Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TikTok requests access to devices on local network

twitter.com

Post reply on HN
Print view View original

51–60 of 158 posts

Re: TikTok requests access to devices on local network

#51

Post by _fzslm »

pizza wrote: post #38
judge2020 wrote: post #19

Earlier quoted context omitted.

> They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.

> Every big app has changed this to no longer show the 'pasted from' notification. Is that because they stopped checking your clipboard, or because they managed to check in a way that doesn't alert the user?

afaik apps can detect patterns on the pasteboard without triggering the notification (i.e. check if the URL is a TikTok URL or not), but they can't actually access the contents without triggering the notification. it's enforced by the pasteboard API on iOS.

so they probably updated their apps to perform this check before doing anything.

Re: TikTok requests access to devices on local network

#52

Post by danlugo92 »

adrr wrote: post #41
diebeforei485 wrote: post #15

Some other apps (Signal?) have also done this out of the blue, though they may have since added a UI around this. Regardless, Apple has done the right thing by putting this behind a permissions box, but the developer should be required to have some sort of explanation string of why they need this.

I assume signal is udp hole punching to get around NAT.

What's some good resources on understanding NAT and udp hole punching that explain it in an intuitive manner?

Re: TikTok requests access to devices on local network

#53

Post by dudus »

MichaelGroves wrote: post #37
judge2020 wrote: post #19

Earlier quoted context omitted.

> They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.

"Lots of people do it" should never be considered a legitimate excuse. Trying to use that excuse should get you kicked out of the meeting room.

Everything TikTok is usually linked to malice and espionage from China. If this is a common industry practice at the very least you give it the benefit of the doubt. It doesn't make it ok. It just makes it not automatically linked to international cyber warfare.

Re: TikTok requests access to devices on local network

#54

Post by finiteseries »

intrasight wrote: post #17

So just use their web site. Honest question - why do people use apps for such?

Because that’s how is used. The concept of apps and web sites being separate things, or being different, or preferable to one another isn’t on the radar of 95% of people, it’s a blurry shapeless vagueness the mind glazes over if it’s ever forced into recognizing its existence, and immediately discarded afterwards.

You’re asking a forum of power users/creators, where a loud minority completely unironically still use desktop & laptop computers for activities besides work. The only people on earth less understanding (intentionally or not) of consumer behavior are the Sentinelese.

Re: TikTok requests access to devices on local network

#55

Post by colechristensen »

judge2020 wrote: post #19
antioxidant wrote: post #14

They used to check your clipboard the whole time too. They use the local network as one of their sensors to identify you (fingerprinting). However they have plenty more (see their privacy policy).

> They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.

>it was never shown that they export those clipboard contents to homebase

When it comes to an app gathering data for a company, is anybody really willing to give the app makers the benefit of the doubt? If there is information available, somebody is going to take it and try to squeeze a penny out of it. Not everybody, but when it gives you a competitive advantage it has a tendency to grow.

Re: TikTok requests access to devices on local network

#56

Post by uniqueuid »

avnigo wrote: post #45
uniqueuid wrote: post #20

Microsoft Teams does this as well, purportedly for video calling (!?) Was there ever an explanation why the permissions are needed?

I assumed it was to gracefully deal with handoff from one device to another while in a meeting since you can start on one device and continue with another, or maybe to share your screen from another device etc. It would be nice to know why exactly certain permissions are requested; sometimes that’s done by telling you what feature it might break if you don’t grant those permissions.

That's a great observation - for handoff it would make much more sense to get the permission beforehand, rather than trying to stop all sorts of a/v and network processes to get the user's ok.

Re: TikTok requests access to devices on local network

#57

Post by judge2020 »

colechristensen wrote: post #55
judge2020 wrote: post #19

Earlier quoted context omitted.

> They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.

>it was never shown that they export those clipboard contents to homebase When it comes to an app gathering data for a company, is anybody really willing to give the app makers the benefit of the doubt? If there is information available, somebody is going to take it and try to squeeze a penny out of it. Not everybody, but when it gives you a competitive advantage it has a tendency to grow.

The cool thing about phones is that you can MITM yourself and see what apps are sending, assuming they don't certificate pin (which TikTok doesn't). The person that reported this during the beta period didn't find any evidence when doing so.

https://old.reddit.com/r/videos/comments/fxgi06/not_new_news...

Re: TikTok requests access to devices on local network

#58

Post by phkahler »

antioxidant wrote: post #14

They used to check your clipboard the whole time too. They use the local network as one of their sensors to identify you (fingerprinting). However they have plenty more (see their privacy policy).

>> They used to check your clipboard the whole time too.

That's a design error on the UI side. An app should not have read access to the clipboard, it should have the ability to accept data from the clipboard when the user pastes it.

Re: TikTok requests access to devices on local network

#59

Post by hipsterhelpdesk »

uniqueuid wrote: post #36

Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

It only “leaks” your ip if you are trying to use webrtc features with a vpn, otherwise web rtc is perfectly fine to use without concern for most people.

Re: TikTok requests access to devices on local network

#60

Post by duiker101 »

judge2020 wrote: post #57
colechristensen wrote: post #55

Earlier quoted context omitted.

>it was never shown that they export those clipboard contents to homebase When it comes to an app gathering data for a company, is anybody really willing to give the app makers the benefit of the doubt? If there is information available, somebody is going to take it and try to squeeze a penny out of it. Not everybody, but when it gives you a competitive advantage it has a tendency to grow.

The cool thing about phones is that you can MITM yourself and see what apps are sending, assuming they don't certificate pin (which TikTok doesn't). The person that reported this during the beta period didn't find any evidence when doing so. https://old.reddit.com/r/videos/comments/fxgi06/not_new_news...

Can you actually still widely do this? Last time I checked on the latest versions of Android apps don't accept user certificates so you can't really do much about any https traffic, which really is the bulk.
Post reply on HN