: Privacy analysis of Tiktok’s app and website

#112

Post by sudosysgen »

mmcwilliams wrote: post #78
munk-a wrote: post #54

Earlier quoted context omitted.

And I assume that different audio drivers and software will produce minutely different outputs. It's also possible that they're queueing a sound to be played then canceling the sound after reading the raw computed signal out of the buffer. Sleezy sleezy crap.

It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.

Time to add random delay and noise then.

Re: Privacy analysis of Tiktok’s app and website

#113

Post by sudosysgen »

JumpCrisscross wrote: post #67
yding wrote: post #47

Earlier quoted context omitted.

Yes. ByteDance does business in Europe and therefore is subject to EU law.

> ByteDance does business in Europe and therefore is subject to EU law Legally, yes. Practically, I’m not sure the EU could block a major Chinese app from its market for fear of retaliation.

They just have to give it a massive fine. Then they can block it for failure to pay.

Re: Privacy analysis of Tiktok’s app and website

#115

Post by anaganisk »

RiOuseR wrote: post #114

Got a confirmation code via sms the other day to confirm the set up of my account... that I never signed up. Either a bot is making accounts, or Tik Tok got a list of phone numbers and is making accounts for people.

Matt be someone made a typo and ended up everything yours. Doesn't have to be a shady thing done by tiktok

Re: Privacy analysis of Tiktok’s app and website

#116

Post by bagacrap »

baybal2 wrote: post #19
harryf wrote: post #12

Three of the main things he calls out are caused by embedding of the Facebook SDK, the Google Analytics SDK and AppsFlyer SDK. The most worrying one IMO is actually AppsFlyer - I doubt they have the resources to properly protect the data they're collecting. It might be more effective to go after the companies providing the SDKs rather than individual apps, to have a real impact. But OK this was for a news story about…

Going back to Google's knowing and willing abetting of hardware ID abuse. I heard it many times that Google knows that a lot of Chinese companies violate their play store policy against using hardware IDs for advertising purposes. If they stand against it, why they added APIs for accessing them in the first place? I thought about that for a long time, and finally it struck me: Google very well knows that GDPR prohibi…

TFA goes into depth about how the fingerprinting is done and it does not rely on any Android API.

Re: Privacy analysis of Tiktok’s app and website

#117

Post by Beefin »

bduerst wrote: post #55
seppin wrote: post #46

Earlier quoted context omitted.

Yes, they don't give the data they harvest to an authoritarian government that already has proven they will use said data to target and ID people for arrest/detention/torture. Which is an important distinction.

TikTok has said that their TikTok China and TikTok elsewhere apps keep their app and user data completely separate (in both data centers and policy). Kind of like how Apple complies with iCloud China and Apple iCloud everywhere else . Source: https://www.reuters.com/article/us-usa-tiktok-army/army-exam...

How is it possible that there be two separate silos when I can follow someone in China despite being in the US

Re: Privacy analysis of Tiktok’s app and website

#118

Post by bagacrap »

billfruit wrote: post #110

"Personal Identifying Information (PII) is transfered to a server that is under control of a company in an unsecure noneuropean country. The server location doesn’t count, it is about where the company deciding about the data resides." I find problematic that such a restriction is in place, what of PII was sent to a European company, is that a problem? What if the ownership of the company changes? This kind of data l…

I assume this law effectively bars certain mergers or acquisitions as illegal.

Re: Privacy analysis of Tiktok’s app and website

#119

Post by danShumway »

sm4rk0 wrote: post #35

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…

I would lightly recommend avoiding these addons and turning on fingerprinting protection in Firefox instead.

> about:config

> resistfingerprinting -> true

> webgl.disabled -> true

Firefox's fingerprinting protection will block canvas fingerprinting by default (put it behind a prompt). It will also spoof your installed fonts. The second setting I listed will take care of webGL, although it won't be behind a prompt, so it's annoying to re-enable for the (very few) sites that need it. I think resistfingerprinting also handles audio fingerprinting, but I'm not completely sure. I do know it reduces timer precision and a few other things.

Firefox's fingerprinting tools are being uplifted from Tor, which means people who care a lot about this and have a lot of experience in what actually helps are working on it. I am cautious of random extensions even if they're not malicious; it's very easy to get this stuff wrong and accidentally open up a new fingerprinting vector instead.

If you are going to install a new extension, install UMatrix and block Javascript by default. That won't help you with a site like Tiktok's since you'll need to turn Javascript back on for them. But a nontrivial portion of the web works without Javascript, and it really does reduce the number of attack vectors you have.

I keep my extension list very small: Ublock Origin, UMatrix, DecentralEyes, and HTTPS Everywhere. Extension sandboxing is very bad, so I don't like to install new extensions if I can help it. Firefox profiles are very cool and potentially very useful, but I don't currently use them. Maybe that will change in the future.

Post reply on HN