Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

171–180 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#171

Post by Xeanort »

shakna wrote: post #142
iudqnolq wrote: post #137

Earlier quoted context omitted.

Exposing the window size is needed for many festures. CSS media queries change what's displayed based on the screen size, and pure css can cause effects that can be independently measured (set a css property and the read it with JS and log the result, or have the css load a background image with tracking data embedded in ths url). Webapps that manually position elements using JavaScript use the API as well. It's also…

CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that. The only place that needs it, are those JS apps that manually position items. Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all tho…

False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs.

[1] https://github.com/jbtronics/CrookedStyleSheets

[2] https://github.com/maxchehab/CSS-Keylogging

Re: Privacy analysis of Tiktok’s app and website

#172

Post by temp_account75 »

Wowfunhappy wrote: post #6
tcd wrote: post #4

As more time passes I begin to fundamentally believe the modern Internet isn't compatible with the GDPR or privacy as a whole. Simply the act of enabling JS within the browser is enough to have your privacy violated in thousands of different ways and data sucked up by everyone who wants it. Simply by installing an app on your smart phone you invite SDK's that are happy to report back all the information the OS freely…

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites). That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet. It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for peop…

(working in the field and away from my computer so using a throaway)

Basically you have two different laws that apply here. Eprivacy and the GDPR:

* Eprivacy has been updated in 2009 and says that you need consent of the user for any read/write operation in the user terminal, unless it has been specifically requested by the user. The wording is strange, but it has been interpreted mostly as being about cookies and any other sorts of tracers. That includes fingerprinting. The thing is, it is a directive, so each European country transcribed it slightly differently! Sometimes, the national DPA (data protection agency) does not even have the authority to apply this law. This is the infamous "cookie banner" law. Note that all login cookies, cart cookies, consent cookies are generally regarded as exempted since they are needed to provide the service asked for by the user.

* The GDPR that everybody knows.

The thing is, since the GDPR, the consensus among DPAs has been that the consent used in Eprivacy is in fact the "GDPR consent" (freely given, no negative consequence, easy to withdraw, requires a positive act, and so on). This is a major change, because most cookie banners used now don't have those characteristics. Keep on scrolling to consent won't fly. "I consent"/"more option" buttons won't fly. "Use you browser settings to block cookie if you don't like it" won't fly. Cookie walls won't fly.

This is the current interpretation of the law among most DPAs. And yes, most website are violating it, but in the sense of Eprivacy, not the GDPR. The non harmonization on the European level makes it harder to engage in repressive action but I have faith that this will soon change.

In the case described by the article, you would need a GDPR consent to carry on fingerprinting, so TikTok is in violation of EPrivacy. When DPAs will start repression, they could be targeted for that.

My two cents!

Re: Privacy analysis of Tiktok’s app and website

#173

Post by wizzwizz4 »

sjy wrote: post #127
namelosw wrote: post #101

Earlier quoted context omitted.

Not defending anyone but I have to point out that fingerprinting sounds like finding a fingerprint that could identify an individual, but that not true. AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual.…

I’m not too sure what “99.5% accuracy” is supposed to mean, but sites like https://amiunique.org usually tell me that my browser fingerprint is unique. Seems rather like a real fingerprint to me, except that I have more than one.

You have more than one real fingerprint, too.

Re: Privacy analysis of Tiktok’s app and website

#174

Post by wizzwizz4 »

sudosysgen wrote: post #112
mmcwilliams wrote: post #78

Earlier quoted context omitted.

It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.

Time to add random delay and noise then.

I believe Firefox adds random delays, if you enable one of the Tracking Protection settings.

Re: Privacy analysis of Tiktok’s app and website

#175

Post by Wowfunhappy »

temp_account75 wrote: post #172
Wowfunhappy wrote: post #6

Earlier quoted context omitted.

> The GDPR helps, a little, in some ways, but it's really had very very little effect overall (apart from some damn annoying "we respect your privacy" pop-ups on websites). That's because—as far as I can tell—the EU has not become serious about enforcing the law. At least not yet. It is absolutely possible to pass a law that says "you can't track people", and that's what the GDPR does. It has a semi-loophole for peop…

(working in the field and away from my computer so using a throaway) Basically you have two different laws that apply here. Eprivacy and the GDPR: * Eprivacy has been updated in 2009 and says that you need consent of the user for any read/write operation in the user terminal, unless it has been specifically requested by the user. The wording is strange, but it has been interpreted mostly as being about cookies and an…

Thank you, but I'm a bit confused. You lost me here:

> And yes, most website are violating it, but in the sense of Eprivacy, not the GDPR.

From what I understand of your post, GDPR has basically superseded the old Eprivacy law, because it requires the same things and then more on top.

Re: Privacy analysis of Tiktok’s app and website

#176

Post by temp_account75 »

Wowfunhappy wrote: post #175
temp_account75 wrote: post #172

Earlier quoted context omitted.

(working in the field and away from my computer so using a throaway) Basically you have two different laws that apply here. Eprivacy and the GDPR: * Eprivacy has been updated in 2009 and says that you need consent of the user for any read/write operation in the user terminal, unless it has been specifically requested by the user. The wording is strange, but it has been interpreted mostly as being about cookies and an…

Thank you, but I'm a bit confused. You lost me here: > And yes, most website are violating it, but in the sense of Eprivacy, not the GDPR. From what I understand of your post, GDPR has basically superseded the old Eprivacy law, because it requires the same things and then more on top.

Sorry about that. They are violating Eprivacy, not the GDPR, because they are dropping tracers without proper consent. But they are violating it because the consent they are collecting is not valid in the definition given in the GDPR. The previous understanding of Eprivacy (before the GPDR) admitted a "soft consent", ie "keep reading and you consent". That is not longer the case because of GDPR.

What they do with the data they collect is subject to the GPDR, but the use of tracers without consent is subject to Eprivacy.

Hope it's more understandable!

Re: Privacy analysis of Tiktok’s app and website

#177

Post by shakna »

gilfillan9 wrote: post #169
shakna wrote: post #142

Earlier quoted context omitted.

CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that. The only place that needs it, are those JS apps that manually position items. Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all tho…

CSS media queries themselves don't have the capability to send any tracking information back, but the effects they cause absolutely do. Consider: @media (min-width: 600px) { .pixel { background-image: url("/pixel?width=600"); } } @media (min-width: 700px) { .pixel { background-image: url("/pixel?width=700"); } } You could add as many of these media queries as you like to increase the resolution of your tracking. Comb…

That's still more finite than what JS can report, and can be easily broken by browser prefetching. (And could have performance implications that could drive users away.)

Whilst it's better-than-nothing fingerprinting, it is still far less effective than JS having access to the window and height properties directly.

Re: Privacy analysis of Tiktok’s app and website

#178

Post by shakna »

Xeanort wrote: post #171
shakna wrote: post #142

Earlier quoted context omitted.

CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that. The only place that needs it, are those JS apps that manually position items. Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all tho…

False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs. [1] https://github.com/jbtronics/CrookedStyleSheets [2] https://github.com/maxchehab/CSS-Keylogging

Both those methods rely on the browser not prefetching certain resources, which they are absolutely allowed to prefetch.

So if a browser changes the prefetching algo, the method is immediately broken. (For example enabling network.predictor.enable-prefetch in Firefox).

It isn't an inherent weakness of CSS itself.

Re: Privacy analysis of Tiktok’s app and website

#179

Post by iudqnolq »

sgn wrote: post #170
iudqnolq wrote: post #132

Earlier quoted context omitted.

In Firefox, setting privacy.resistFingerprinting = true in about:config fixes the canvas leak and possibly the audio leak. It's part of a push to bring into Firefox privacy features from the TOR project. https://wiki.mozilla.org/Security/Fingerprinting

Firefox 58+ blocks canvas by default. We don't need to change about:config for Canvas tracking. Not sure about the status of AudioContext tracking, though.

Are you sure about this? SO says no: https://superuser.com/questions/1416419/how-can-i-block-html...

Re: Privacy analysis of Tiktok’s app and website

#180

Post by iudqnolq »

animesh wrote: post #162
iudqnolq wrote: post #132

Earlier quoted context omitted.

In Firefox, setting privacy.resistFingerprinting = true in about:config fixes the canvas leak and possibly the audio leak. It's part of a push to bring into Firefox privacy features from the TOR project. https://wiki.mozilla.org/Security/Fingerprinting

I don't know about fixing canvas and audioleak, but it reset browser zoom to 100% on every load of any website say HN. This is pretty annoying.

Try this recommended extension: https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we/
Post reply on HN