Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TikTok requests access to devices on local network

twitter.com

Post reply on HN
Print view View original

101–110 of 158 posts

Re: TikTok requests access to devices on local network

#101

Post by stingraycharles »

the_mitsuhiko wrote: post #88

For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itse…

Interesting. I initially denied the permission, but Tiktok seemed to not be able to make any Internet requests. The kind of behavior I would expect if DNS didn’t work anymore.

Maybe it’s just as innocent as this, but OTOH, it’s tiktok we’re talking about.

Re: TikTok requests access to devices on local network

#102

Post by allo37 »

uniqueuid wrote: post #85
hipsterhelpdesk wrote: post #59

Earlier quoted context omitted.

It only “leaks” your ip if you are trying to use webrtc features with a vpn, otherwise web rtc is perfectly fine to use without concern for most people.

Interesting! That's not how I read the ublock origin docs: "Keep in mind that this feature is to prevent leakage of your non-internet-facing IP adresses. The purpose of this feature is not to hide your current internet-facing IP address -- so be cautious to not misinterpret the results of some WebRTC-local-IP-address-leakage tests found online." That said, my Firefox 91 and Safari don't leak local IPs regardless of t…

I believe newer versions of WebRTC use mdns to mask local IPs:

https://bugs.chromium.org/p/chromium/issues/detail?id=878465

Re: TikTok requests access to devices on local network

#104

Post by uniqueuid »

allo37 wrote: post #102
uniqueuid wrote: post #85

Earlier quoted context omitted.

Interesting! That's not how I read the ublock origin docs: "Keep in mind that this feature is to prevent leakage of your non-internet-facing IP adresses. The purpose of this feature is not to hide your current internet-facing IP address -- so be cautious to not misinterpret the results of some WebRTC-local-IP-address-leakage tests found online." That said, my Firefox 91 and Safari don't leak local IPs regardless of t…

I believe newer versions of WebRTC use mdns to mask local IPs: https://bugs.chromium.org/p/chromium/issues/detail?id=878465

Great find! Here's the IETF draft [1], submitted by Apple (which would explain why I'm not seeing leaks on Safari)

[1] https://datatracker.ietf.org/doc/html/draft-mdns-ice-candida...

Re: TikTok requests access to devices on local network

#105

Post by smolder »

dudus wrote: post #53
MichaelGroves wrote: post #37

Earlier quoted context omitted.

"Lots of people do it" should never be considered a legitimate excuse. Trying to use that excuse should get you kicked out of the meeting room.

Everything TikTok is usually linked to malice and espionage from China. If this is a common industry practice at the very least you give it the benefit of the doubt. It doesn't make it ok. It just makes it not automatically linked to international cyber warfare.

The incidents that might qualify as cyber warfare could also just be looked at as the same struggle for power on a different front, compared to economics. It can't be lost on Chinese leaders how valuable it is to the US to have so much money and data flowing through its domestic tech companies. Tech companies can't cross the line into cyber warfare themselves and get a pass on it, but they do play a role in it.

Re: TikTok requests access to devices on local network

#106

Post by the_mitsuhiko »

uniqueuid wrote: post #92
the_mitsuhiko wrote: post #88

For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itse…

Thanks for the details! That opens new questions; for example, what's a "custom" DNS query? One that doesn't use mDNSResponder (or whatever iOS uses right now)?

I am not sure under which circumstances it flags. If you write your own DNS client for sure it will happen, but there seem to be more things that cause this to trigger.

After that dialog was introduced I saw it pop up on stack overflow for some relatively common libraries (for instance with unity) even if they did not attempt to access the local network.

Re: TikTok requests access to devices on local network

#107

Post by dheera »

Lammy wrote: post #13
dangoor wrote: post #2

Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?

Any discussion of intent is always going to be speculation. All we can think about is what such a thing would be capable of if it were somehow malicious. The first possibility that comes to my mind would be sniffing Ethernet MAC addresses because it could be done without any sort of device-specific support built in to the app. Assuming your local devices’ manufacturers are following Da Rulez, the first part of their…

Apple is also complicit in making it incredibly hard to execute an MITM proxy to know what your iOS apps are sending back to their servers.

Being able to MITM and see what your apps and OS are sending back is the first step to real privacy.

Re: TikTok requests access to devices on local network

#108

Post by teawrecks »

swiley wrote: post #71
uniqueuid wrote: post #36

Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

That's a clear violation of the CFAA. This crime carries prison time. How come they threw teenagers in prison but not the people responsible for doing it en mass?

Because people blindly accept terms of service.

Re: TikTok requests access to devices on local network

#110

Post by t0ps0il »

alerighi wrote: post #21
diebeforei485 wrote: post #15

Some other apps (Signal?) have also done this out of the blue, though they may have since added a UI around this. Regardless, Apple has done the right thing by putting this behind a permissions box, but the developer should be required to have some sort of explanation string of why they need this.

That thing makes it annoying for the kind of applications my company does, that needs to communicate with other devices on the local network. It's annoying because it's not like other permissions, where you can ask the OS to prompt the user, and check if the user granted it or not, but it's some special permission. If the user, by mistake because it doesn't know that it's needed, doesn't give it one time it's impossi…

> It's annoying because it's not like other permissions

Normally if I want to use a permission, say location, I need to provide a value for given permission in my app's `info.plist` file, and if I don't and the app tries to grab the current location, it crashes with logs yelling at me to provide a description for the location privacy key.

With local network permissions it's different.

I've never had to do any local networking in my career as an iOS dev so downloaded Apple's peer to peer example app (https://developer.apple.com/documentation/network/building_a...) and removed the `Privacy - Local Network Usage Description` key/value pair from the `info.plist` file and ran the app on my device.

I fully expected a crash with a description telling me to add this key but iOS just filled in the missing description with a default value and asked away. I wonder why that permission is treated differently from the rest?

Post reply on HN