Live data from Hacker News

FCC: TikTok is unacceptable security risk and should be removed from app stores

blog.malwarebytes.com

31–40 of 899 posts

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#31
post #26

"TikTok is said to collect “everything”, from search and browsing histories; keystroke patterns; biometric identifiers—including faceprints" How can they even collect browsing history or biometric identifiers on Android? Isn't browser history stored in the browser's private storage space, or am I being naive here?

[deleted]

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#32
post #26

"TikTok is said to collect “everything”, from search and browsing histories; keystroke patterns; biometric identifiers—including faceprints" How can they even collect browsing history or biometric identifiers on Android? Isn't browser history stored in the browser's private storage space, or am I being naive here?

IIRC you can use the android shared webview to determine if a site is in cache on the system by measuring access times.

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#33
Lots of folks here arguing that the focus on TikTok is unfair, given the data collection practices of domestic corps like Facebook. From a privacy point of view, this argument is well-founded, but I think it's tangential to the argument TFA is making, which is: this data collection done by a foreign government and exploited for surveillance or espionage is a national security risk.

I get it. We want corps to stop hoovering up our data because they can use it to manipulate us with advertising, and they can mishandle it such that other bad actors can exploit it. I'm with you, this is a valid concern that we should address. But I think TikTok's specific case warrants additional concern because it's all that, plus it puts a geopolitical adversary in control of the data, countless devices, and a media channel central to the current cultural zeitgeist.

I don't think it's reasonable to wait for general regulation of social media corps while TikTok continues to do its thing, particularly if targeted action against TikTok is politically viable.

Edit: typo

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#34
post #23

Can someone explain the capturing "keystroke patterns" part? Are they saying the app is somehow capturing keystrokes while other apps are running?

In the article the TikTok spokesperson explains this:

“It’s not logging what you’re typing. It’s an anti-fraud measure that checks the rhythm of the way people are typing to ensure it’s not a bot or some other malicious activity.”

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#37
post #10

I don't have a horse in this race at all, but the annoying part is that the same rules don't get applied across the board. Everything they're accusing TikTok of - from data harvesting to the government having access to said data - is true for western companies as well and that should be the problem. Not the fact that the data is now in the hands of the Chinese but that the data is being collected at all provided to t…

> but don't argue that the practice suddenly becomes problematic when others do it.

The extent to which it's problematic depends on who's doing it, even if all cases are problematic.

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#38
post #22
post #16

Earlier quoted context omitted.

Perhaps there is a reason why China’s government bans all the American Social Media companies. If they could undermine the country’s sovereignty then it would be a significant difference.

They ban them because the companies don't want to follow the same rules Chinese companies have to follow. It's exactly what I'm asking for. Have one set of rules and apply them to everyone. Ban data harvesting completely. Ban it for Facebook, Google and everyone else and then kick out TikTok because they don't follow the rules.

They ban them because they won’t censor factual information and won’t promote disinformation.

See how Chinese censorship applies to mRNA vaccine conspiracy theories. A person that debunked them was banned from wechat.

Do you see western governments doing this?

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#39
post #26

"TikTok is said to collect “everything”, from search and browsing histories; keystroke patterns; biometric identifiers—including faceprints" How can they even collect browsing history or biometric identifiers on Android? Isn't browser history stored in the browser's private storage space, or am I being naive here?

IIRC you can use the android shared webview to determine if a site is in cache on the system by measuring access times.

Sounds similar to a timing attack[0]

0. https://en.wikipedia.org/wiki/Timing_attack

Re: FCC: TikTok is unacceptable security risk and should be removed from app stores

#40

However putting this data in the hands of FAANG is no problem at all, and totally can't end up in any nefarious hands.

Help me understand your perspective: are you American or no? I have a hard time understanding why an American wouldn't see FAANG as the lesser of two evils here.
Post reply on HN