Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon says email banning TikTok from employee phones was ‘sent in error’

twitter.com

Post reply on HN
Print view View original

431–440 of 496 posts

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#431

Post by thephyber »

vxNsr wrote: post #331
taurath wrote: post #281

Earlier quoted context omitted.

Tiktok isn't imploding, its broadly a bunch of old men (senators, CEOs) afraid of china. The userbase of tiktok is tweens and teens. The best thing those old men could do is legislate system level privacy protections onto IOS and Android so an app can never get the level of info they're worried about.

What does the age or gender of the people have to do with this?

It's the same argument against allowing Congress or the Supreme Court from legislating/ruling on new tech when they don't know how it's used because they don't use it themselves. Age cohorts do actually matter in apps that live or die based on network effects.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#433

Post by scarface74 »

radlad wrote: post #430
scarface74 wrote: post #425

Earlier quoted context omitted.

For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. Your password should never be in your clipboard at least with iOS. If you’re using either the native password manager or a third party password manage…

Android does this too. On neither platform does it work 100% of the time, especially in browsers. That's why almost all clipboard managers also have a "copy to clipboard" feature from the autofill view.

I’ve never had it not work in the browser.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#434

Post by FireBeyond »

scarface74 wrote: post #425
DaiPlusPlus wrote: post #389

Earlier quoted context omitted.

For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff t…

For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. Your password should never be in your clipboard at least with iOS. If you’re using either the native password manager or a third party password manage…

Handoff and 1password, for example. Copy a password on your Mac, and now it's on your phone's clipboard.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#435

Post by thephyber »

ccktlmazeltov wrote: post #315
dvt wrote: post #109

Looks like TikTok is slowly imploding. I know there's plenty of political implications and a lot of discussion here is on that (which is interesting in its own right), but I wonder if there's opportunity here for a potential competitor.

China is blocking all the US apps, I don't see why the US (or US companies that get blocked in China) shouldn't do the same to popular Chinese apps.

Talking about countries versus companies is a different argument depending on whether you are inside or outside Chinese borders.

I'm not at all in favor of the US government banning apps unless the US government publicly and transparently shows the proof of security risk first. Anything short of that just appears to be politics and is likely to just be a negotiation tactic.

I prefer more privacy controls and transparency (which gives consumers / Attorneys General the ability to sue the app company), but I don't want my government to see the Chinese government's policies as the thing we need to compete with.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#436

Post by thephyber »

shripadk wrote: post #183
newguy1234 wrote: post #141

Earlier quoted context omitted.

Probably not. Gen Z is already addicted to it. They like it more than all other social media apps from what I've seen.

Gen Z was addicted to Vine before it. And it will be addicted to anything else that comes after it. No addiction is greater than national security. And the US Government is not obligated to TikTok in any way, shape or form. It can ban without any consideration to the number of people "addicted" to the platform.

> No addiction is greater than national security.

I'm tired of "national security" being thrown around willy nilly. If the US government has proof that this is a security risk, they need to be public and transparent with their proof. Anything short of that and I'm not on board with "a ban".

That said, I agree that young kids and those who compulsively use social networks are fickle and are likely to move onto another network when the current one ceases to keep their attention.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#437

Post by saagarjha »

scarface74 wrote: post #425
DaiPlusPlus wrote: post #389

Earlier quoted context omitted.

For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff t…

For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. Your password should never be in your clipboard at least with iOS. If you’re using either the native password manager or a third party password manage…

I use the native password manager–iCloud Keychain. Sometimes I need to copy passwords out of Settings for the handful of circumstances that it doesn't work.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#438

Post by saagarjha »

GekkePrutser wrote: post #401
che_shirecat wrote: post #393

Earlier quoted context omitted.

So, like LinkedIn and Reddit? (the site that the "researcher" behind these NYT-cited claims is using) [1] You could run through the toplist of apps and find hundreds that exhibit the same behavior. Not trying to derail this via whataboutism, I just feel like the core HN ethos is lost when we mindlessly repeat the obvious geopolitically-driven narrative here without any critical thinking. What I definitely do understa…

That the others are doing it too doesn't make it right. Really Apple should take a stand and give all of them 30 days to fix their apps or get banned. But TikTok annoyed me in particular for a long time. Nothing to do with geopolitics, I already hated it before I knew it was owned by China and everyone started banning it. It was just that for the past months every time someone forwarded me a stupid video I was suppos…

> Really Apple should take a stand and give all of them 30 days to fix their apps or get banned.

Thirty days later the show of brinkmanship ends up with a bunch of iPhone users unhappy that half of their favorite apps work.

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#439

Post by saagarjha »

ehsankia wrote: post #204
nvr219 wrote: post #66

Earlier quoted context omitted.

They're devices that are under Amazon's MDM. So if the device was enrolled with their MDM then it applies.

Right, but on Android at least, you can either have the whole device be under MDM (#2) or just a work profile (#3). In the latter, if your sysadmin decides to wipe your device, it only wipes your Work profile and not your entire phone, from my understanding. Is that not correct? My assumption was that any apps installed on the personal partition were off limit for the MDM.

iOS has this too, it's just that your company has to use it. And many don't…

Re: Amazon says email banning TikTok from employee phones was ‘sent in error’

#440

Post by saagarjha »

jsf01 wrote: post #313
sevencolors wrote: post #299

Earlier quoted context omitted.

Does anyone have a "explain it like I'm 5 but took some CS classes back in college"? I know that if you craft your buffer overflow just right it will overwrite other parts of memory with the new function. But how do you know what parts will get overwritten? Does that mean the new function can do almost anything?

With a buffer overflow, you can write your own code into a chunk of memory that ends up being run by the application. In this case, since WhatsApp already had SMS read privileges as part of the signup auth flow, the attacker also had those privileges. The article has some detail about the remote code execution part of this exploit. “What this means is that there was a software flaw in the WhatsApp code for handling M…

> With a buffer overflow, you can write your own code into a chunk of memory that ends up being run by the application.

This is usually no longer the case in modern applications. So attackers instead string together short snippets of code from the application itself and jump around between them to basically do what they want.

Post reply on HN