Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

121–130 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#121

Post by thinkloop »

hombre_fatal wrote: post #21
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

> Doesn't help that legislators are absolutely clueless here.

You're a world-leading computerist and you had no clue either (nor I), how in the world are legislators supposed to do this. It's a fundamental problem. And once it's finally legislated the sme's are already on the next thing.

Re: Privacy analysis of Tiktok’s app and website

#122

Post by kbenson »

saagarjha wrote: post #99
kbenson wrote: post #97

Earlier quoted context omitted.

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

> Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. I don't want my browser to keep changing its screen size. > All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it s…

> I don't want my browser to keep changing its screen size.

Neither do I. I'm taking about how useless it is to use these metrics to identify bots, sine any bot can easily circumvent them, and with far more less hassle than a user.

The fingerprinting is "for" fraud, but is not very useful in that context. The fallout is that all our privacy is worse though.

> I disagree ... the fact that they haven't been able to eliminate it

They haven't eliminated it because it still works well enough on end users, even though the narrative is that it's to prevent fraud.

Fingerprinting works for users, but for any halfway competent adversary it's close to useless. Just keep that in mind when it's brought up as a solution to fraud and that's why it's worth allowing.

Re: Privacy analysis of Tiktok’s app and website

#124

Post by meddlepal »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Congressional hearings are political theater. Theyre not meant to accomplish anything.

Re: Privacy analysis of Tiktok’s app and website

#125

Post by decebalus1 »

danShumway wrote: post #119
sm4rk0 wrote: post #35

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…

I would lightly recommend avoiding these addons and turning on fingerprinting protection in Firefox instead. > about:config > resistfingerprinting -> true > webgl.disabled -> true Firefox's fingerprinting protection will block canvas fingerprinting by default (put it behind a prompt). It will also spoof your installed fonts. The second setting I listed will take care of webGL, although it won't be behind a prompt, so…

> I would lightly recommend avoiding these addons and turning on fingerprinting protection in Firefox instead.

A word of caution, this will tell all websites you're on UTC so it will break several things (fitness trackers, github reports, etc..). If you're banging your head against the wall (like I did) because you can't figure out why everyone thinks you're on UTC, it's because of this.

Re: Privacy analysis of Tiktok’s app and website

#126

Post by danShumway »

decebalus1 wrote: post #125
danShumway wrote: post #119

Earlier quoted context omitted.

I would lightly recommend avoiding these addons and turning on fingerprinting protection in Firefox instead. > about:config > resistfingerprinting -> true > webgl.disabled -> true Firefox's fingerprinting protection will block canvas fingerprinting by default (put it behind a prompt). It will also spoof your installed fonts. The second setting I listed will take care of webGL, although it won't be behind a prompt, so…

> I would lightly recommend avoiding these addons and turning on fingerprinting protection in Firefox instead. A word of caution, this will tell all websites you're on UTC so it will break several things (fitness trackers, github reports, etc..). If you're banging your head against the wall (like I did) because you can't figure out why everyone thinks you're on UTC, it's because of this.

That's true, it can be really annoying, especially when you don't know the cause. On the plus side, it means I've now picked up a new skill that I didn't originally need or want.

I've also found, like, 3 date bugs in an application where I was assuming that that the server and the client would be in the same time zone.

Re: Privacy analysis of Tiktok’s app and website

#127

Post by sjy »

namelosw wrote: post #101
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Not defending anyone but I have to point out that fingerprinting sounds like finding a fingerprint that could identify an individual, but that not true. AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual.…

I’m not too sure what “99.5% accuracy” is supposed to mean, but sites like https://amiunique.org usually tell me that my browser fingerprint is unique. Seems rather like a real fingerprint to me, except that I have more than one.

Re: Privacy analysis of Tiktok’s app and website

#128

Post by bayarrhea »

kbenson wrote: post #97
yding wrote: post #51

Earlier quoted context omitted.

This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which i…

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

Ah yes, so trivial. That must explain why millions of people are doing it and we have perfect privacy online. Who knew perfect privacy was one hackathon away the whole time?

Re: Privacy analysis of Tiktok’s app and website

#129

Post by sjy »

applecrazy wrote: post #20

I'm curious what device data is sent from the app. Are they using any private APIs to extract data from mobile users as well? That would be even more insidious, since it's hard to analyze that. I tried decompiling the Android version of the app, but I'm not a mobile dev and don't know where to look to analyze its data collection behavior. I also considered using mitmproxy (like the OP) to analyze transmitted data fro…

If you’re interested in exploring this, the university network shouldn’t be a problem if you create a private network between your laptop and phone and connect the phone to the internet using NAT on the laptop. The Internet Sharing feature in macOS makes this pretty easy.

Re: Privacy analysis of Tiktok’s app and website

#130

Post by sjy »

Wowfunhappy wrote: post #14
jandrese wrote: post #11

Earlier quoted context omitted.

Are cookies violating if they don't leave the website? It doesn't seem to be a problem as long as the cookie is only used within the context of your site. It's when they're used on other websites that the tracking capabilities exceed what you can otherwise glean from the server logs. Plus, they're kind of important for sites that provide logins, or have shopping carts, or a variety of other legitimate uses for cookie…

Cookies aren't inherently against GDPR if they're used explicitly for necessary site functionality—you don't even need to tell users about them in that case. What's not allowed is user tracking.

So why display the cookie warning? I assume it’s an attempt to obtain “consent” to something that would otherwise be prohibited by the GDPR, and in relation to consent the GDPR says:

“Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment ... Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.”

I agree with the grandparent that many cookie warnings seem at odds with the GDPR in this respect.

Post reply on HN