Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

151–160 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#151

Post by kbenson »

shakna wrote: post #145
kbenson wrote: post #143

Earlier quoted context omitted.

We're talking about a theoretical situation where we gate the canvas and audio api behind a permission prompt. My "presumably" is about how that would be theoretically implemented.

Why would gating the API behind the Permissions API change what is currently considered permission by the Browser? That'd require rewriting the API itself.

Gating the API behind a permissions dialog or permission setting. The difference being that an end site either uses it and gets valid data (because the user allowed it, the default without a dialog today), or gets errors letting them know the data can't be relied upon.

If you visit a random internet site and get a prompt for the audio API are you going to allow it? Probably not, especially if you think it's just so the site can be obnoxious with sounds or listen to you.

The canvas api might be a little more likely to be allowed by the average person, but enough might disallow or ask about it that sites that have a valid use for it will put up a banner noting why it's important, making sites using it for tracking stand out all the more.

The bottom line is that we're coming to an understanding (well, it's been known for years) that each additional browser feature has downsides, so making them enabled by default has repercussions.

Re: Privacy analysis of Tiktok’s app and website

#152

Post by stinos »

iudqnolq wrote: post #132
hombre_fatal wrote: post #21

Earlier quoted context omitted.

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

In Firefox, setting privacy.resistFingerprinting = true in about:config fixes the canvas leak and possibly the audio leak. It's part of a push to bring into Firefox privacy features from the TOR project. https://wiki.mozilla.org/Security/Fingerprinting

I really want to do this, but last time I checked it also leads to FF sending UTC time back to sites (or something like that), resulting in showing non-local time for your own and other interactions on pretty much all sites like github/slack/... Fairly annoying. I hope this becomes a separate setting at one point.

Re: Privacy analysis of Tiktok’s app and website

#153

Post by shakna »

kbenson wrote: post #151
shakna wrote: post #145

Earlier quoted context omitted.

Why would gating the API behind the Permissions API change what is currently considered permission by the Browser? That'd require rewriting the API itself.

Gating the API behind a permissions dialog or permission setting . The difference being that an end site either uses it and gets valid data (because the user allowed it, the default without a dialog today), or gets errors letting them know the data can't be relied upon. If you visit a random internet site and get a prompt for the audio API are you going to allow it? Probably not, especially if you think it's just so…

> Gating the API behind a permissions dialog or permission setting.

Those dialogs and settings are controlled by the Permissions API today.

> If you visit a random internet site and get a prompt for the audio API are you going to allow it? Probably not, especially if you think it's just so the site can be obnoxious with sounds or listen to you.

You and I might disable it. Overwhelmingly, the majority of the public click "enable" or "yes" on permission pop-ups. And tend to make sure "enable forever" is ticked.

> The bottom line is that we're coming to an understanding (well, it's been known for years) that each additional browser feature has downsides, so making them enabled by default has repercussions.

I don't disagree. The problem here is that the permission model itself has been broken, and won't be repaired because of backwards compatibility, and a lack of incentive.

Re: Privacy analysis of Tiktok’s app and website

#154

Post by HunOL »

SeriousM wrote: post #146
yding wrote: post #44

The GDPR law is complex, but I'm 99% sure that this guy is misinterpreting it here. Sending data to Google, FaceBook and AppsFlyer (and other American companies) is generally legal under GDPR. All three companies are covered under the US-EU Privacy Shield framework: https://www.privacyshield.gov/participant_search Furthermore, sending PII data to a non-EU country is also allowed under GDPR as long as the company in q…

Even though these practices may be legal you'll agree that 99% of the people here are not ok with them. It's not needed to send personal data around the world for tracking. The core functionality of tiktok doesn't need that at all.

> Even though these practices may be legal you'll agree that 99% of the people here are not ok with them

Sad truth is that they are not ok with it only because it's TikTok and it has Chinese origin.

Re: Privacy analysis of Tiktok’s app and website

#155

Post by rufposten »

yding wrote: post #44

The GDPR law is complex, but I'm 99% sure that this guy is misinterpreting it here. Sending data to Google, FaceBook and AppsFlyer (and other American companies) is generally legal under GDPR. All three companies are covered under the US-EU Privacy Shield framework: https://www.privacyshield.gov/participant_search Furthermore, sending PII data to a non-EU country is also allowed under GDPR as long as the company in q…

I'm the author and even if I know GDPR quite well as professional journalist I know I can't interprete a law on my own, so I additionally asked an legal expert in this field. So this is what he explained:

1. Sending data to Appsflyer is OK in general, but you have to declare to which parties the data will be sent afterwards. As most of the partners will be joint controllers of the data you have to lay open the arrangements with ALL joint controllers: "The arrangement may designate a contact point for data subjects. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject." Tiktok just denied to show any arrangements.

2. Sending data to Facebook is ok in general, but here it's without consent, so it must be covered by legitimate interests. This has to be balanced with the interests of the user and two crucial points are how invasive and how transparent a data procesing is. Sending your search terms to a company you don't even know it's involved and de-anonymising you in the same time (in case you have a app of facebook inc. on your smartphone) hardly can be legitimate interest.

3. Sending data to a non-EU country is OK, but only if the country is secure. This is indeed complex, but: ECJ ruled, that if public authorities have access on a generalised basis to the content of electronic communications, it's not ok, it's even a FUNDAMENTAL violation of the privacy of the users.

4. Browser/Device-Fingerprinting is legally ok. But I doubt that it is used for anti-fraud/security. If it's used for tracking, they probably need consent.

Re: Privacy analysis of Tiktok’s app and website

#156

Post by [deleted] »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

[deleted]

Re: Privacy analysis of Tiktok’s app and website

#157

Post by stiray »

hombre_fatal wrote: post #21
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

Ok, how to fix fingerprinting:

- for web, stop using chrome, install firefox (or firefox mobile) and in about:config set privacy.resistFingerprinting on true then add following addons:

https://addons.mozilla.org/en-US/android/addon/canvas-finger...

https://addons.mozilla.org/en-US/android/addon/audioctx-fing...

https://addons.mozilla.org/en-US/android/addon/webgl-fingerp...

https://addons.mozilla.org/en-US/android/addon/font-fingerpr...

They will not only prevent fingerprints but also screw with the data (add random noise to audio/webgl sample, return random fonts,...).

- the most important rule, don't use applications like tiktok, fb,.. if your phone is not rooted, with xprivacylua (https://github.com/M66B/XPrivacyLua, for added kicks https://github.com/M66B/NetGuard) installed and you have basic understanding what you allow there (disallow everything for new apps and work permissions one by one). The sole purpose of those apps and their bussiness model is to steal your data. This is most sane advice I can give, sorry :(

Voila. Solved.

Those methods of fingerprinting are few years old and well known.

Re: Privacy analysis of Tiktok’s app and website

#159

Post by yorwba »

Beefin wrote: post #117
bduerst wrote: post #55

Earlier quoted context omitted.

TikTok has said that their TikTok China and TikTok elsewhere apps keep their app and user data completely separate (in both data centers and policy). Kind of like how Apple complies with iCloud China and Apple iCloud everywhere else . Source: https://www.reuters.com/article/us-usa-tiktok-army/army-exam...

How is it possible that there be two separate silos when I can follow someone in China despite being in the US

The person in China can use TikTok (international) or you can use Douyin (Chinese), putting the two of you in the same silo.
Post reply on HN