Live data from Hacker News

TikTok tracks you across the web, even if you don’t use the app

consumerreports.org

201–210 of 214 posts

Re: TikTok tracks you across the web, even if you don’t use the app

#201

Earlier quoted context omitted.

uBO can break sites, but in my experience doesn't to the degree that you're describing. Perhaps you should clear all settings and re-install the extension once and see if that helps? Do you maybe have other content blocking extensions running at the same time as uBO that are causing 'clashes'?

I'll probably give this a shot. The only settings changes I can remember are allowing things, but I could be wrong. No other content-blocker extensions, I believe.

Sometimes 'Enhanced Tracking Protection' built into Firefox can break sites too. Click on the shield in the URL bar to toggle.

Re: TikTok tracks you across the web, even if you don’t use the app

#202

The TikTok pixel is not actually a pixel like in the old days. It is not a 1x1 transparent image loaded from their servers. It is executable javascript code. All you have to do to stop 99% of the corporate spying is disable unsafe remote code execution. It's hard to believe I have to say that after the many decades of people getting it drilled into their heads "Do not open random email attachments" but here we are in…

Seems like automatic loading of resources (hosted by third parties) by popular web browsers is beyond question. I access the www everyday using a browser that does not auto-load resources. It would be dishonest to claim it is not useful. I recall a brief period of time in the early www where web pages could contain "Java applets" and the browser would prompt the user if they wanted to run the code. Web developers hav…

Is it really a good idea to automatically send resources to a client that has not explicitly requested them. It is behaviour that takes control away from the client. (Needless to say, this behaviour is open to tremendous abuse and can be wasteful.)

Auto-fetching took this to a new level. (I always disable this behaviour, either within the client or outside it.)

Going even further, HTTP/2 server push has IMO only highlighted the questionable nature of this behaviour. Its justification is "performance" but it still removes control from the client. Will push be removed from Chrome.

https://groups.google.com/a/chromium.org/g/blink-dev/c/K3rYL...

Re: TikTok tracks you across the web, even if you don’t use the app

#203

Earlier quoted context omitted.

You dont need UBlock with Brave, brave Shields do what UBlock does while being faster(rust) and integrated in the browser.

This is mostly true however Brave Shields do not support the $removeparam operator so it is unable to remove url based tracking. You still need uBO or the ClearURLs extension to do that. https://github.com/brave/adblock-rust/issues/166 )

Brave already removes tracking parameters from URLs

https://brave.com/privacy-updates/5-grab-bag/

Re: TikTok tracks you across the web, even if you don’t use the app

#204

What is the source of the tracker? It can't be tiktok.com. They must be using a different name domain.

analytics.tiktok.com. googletagmanager.com has a script that gets the analytics JS from tiktok, so if you're blocking Google Tag Manager, then you'll never even see an attempt at loading from tiktok.

Thanks. For some reason, I never gray listed that site. Now I know better

Re: TikTok tracks you across the web, even if you don’t use the app

#206

Earlier quoted context omitted.

What options will you suggest for web developers instead? How can you develop a convenient user experience without js? Even the most simple things require it, and will likely use a third party framework.

As someone who blocks JS by default, don't depend on remotely hosted JS. If I go to example.com and I think it seems truthworthy I might allow scripts to run from that domain and that domain only. If the site doesn't work after that, I'll just close the tab and move on. The simple stuff doesn't need bloated frameworks. Don't obfuscate your JS either if you can help it. If I'm not sure if I should be trusting your sit…

Displaying pictures is one thing. But how are you going to create a dashboard that updates every short interval without JavaScript?

Let's say a website serves React from its own domain, so no 3rd party references are used (which in this case it'll be very easy for them to serve you a modified version of the framework), they'd rightfully want to save bandwidth and minimize it! Which means obfuscation as a byproduct.

I understand where you're coming from and I do a fair share of blocking myself, but I also see why things are the way they are if you want to develop an online product.

Re: TikTok tracks you across the web, even if you don’t use the app

#207

Earlier quoted context omitted.

What options will you suggest for web developers instead? How can you develop a convenient user experience without js? Even the most simple things require it, and will likely use a third party framework.

What of the most simple of things require JavaScript or a third-party framework? Modern CSS can handle a lot on the visual side, and modern HTML allows you to do form validation, dynamic lazy-loading and resizing of images, dialogs, collapsible elements, etc without JavaScript.

When I typed that I didn't mean showing a picture or serving a text file. Anything that's not a static page will probably require JavaScript.

Re: TikTok tracks you across the web, even if you don’t use the app

#208

Earlier quoted context omitted.

As someone who blocks JS by default, don't depend on remotely hosted JS. If I go to example.com and I think it seems truthworthy I might allow scripts to run from that domain and that domain only. If the site doesn't work after that, I'll just close the tab and move on. The simple stuff doesn't need bloated frameworks. Don't obfuscate your JS either if you can help it. If I'm not sure if I should be trusting your sit…

Displaying pictures is one thing. But how are you going to create a dashboard that updates every short interval without JavaScript? Let's say a website serves React from its own domain, so no 3rd party references are used (which in this case it'll be very easy for them to serve you a modified version of the framework), they'd rightfully want to save bandwidth and minimize it! Which means obfuscation as a byproduct. I…

For somethings you really can't help but depend on javascript. I don't really mind it if it's something ambitious enough, it's the display of basic content breaking that bugs me most.

A dashboard may still work if you can just display the current data and add a note that because JS is disabled the page must be refreshed manually to pull updated values. You don't even have to throw in a refresh button since the browser's already got one. If I go to a website without JS enabled I expect things to take a bit more work on my part.

Minified JS is a problem I run into a lot. Most of the time though, I err on the side of caution and just move on. There's so many interesting things worthy of my attention that if the site full of inscrutable javascript is just a random article/blog post or something shared as a general "hey look at this cool/fun/impressive site" it can easily be abandoned for something less troublesome.

For sites I actually do need to access for some reason I can take the time to analyze it properly, but most of the time those kinds of sites are already familiar/trustworthy, and I've got other options too like firing up a less restricted browser in a VM.

I certainly don't expect developers to give up using JavaScript for the sake of the few users like me, but the better a site does at keeping content accessible without it the less likely I am to just move on to the next tab.

Re: TikTok tracks you across the web, even if you don’t use the app

#209
This is the same technology used by Google, Facebook, Linkedin, Pinterest, Snapchat, and Twitter. There are other services like Clearbit that offer just the data part of this, without the social media network attached. Every major ad network does this.

There is nothing unique about TikTok's tracking implementations other than how much data they attempt to take in.

Re: TikTok tracks you across the web, even if you don’t use the app

#210

Earlier quoted context omitted.

Google and Facebook coin it as violation of their terms. Just watch HN and you will get the next story every other month. But the most chilling quote is "we kill people based on metadata": As NSA General Counsel Stewart Baker has said, “metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.” When I quoted Baker at a recent debate at Johns Hopkins Un…

I'm not entirely sure what you're hinting at. Are you saying that the US military and intelligence agencies use metadata to track down and kill people that they deem as enemies? And that Meta/Google/etc. are in cahoots with them to do this? Can you link me example of this happening? Is there credible evidence that an ordinary citizen (like myself) is in more danger from state actors because of the information harvest…

You write this as if this wasn't common knowledge: https://en.m.wikipedia.org/wiki/Global_surveillance_disclosu...

If they had no need for contacting Meta and Microsoft and Google, why did they do so?

How could would this put an ordinary citizen at risk? I don't know. All the data is run through an AI and if it labels you terrorist, who is to question it?

They sure kill a lot of people in Pakistan based on this data:

https://arstechnica.com/information-technology/2016/02/the-n...

Post reply on HN