Earlier quoted context omitted.
They don't if you have JavaScript disabled ;)
Is it even possible to use TikTok with noscript?
Yes, it’s possible
Privacy analysis of Tiktok’s app and website
191–200 of 207 posts
Re: Privacy analysis of Tiktok’s app and website
#192> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…
This is a genuinely great idea. Other stuff like recording audio, looking at your location, and even annoyances like sending you notifications all require a permission request that appears in the browser chrome. Why doesn't Firefox put other features that impact privacy behind the same barrier?
Re: Privacy analysis of Tiktok’s app and website
#193Just don't use TikTok. The whole purpose of this app is to gather a huge amount of behavioral data (about various themes and topics and how you react to them), enabling China to do political message targetting on par with what Cambridge Analytica did.
Re: Privacy analysis of Tiktok’s app and website
#194Earlier quoted context omitted.
In Firefox, setting privacy.resistFingerprinting = true in about:config fixes the canvas leak and possibly the audio leak. It's part of a push to bring into Firefox privacy features from the TOR project. https://wiki.mozilla.org/Security/Fingerprinting
I really want to do this, but last time I checked it also leads to FF sending UTC time back to sites (or something like that), resulting in showing non-local time for your own and other interactions on pretty much all sites like github/slack/... Fairly annoying. I hope this becomes a separate setting at one point.
I enabled it and Todoist would show me a dialog on every page reload to set my timezone to UTC. After I realized that resistFingerprinting was causing it, I had to disable it.
It would be nice if the settings inside resistFingerprinting were configurable. I understand that the point of it is to make every browser look the same to analytics engine, but having timezones and zoom levels reset is not the best thing.
Re: Privacy analysis of Tiktok’s app and website
#195Earlier quoted context omitted.
Ok, how to fix fingerprinting: - for web, stop using chrome, install firefox (or firefox mobile) and in about:config set privacy.resistFingerprinting on true then add following addons: https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/ad…
Thanks, these look awesome - simple, yet powerful.
Yes, and doing exactly what they should be doing nothing more and nothing less. I love small utilities :)
Re: Privacy analysis of Tiktok’s app and website
#196> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…
Brave is just snake oil. They couldn't ever implement true canvas or audio protection or prevent font or window decoration fingerprinting even if they wanted.
If you want that stuff you use Firefox and enable resistFingerprinting its the only possible way
Re: Privacy analysis of Tiktok’s app and website
#197Earlier quoted context omitted.
> Presumably, without an allow the API doesn't function at all An incorrect presumption. The API works perfectly fine without the need for permissions. This is not a new technique. There's a decent write up here [0]. Permissions are only required to play to the actual device, or record from the actual device. Recording from nothing and not playing is allowed. [0] https://iq.opengenus.org/audio-fingerprinting/
We're talking about a theoretical situation where we gate the canvas and audio api behind a permission prompt. My "presumably" is about how that would be theoretically implemented.
Except prompt spam is a real issue too. Very quickly you can end up like Windows' UAC that basically trains people to blindly click "yes" on any dialog they see. Putting a permission prompt for every tiny little thing a browser can do isn't a good experience for the user, and most people will have no clue what "allow access to canvas/audio api" means.
Re: Privacy analysis of Tiktok’s app and website
#198Earlier quoted context omitted.
We're talking about a theoretical situation where we gate the canvas and audio api behind a permission prompt. My "presumably" is about how that would be theoretically implemented.
Except prompt spam is a real issue too. Very quickly you can end up like Windows' UAC that basically trains people to blindly click "yes" on any dialog they see. Putting a permission prompt for every tiny little thing a browser can do isn't a good experience for the user, and most people will have no clue what "allow access to canvas/audio api" means.
Except that with a prompt for a specific API, you can get specific on when it's appropriate. E.g.
"This website has asked for permission to use the Audio API. If they aren't actively doing audio processing, this may be an attempt to identify and track you. If you haven't been presented by the site with a good reason why to allow this access, and it's not immediately obvious (such as for a music service), consider whether you want them to have access."
This accomplishes a few things. First, it's very clear about the implications and when it's obvious it should be allowed. Second, it gently suggests the default behavior for people should be to deny unless needed. Thirdly, it communicates to sites (through users the appropriate way to ask for permissions if hey have a legitimate reason, which is to let users know why they need access. Lastly, if sites lie to users about why they need access, they can be called out on that. People don't like being lied to.
Re: Privacy analysis of Tiktok’s app and website
#199Earlier quoted context omitted.
Except prompt spam is a real issue too. Very quickly you can end up like Windows' UAC that basically trains people to blindly click "yes" on any dialog they see. Putting a permission prompt for every tiny little thing a browser can do isn't a good experience for the user, and most people will have no clue what "allow access to canvas/audio api" means.
Except that with a prompt for a specific API, you can get specific on when it's appropriate. E.g. "This website has asked for permission to use the Audio API. If they aren't actively doing audio processing, this may be an attempt to identify and track you. If you haven't been presented by the site with a good reason why to allow this access, and it's not immediately obvious (such as for a music service), consider whe…
Now imagine getting 10 of these, as a user who has no idea what those words mean, nor care, because you just want to see the latest meme on Facebook, and you just blindly press Allow on everything and quickly become desensitized to all prompts.
Re: Privacy analysis of Tiktok’s app and website
#200Earlier quoted context omitted.
Yes, they don't give the data they harvest to an authoritarian government that already has proven they will use said data to target and ID people for arrest/detention/torture. Which is an important distinction.
TikTok has said that their TikTok China and TikTok elsewhere apps keep their app and user data completely separate (in both data centers and policy). Kind of like how Apple complies with iCloud China and Apple iCloud everywhere else . Source: https://www.reuters.com/article/us-usa-tiktok-army/army-exam...
And if the CCP asked for access to TikTok's international data, do you think they have the ability to say no?