TikTok tracks you across the web, even if you don’t use the app • Hacker News Board

Re: TikTok tracks you across the web, even if you don’t use the app

#141

Post by heavyset_go » Sun, Oct 02, 2022, 5:49 AM UTC

dijit wrote: post #40

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

> Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmentation and want life to be easier for them.

If they sat down with real users, then they'd know that most people get very frustrated when web apps make their phones slow, which happens relatively often.

If they cared, they'd also be frustrated, because they have the background knowledge to understand just how unnecessary such poor user experiences are most of the time. I've seen simple mailing address forms slow phones down. That doesn't need to happen.

> I really really wish that I could convince Web Developers that not every website needs to be a web app.

I'd say it's more that not every website needs to be written in JavaScript from the bottom up. There are web apps that I use that are tasteful and reserved with their uses of JavaScript, if they even use it at all.

You don't need to make web apps using using dynamic code for every little thing, like even building static HTML elements with JavaScript.

And not everything needs to be a SPA, nor does everything need to be built using nine layers of frameworks and abstractions.

Re: TikTok tracks you across the web, even if you don’t use the app

#142

Post by null_object » Sun, Oct 02, 2022, 5:51 AM UTC

WirelessGigabit wrote: post #117

DerekBickerton wrote: post #3

> You can’t stop data collection from the tech industry altogether, but with a few simple steps you can make a dent in the amount of information that’s being collected. > Use privacy-protecting browser extensions. You can add extensions to your browser that will do a lot to protect your privacy. One is Disconnect, made by the company that performed our TikTok investigation. The Disconnect extension shows you how webs…

With iOS you’re SOL. No extensions. And they allow in-app browsers. I wish it would be banned.

> With iOS you’re SOL. No extensions

I’m reading this using iCab Mobile on iOS, which is a browser apparently no-one on HN has ever heard of, as I need to mention it every time this tired old and inaccurate assertion is trotted-out again.

This browser allows you to define your own blocking lists, including filters for every conceivable combination of JS, CSS, cross-site, cookie-based and URL tracking.

So which part do you want to ban exactly?

[0] https://apps.apple.com/us/app/icab-mobile-web-browser/id3081...

Re: TikTok tracks you across the web, even if you don’t use the app

#143

Post by aceazzameen » Sun, Oct 02, 2022, 5:53 AM UTC

wackget wrote: post #41

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

It's a shame uMatrix is no longer actively supported because it was the silver bullet for this kind of shit.

Yeah, but uMatrix still works. It's kind of a finished product. It still received a security update since support ended. I use it all the time and am fascinated at the amount of third party scripts so many websites use. I always appreciate a site that loads everything from their own domain, which is rare. As for social media tracking scripts, I block them all. Google/gstatic is the only one that gets a free pass, otherwise too many sites won't work.

Re: TikTok tracks you across the web, even if you don’t use the app

#144

Post by 1vuio0pswjnm7 » Sun, Oct 02, 2022, 5:55 AM UTC

TikTok proxy, no Javascript required

https://proxitok.pabloferreiro.es/

Re: TikTok tracks you across the web, even if you don’t use the app

#145

Post by heavyset_go » Sun, Oct 02, 2022, 5:59 AM UTC

magic_hamster wrote: post #114

dijit wrote: post #40

Earlier quoted context omitted.

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

What options will you suggest for web developers instead? How can you develop a convenient user experience without js? Even the most simple things require it, and will likely use a third party framework.

What of the most simple of things require JavaScript or a third-party framework?

Modern CSS can handle a lot on the visual side, and modern HTML allows you to do form validation, dynamic lazy-loading and resizing of images, dialogs, collapsible elements, etc without JavaScript.

Re: TikTok tracks you across the web, even if you don’t use the app

#146

Post by matheusmoreira » Sun, Oct 02, 2022, 6:03 AM UTC

dijit wrote: post #40

superkuh wrote: post #33

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

I agree with you. As a user, I want web developers to have as little freedom as possible. The freedom they enjoy today implies the potential for abuse and boy do they abuse it. Tracking and fingerprinting everywhere, anti-patterns everywhere, sites that are painful to use because they use javascript for everything and even the back button doesn't works properly, sites that don't even render at all without javascript enabled.

This actually pushed me to scrape some websites. I essentially reverse engineered the site and created my own custom client for them just to ensure only my code ever runs. I don't have time or energy to do this for every site though...

Re: TikTok tracks you across the web, even if you don’t use the app

#147

Post by EGreg » Sun, Oct 02, 2022, 6:03 AM UTC

WirelessGigabit wrote: post #116

EGreg wrote: post #69

Earlier quoted context omitted.

Shouldnt this have been rendered impossible with Apple and Google’s crackdown on third-party cookies? Whether it a 1x1 tracking pixel or a full-blown Javascript, Apple’s ITP protection would seem to render it unables to track people across websites. The key word is SEEM. I have no idea regarding all the contradictory news coming out of all the camps. I posted a question on StackOverflow with a significant bounty that…

CNAME wouldn’t work because then the cookie is bound to that domain. So the identity doesn’t travel from website to website.

Well, yes and no

First of all, the subdomain can redirect to google.com and back, loading it in a first-party context, and then redirect to your main domain page. I guess Google here would be a “second party”. https://learn.microsoft.com/en-us/azure/active-directory/dev...

Second way is that subdomain can load an iframe from google.com and the iframe will send a postMessage to the enclosing page, which will send a request to the server to set a cookie.

As long as you logged in ONCE in google (let’s say in a popup, or maybe using ITP’s click-to-login) then it will store the session cookie this way. And after that it can meep a cookie around for 10 years and track this guy across all the subdomains where he signed in once.

Re: TikTok tracks you across the web, even if you don’t use the app

#148

Post by someNameIG » Sun, Oct 02, 2022, 6:11 AM UTC

Nextgrid wrote: post #120

EGreg wrote: post #69

Earlier quoted context omitted.

Shouldnt this have been rendered impossible with Apple and Google’s crackdown on third-party cookies? Whether it a 1x1 tracking pixel or a full-blown Javascript, Apple’s ITP protection would seem to render it unables to track people across websites. The key word is SEEM. I have no idea regarding all the contradictory news coming out of all the camps. I posted a question on StackOverflow with a significant bounty that…

ITP doesn't conceal the IP & user-agent, which is enough to track someone reliably since most connections still have a persistent-enough IP address. It only breaks down if you're behind NAT (sharing the public IP with lots of other people) and have a very common user-agent such as the one of the latest version of a mainstream browser. The only way to defeat this is to 1) have all browsers standardize on a single user…

ITP is with Safari, and most people using it will have the latest version, so will blend into the Apple user crowed that way. And private relay is pretty much a VPN.

Re: TikTok tracks you across the web, even if you don’t use the app

#149

Post by bagels » Sun, Oct 02, 2022, 6:30 AM UTC

secondcoming wrote: post #56

dijit wrote: post #40

Earlier quoted context omitted.

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

And it’ll get worse with wasm.

Why will wasm make 'it' (security?) worse?

Re: TikTok tracks you across the web, even if you don’t use the app

#150

Post by ehnto » Sun, Oct 02, 2022, 6:38 AM UTC

matheusmoreira wrote: post #146

dijit wrote: post #40

Earlier quoted context omitted.

I really really wish that I could convince Web Developers that not every website needs to be a web app. I keep bringing up that I don't want JS to execute random code, even if it's sandboxed, it's mostly unnecessary, and I always get the same sort of replies. Everyone calls me out of touch, I'm downvoted to oblivion, everyone suggests that I'm a unique case and everyone wants JS, they say that they don't want fragmen…

I agree with you. As a user, I want web developers to have as little freedom as possible. The freedom they enjoy today implies the potential for abuse and boy do they abuse it. Tracking and fingerprinting everywhere, anti-patterns everywhere, sites that are painful to use because they use javascript for everything and even the back button doesn't works properly, sites that don't even render at all without javascript…

To be fair, users expect websites to do a lot now. That is because brands pushed so much for interactivity. I do agree with you, but if we take away JS we would still want to enhance the web with interactivity.

I do recall building completely JS free eCommerce applications and in all honesty they were lightening fast compared to todays SPAs and still just as complex as applications. But we can do much better for user experience of complex applications with a sprinkle of interactivity.