Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

131–140 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#131

Post by zaphirplane »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

This is interesting because a cookie with a uuid is probably a better tracker, specially with shared computers. I know cookies can be deleted but expect the majority of their users wouldn’t be deleting cookies or using ad blockers

Re: Privacy analysis of Tiktok’s app and website

#132

Post by iudqnolq »

hombre_fatal wrote: post #21
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

In Firefox, setting privacy.resistFingerprinting = true in about:config fixes the canvas leak and possibly the audio leak. It's part of a push to bring into Firefox privacy features from the TOR project.

https://wiki.mozilla.org/Security/Fingerprinting

Re: Privacy analysis of Tiktok’s app and website

#133

Post by shakna »

kbenson wrote: post #92
ehsankia wrote: post #88

Earlier quoted context omitted.

> And the few websites that do can explain why you should click "Allow" when they prompt you for access. You missed it, this doesn't require an Allow, because it's not actually accessing the microphone. It's using the audio APIs to generate a waveform, and depending on your computer/DSP, the waveform will be slightly different. It's not using any of your computers sensors https://news.ycombinator.com/item?id=21436414

> You missed it, this doesn't require an Allow, because it's not actually accessing the microphone. Presumably, without an allow the API doesn't function at all, so it works perfectly well. When denied access, the API should either not exist, or (more appropriately) just return errors.

> Presumably, without an allow the API doesn't function at all

An incorrect presumption. The API works perfectly fine without the need for permissions.

This is not a new technique. There's a decent write up here [0].

Permissions are only required to play to the actual device, or record from the actual device. Recording from nothing and not playing is allowed.

[0] https://iq.opengenus.org/audio-fingerprinting/

Re: Privacy analysis of Tiktok’s app and website

#134

Post by iudqnolq »

saagarjha wrote: post #99
kbenson wrote: post #97

Earlier quoted context omitted.

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

> Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. I don't want my browser to keep changing its screen size. > All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it s…

TOR makes the most usability compromising security choices of any browser and even they don't have a fixed window size to avoid any fingerprinting here.

They do prevent manually resizing the window because the exact width could be used to rack you across sites in the same windows.

Re: Privacy analysis of Tiktok’s app and website

#135

Post by applecrazy »

sjy wrote: post #129
applecrazy wrote: post #20

I'm curious what device data is sent from the app. Are they using any private APIs to extract data from mobile users as well? That would be even more insidious, since it's hard to analyze that. I tried decompiling the Android version of the app, but I'm not a mobile dev and don't know where to look to analyze its data collection behavior. I also considered using mitmproxy (like the OP) to analyze transmitted data fro…

If you’re interested in exploring this, the university network shouldn’t be a problem if you create a private network between your laptop and phone and connect the phone to the internet using NAT on the laptop. The Internet Sharing feature in macOS makes this pretty easy.

Thanks, I forgot about this. Looking to explore and report findings post-finals

Re: Privacy analysis of Tiktok’s app and website

#136

Post by iudqnolq »

m463 wrote: post #40
the_pwner224 wrote: post #18

Earlier quoted context omitted.

I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.

I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox. Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)

The setting in Firefox about:config privacy.resistFingerprinting includes mitigations for some canvas fingerprinting attacks. It's part of a push to bring into Firefox privacy features from the TOR project.

https://wiki.mozilla.org/Security/Fingerprinting

Re: Privacy analysis of Tiktok’s app and website

#137

Post by iudqnolq »

inetknght wrote: post #91
commoner wrote: post #85

Earlier quoted context omitted.

privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects. https://wiki.mozilla.org/Security/Fingerprinting For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.

That shouldn't be necessary if the browser didn't report accurate window sizing information

Exposing the window size is needed for many festures. CSS media queries change what's displayed based on the screen size, and pure css can cause effects that can be independently measured (set a css property and the read it with JS and log the result, or have the css load a background image with tracking data embedded in ths url). Webapps that manually position elements using JavaScript use the API as well.

It's also he extremely hard to prevent any way of getting at it. For example, I could measure if a line of text overflows and by how much.

Re: Privacy analysis of Tiktok’s app and website

#138

Post by sm4rk0 »

hoorayimhelping wrote: post #49
sm4rk0 wrote: post #35

I'm using these four Firefox addons in addition to uBlock Origin and Cookie AutoDelete: (Canvas|WebGL|AudioContext|Font) Fingerprint Defender They report and seem to block fingerprinting attempts. https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-U…

These links have android in the url, which makes me think they're for the android version of firefox. Either way, those links allowed me to install the extensions on desktop Firefox on Windows, so it's all good.

I wrote the comment on an Android phone - that's why "android" in URLs.

Re: Privacy analysis of Tiktok’s app and website

#139

Post by kbenson »

bayarrhea wrote: post #128
kbenson wrote: post #97

Earlier quoted context omitted.

> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling . At least at the level the remote side can see. Screen size is easily configured and/or randomized to som…

Ah yes, so trivial. That must explain why millions of people are doing it and we have perfect privacy online. Who knew perfect privacy was one hackathon away the whole time?

The context of this is that the tracking helps prevent fraud. It's trivial for someone to circumvent it that puts some effort into it, so it doesn't work well for any but the most simple instances of fraud detection.

We all, as end users, pay for this because as an end user it's much more onerous to work around because site specific tweaks to make a site work require a lot of effort.

Re: Privacy analysis of Tiktok’s app and website

#140

Post by hamhand »

RiOuseR wrote: post #114

Got a confirmation code via sms the other day to confirm the set up of my account... that I never signed up. Either a bot is making accounts, or Tik Tok got a list of phone numbers and is making accounts for people.

After seeing all those sketchy or even fraudulent mobile ads by TikTok's company, I won't be surprised if that's a bait.

But pretty much everybody does it in China, Baidu etc, like "You phone has 8GB of garbage, download us to clean it", "Download us to boost your signal by 4 times immediately", "This cutie just sent you a message, download us to repsond", basically anything to make you download their apps, and only political problems go punished.

Post reply on HN