Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TikTok requests access to devices on local network

twitter.com

Post reply on HN
Print view View original

121–130 of 158 posts

Re: TikTok requests access to devices on local network

#121

Post by SllX »

snapetom wrote: post #103

Pokemon Go started asking for this back in March with an update. I don't think it was ever figured out why it would want access, and it's certainly not for Chromecast/Roku/AppleTV.

Pokéball Plus support. I mean, I can’t speak to Niantic fingerprinting players because I don’t know if they are, but you do need Bluetooth to use the Pokéball Plus properly. Also I believe you need Bluetooth to work with the Let’s Go Pikachu and Eevee games on the Switch to transfer Pokémon back and forth, but I never did get that to work properly.

Re: TikTok requests access to devices on local network

#122

Post by uniqueuid »

excitom wrote: post #120
uniqueuid wrote: post #93

Earlier quoted context omitted.

The incident I'm referring to was about LG [1]. The report includes network captures, so I'd trust it. Apparently, some chinese smart TV brands have been doing similar things, but I wouldn't be surprised if most other vendors have caught up and used stealthier techniques. [edit] Here's the news about those chinese TVs [2] and the original report [3] [1] https://arstechnica.com/information-technology/2013/11/lg-sm...…

Small point: LG is a Korean company, not Chinese.

Right, those are two distinct incidents (and years apart).

Sorry if that wasn't clear.

Re: TikTok requests access to devices on local network

#123

Post by blacksmith_tb »

wyager wrote: post #117
uniqueuid wrote: post #36

Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

Many common wifi APs (eg TP-link EAP225) will allow you to create separate wifi networks on different VLANs. You can use this to isolate internet of shit devices onto their own networks where they can’t talk to your other devices, without increasing your hardware costs or causing wifi interference. You’ll need a router/firewall and an AP that are both VLAN-aware. I personally use an EAP225 and some eBay industrial PC…

And/or some routers offer 'AP Isolation' or 'Client Isolation' to prevent devices from communicating with each other (I am always glad to see public networks configured this way, but at home it'd be a pain to not be able to shell from one box into another etc.)

Re: TikTok requests access to devices on local network

#124

Post by 73r7fudhdjduru »

swiley wrote: post #97
Hnrobert42 wrote: post #95

Earlier quoted context omitted.

I would argue the point was the opposite. It began with a request for authorization.

I don't see how this is any different than walking into a building and telling the concierge you're a maintenance worker.

The illegal part there isn't requesting access it's lying about being a maintenance worker to gain access.

Re: TikTok requests access to devices on local network

#125

Post by nicce »

the_mitsuhiko wrote: post #88

For some technical context: this dialog pops up the first time an app attempts to send a packet to a local device. A "common" reason why this happens are actually your own network devices if you're connected on wifi. For instance sending a custom DNS query to the wifi advertised DNS server (if it's the router) will cause that dialog. Same thing happens if you happen to have a router redirect certain resources to itse…

More context, especially resolving link-local DNS names (those ending with local, per RFC 6762) requires local network access. For iOS devices, Apple has summed this pretty well[1]. Yes, if permission required on below:

    Making an outgoing TCP connection — yes

    Listening for and accepting incoming TCP connections — no

    Sending a UDP unicast — yes

    Sending a UDP multicast — yes

    Sending a UDP broadcast — yes

    Receiving an incoming UDP unicast — no

    Receiving an incoming UDP multicast — yes

    Receiving an incoming UDP broadcast — yes

    And finally usage of Bonjour operations.
[1] https://developer.apple.com/forums/thread/663874

Re: TikTok requests access to devices on local network

#126

Post by snapetom »

SllX wrote: post #121
snapetom wrote: post #103

Pokemon Go started asking for this back in March with an update. I don't think it was ever figured out why it would want access, and it's certainly not for Chromecast/Roku/AppleTV.

Pokéball Plus support. I mean, I can’t speak to Niantic fingerprinting players because I don’t know if they are, but you do need Bluetooth to use the Pokéball Plus properly. Also I believe you need Bluetooth to work with the Let’s Go Pikachu and Eevee games on the Switch to transfer Pokémon back and forth, but I never did get that to work properly.

Yeah, but Let's Go and Pokeball were released years ago. Go Plus was released almost Day 1, if I recall. All of those connect via Bluetooth and never required a network. They all still work just fine if you deny PoGo the permission to access devices.

Re: TikTok requests access to devices on local network

#127

Post by indymike »

Hnrobert42 wrote: post #95
swiley wrote: post #89

Earlier quoted context omitted.

Unauthorized network access? Literally the whole point of the thing.

I would argue the point was the opposite. It began with a request for authorization.

> It began with a request for authorization.

Yes, by asking someone who doesn't have permission to give that authorization to do so.

Re: TikTok requests access to devices on local network

#128

Post by SllX »

snapetom wrote: post #126
SllX wrote: post #121

Earlier quoted context omitted.

Pokéball Plus support. I mean, I can’t speak to Niantic fingerprinting players because I don’t know if they are, but you do need Bluetooth to use the Pokéball Plus properly. Also I believe you need Bluetooth to work with the Let’s Go Pikachu and Eevee games on the Switch to transfer Pokémon back and forth, but I never did get that to work properly.

Yeah, but Let's Go and Pokeball were released years ago. Go Plus was released almost Day 1, if I recall. All of those connect via Bluetooth and never required a network. They all still work just fine if you deny PoGo the permission to access devices.

Correct me if I’m wrong, but isn’t this the same dialog that pops up for Bluetooth devices or am I missing something?

I haven’t used my Pokeball Plus since about a month after I bought it, which was basically day or week 1, but if I recall correctly the mandate to ask for permissions only came around after that time frame and I would expect it the next time I pulled it out.

But if it does work without Bluetooth permissions; then that’s cool, or if this is a separate dialog than the Bluetooth permissions dialog, then I’m just wrong which is also fine and I can live with that.

Re: TikTok requests access to devices on local network

#129

Post by na85 »

swiley wrote: post #71
uniqueuid wrote: post #36

Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

That's a clear violation of the CFAA. This crime carries prison time. How come they threw teenagers in prison but not the people responsible for doing it en mass?

There are a different set of laws for me and you. Corporations and CEOs play by their own rules.

Re: TikTok requests access to devices on local network

#130

Post by xvector »

teawrecks wrote: post #108
swiley wrote: post #71

Earlier quoted context omitted.

That's a clear violation of the CFAA. This crime carries prison time. How come they threw teenagers in prison but not the people responsible for doing it en mass?

Because people blindly accept terms of service.

It's not people's fault that terms of service are intentionally designed to be as long-winded as possible if you want any hope of using a product or service.
Post reply on HN