TikTok tracks you across the web, even if you don’t use the app • Hacker News Board

Re: TikTok tracks you across the web, even if you don’t use the app

#111

Post by octoberfranklin » Sun, Oct 02, 2022, 1:24 AM UTC

jxramos wrote: post #78

andrewflnr wrote: post #72

Earlier quoted context omitted.

Look, I do run uBO. It doesn't even completely block JS, yet it still routinely breaks very basic pages, and I have to use a lot of webdev and industry knowledge to even try to unbreak them without entirely turning off blocking. So no, for most people who want to use mainstream websites, just turning off JS is not a real option. That this is a dystopic scenario does not change the practical reality.

this may be daydreaming too shallowly, but I wonder if basic Javascript UI patterns could be identified by some tool. Something along the lines of a new pane showing up in the Developer Tools that semantically identifies the roles of certain Javascript. * This block of code ensures these UI elements are synched among each other. * This block of code sends this UI data to this server address. Something that gives a ro…

That's what LibreJS does.

https://www.gnu.org/software/librejs/

It is not terribly useful.

Re: TikTok tracks you across the web, even if you don’t use the app

#112

Post by falcolas » Sun, Oct 02, 2022, 1:30 AM UTC

bradleybuda wrote: post #105

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

A web browser is an application that safely executes untrusted remote code. It sounds like you don’t want to use a web browser.

Is it really safe when a company - such as TikTok - is executing arbitrary code on properties they don’t own or operate, without user consent?

That doesn’t seem safe to me.

Re: TikTok tracks you across the web, even if you don’t use the app

#113

Post by _8j50 » Sun, Oct 02, 2022, 1:36 AM UTC

YeBanKo wrote: post #81

_8j50 wrote: post #35

Make shadow profiles illegal.

Can be something like, companies can’t store PII without getting explicit user consent.

They will do it without PII.

It can be worded so that collecting any specific information pre and post-processed (to cover ML) about a person who is not a consenting user of your service allows individuals to sue for punitive damages and in exteme cases make it a felony.Any information, even anonymized information about individuals will be prohibited. However, if you use Google for example and agree to their ToS they can do whatever they want within reason, so long as the activity being tracked is related to the user explicitly interacting with a google service. So tracking cookies and all the weird shit they do is fine for their users, they just can't track users if the user visited hn.com and they did not explicitly consent to being tracked by google analytics, the hn.com admin can let you know it wants to allow the 3rd party service google to track you and get your consent.

This stuff is possible, I despise all the fatalism. Us, the people that understand this at any depth just need to agree on it and speak very loudly and convince our peers, being defeated and hoping politicians figure out tech some day is silly. That's why I am trying to discuss this here.

Re: TikTok tracks you across the web, even if you don’t use the app

#114

Post by magic_hamster » Sun, Oct 02, 2022, 1:49 AM UTC

dijit wrote: post #40

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

What options will you suggest for web developers instead? How can you develop a convenient user experience without js? Even the most simple things require it, and will likely use a third party framework.

Re: TikTok tracks you across the web, even if you don’t use the app

#115

Post by sva_ » Sun, Oct 02, 2022, 1:56 AM UTC

galangalalgol wrote: post #76

andrewflnr wrote: post #72

Earlier quoted context omitted.

Look, I do run uBO. It doesn't even completely block JS, yet it still routinely breaks very basic pages, and I have to use a lot of webdev and industry knowledge to even try to unbreak them without entirely turning off blocking. So no, for most people who want to use mainstream websites, just turning off JS is not a real option. That this is a dystopic scenario does not change the practical reality.

I never have to turn off uBO to get pages to work. Am I just visiting really boring sites, or is there a default setting I should change to be more strict amd break more pages?

I just had this problem today when trying to book a flight at American Airlines. The purchase button would simply not work when uBO was on.

Re: TikTok tracks you across the web, even if you don’t use the app

#116

Post by WirelessGigabit » Sun, Oct 02, 2022, 2:09 AM UTC

EGreg wrote: post #69

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

Shouldnt this have been rendered impossible with Apple and Google’s crackdown on third-party cookies? Whether it a 1x1 tracking pixel or a full-blown Javascript, Apple’s ITP protection would seem to render it unables to track people across websites. The key word is SEEM. I have no idea regarding all the contradictory news coming out of all the camps. I posted a question on StackOverflow with a significant bounty that…

CNAME wouldn’t work because then the cookie is bound to that domain. So the identity doesn’t travel from website to website.

Re: TikTok tracks you across the web, even if you don’t use the app

#117

Post by WirelessGigabit » Sun, Oct 02, 2022, 2:11 AM UTC

DerekBickerton wrote: post #3

> You can’t stop data collection from the tech industry altogether, but with a few simple steps you can make a dent in the amount of information that’s being collected. > Use privacy-protecting browser extensions. You can add extensions to your browser that will do a lot to protect your privacy. One is Disconnect, made by the company that performed our TikTok investigation. The Disconnect extension shows you how webs…

With iOS you’re SOL. No extensions. And they allow in-app browsers. I wish it would be banned.

Re: TikTok tracks you across the web, even if you don’t use the app

#118

Post by giancarlostoro » Sun, Oct 02, 2022, 2:18 AM UTC

dijit wrote: post #40

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

> I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies.

I mean having done front-end and back-end. I gotta say, the way a SPA framework lets you re-use front-end code is probably why such frameworks are selling like hot cakes. I legit feel like someone needs to spec out a back-end layout that is generic and implementable in any language, but supports some of the concepts like containers and such.

Re: TikTok tracks you across the web, even if you don’t use the app

#119

Post by Ozzie_osman » Sun, Oct 02, 2022, 2:20 AM UTC

jjeaff wrote: post #58

Ozzie_osman wrote: post #42

No surprise. Every company with an ad platform uses a pixel. Meta, Google, Reddit, Microsoft. Advertisers add it to their site to get access to things like tracking of performance if their ads, and custom audiences for retargeting or look-alike audiences. In exchange, that ad platform gets your browsing data. It's not great, but everyone is doing it so I wouldn't consider the fact that TikTok, one of the biggest soci…

Do all the ad companies require this pixel on every page of your site? In other words, could you not have an ad platform specific page that embeds the pixel and acts as the landing page for any of your ads? If so, I don't see any problem with that. The only customers accessing that page would be incoming ad clicks.

No. They don't even require it at all, but they encourage you to do so to get access to certain things.

Without the pixel, the platform sees a click on their side. But if you wanted to pay for other conversions, eg a purchase, you'd need to send an event back (either via pixel or via API).

As an other example, if you wanted to retarget, you'd also need the pixel. Let's say you wanted to target users who added an item to their cart but never purchased, the pixel would fire a "added to cart" event.

Finally, if you want look-alike audiences, you'd want to pixel as many users as broadly across your site as possible. As an example of this last one, you might want to tell the ad platform to show your ad to people who seem to resemble people who have made purchases on your site. Having the pixel let's them build that list of users who purchased on your site, then try to target users who seem to have similar interests/location/browsing habits. The funny part about this is the platform might implicit learn to target your ad to people who have visited a competitor. But since you add the pixel too, they show the competitor ad to people who visit you. So the ad platform is really a weapons dealer here.

So Yea, you could decide to only use the pixel in a limited way, or not use it at all, but you'd miss out on better targeting, optimization, and reporting.

If you put the pixel on a lan

Re: TikTok tracks you across the web, even if you don’t use the app

#120

Post by Nextgrid » Sun, Oct 02, 2022, 2:22 AM UTC

EGreg wrote: post #69

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

Shouldnt this have been rendered impossible with Apple and Google’s crackdown on third-party cookies? Whether it a 1x1 tracking pixel or a full-blown Javascript, Apple’s ITP protection would seem to render it unables to track people across websites. The key word is SEEM. I have no idea regarding all the contradictory news coming out of all the camps. I posted a question on StackOverflow with a significant bounty that…

ITP doesn't conceal the IP & user-agent, which is enough to track someone reliably since most connections still have a persistent-enough IP address. It only breaks down if you're behind NAT (sharing the public IP with lots of other people) and have a very common user-agent such as the one of the latest version of a mainstream browser.

The only way to defeat this is to 1) have all browsers standardize on a single user-agent that never changes going forwards and 2) per-origin VPNs so that the public IP seen by each origin is different.