Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy analysis of Tiktok’s app and website

rufposten.de

Post reply on HN
Print view View original

181–190 of 207 posts

Re: Privacy analysis of Tiktok’s app and website

#181

Post by pferde »

stiray wrote: post #157
hombre_fatal wrote: post #21

Earlier quoted context omitted.

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

Ok, how to fix fingerprinting: - for web, stop using chrome, install firefox (or firefox mobile) and in about:config set privacy.resistFingerprinting on true then add following addons: https://addons.mozilla.org/en-US/android/addon/canvas-finger... https://addons.mozilla.org/en-US/android/addon/audioctx-fing... https://addons.mozilla.org/en-US/android/addon/webgl-fingerp... https://addons.mozilla.org/en-US/android/ad…

Thanks, these look awesome - simple, yet powerful.

Re: Privacy analysis of Tiktok’s app and website

#182

Post by chki »

Razengan wrote: post #166
chki wrote: post #160

Earlier quoted context omitted.

And I wonder whether comments like yours are spread by the Chinese Government to undermine trust in our media/democracy.

If I could prove I'm not associated with China in any way, and in fact don't like what they do, could it be proved that the wave of Tiktok-related posts has nothing to do with Facebook/Google?

I'm 99% sure that you are not affiliated with the Chinese Government. I just wanted to show that accusations like these are not really helpful. It's not the responsibility of Goole/Facebook to prove that they aren't sponsoring bad faith anti-TikTok articles. It's your responsibility as a commentator to show at least some proof (beside a convincing motive). I think the bar for that proof should be rather low, but there needs to be something. Otherwise we are switching from a commenting system based on a reason to a commenting system based on feelings/opinions.

Re: Privacy analysis of Tiktok’s app and website

#183

Post by dkarras »

gambler wrote: post #68

"They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware." Why the fuck does this still work? People are complaining about all those websites that use it, but ignore the fact that it can be mostly fixed by changing 2 applications (Chrome and Firefox).

How would you make it not work besides disabling canvas altogether? It is the staple component for interactive graphical stuff in the browsers. I work with it extensively for interactive content and I very frequently read pixel data from it. Let's say I'm going to blur an image, I need that pixel data. The fingerprinters do the same thing, but the pixel data gives something unique about your GPU.

Re: Privacy analysis of Tiktok’s app and website

#184

Post by mmcwilliams »

sudosysgen wrote: post #112
mmcwilliams wrote: post #78

Earlier quoted context omitted.

It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.

Time to add random delay and noise then.

True, but I think the technique points to the way that other timing attacks used as fingerprinting vectors can and will work. Profiling performance of network requests, image rendering time, etc will always be risks unless all Javascript features employ that kind of mitigation.

Re: Privacy analysis of Tiktok’s app and website

#185

Post by mrlanderson »

If anyone wants to work on a project that works against this in a completely different way, shoot me an email.

We are growing a community of people who don't trust our fragile governments to figure this out, and instead want to democratize these tools and level the playing field rather than attempting prohibition yet again..

Re: Privacy analysis of Tiktok’s app and website

#186

Post by novok »

yding wrote: post #51
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which i…

I thought the IP blocks that most cloud service providers & VPNs have are well known, and for services that don't need their customers to talk to cloud servers, they widescale ban the IP ranges. Like netflix and many others.

Re: Privacy analysis of Tiktok’s app and website

#187

Post by [deleted] »

hombre_fatal wrote: post #21
graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

[deleted]

Re: Privacy analysis of Tiktok’s app and website

#188

Post by gengchun88 »

graposaymaname wrote: post #13

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…

Those techniques described here were pioneered by Facebook and Google. Basically they are (automatic) CAPTCHA.

I still remember the news articles refering a patent Facebook filed about audio fingerprinting as the evidence of Facebook eavesdropping on the people.

Also technologically with some encryption argorithms, a company can claim that they are not capable to identify user with the fingerprint. But in theory given enough data they still can.

Re: Privacy analysis of Tiktok’s app and website

#189

Post by Wowfunhappy »

temp_account75 wrote: post #176
Wowfunhappy wrote: post #175

Earlier quoted context omitted.

Thank you, but I'm a bit confused. You lost me here: > And yes, most website are violating it, but in the sense of Eprivacy, not the GDPR. From what I understand of your post, GDPR has basically superseded the old Eprivacy law, because it requires the same things and then more on top.

Sorry about that. They are violating Eprivacy, not the GDPR, because they are dropping tracers without proper consent. But they are violating it because the consent they are collecting is not valid in the definition given in the GDPR. The previous understanding of Eprivacy (before the GPDR) admitted a "soft consent", ie "keep reading and you consent". That is not longer the case because of GDPR. What they do with the…

That makes more sense, thanks!

Re: Privacy analysis of Tiktok’s app and website

#190

Post by shrimp_emoji »

dylz wrote: post #39
hombre_fatal wrote: post #21

Earlier quoted context omitted.

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…

> What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? In my experience, blocking these everywhere globally as a default will result in being banned from websites, trigger bullshit "fraud" invasive analytics, and all sorts of obnoxious fail-closed problems by invasive trackers. You will also be banned from most Distil-hosted sit…

Perhaps more egregiously, using a VPN gets you auto-banned from some Battlefield 4 servers. D:
Post reply on HN