Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TikTok requests access to devices on local network

twitter.com

Post reply on HN
Print view View original

61–70 of 158 posts

Re: TikTok requests access to devices on local network

#61

Post by nostrademons »

uniqueuid wrote: post #36

Just to add: Scanning networks to gather data seems pretty popular these days - smart tvs have done so, and even the ebay site used to portscan visitors [1]. [edit] And of course, there's WebRTC leaking your local IP - which ublock origin can specifically block [2]. [1] https://www.bleepingcomputer.com/news/security/ebay-port-sca... [2] https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

Is this separate from mDNS [1]? A lot of smart TVs and PCs increasingly use mDNS to support some fairly handy consumer features, like AirDrop, being able to setup your TV with your phone, network printing/scanning, ChromeCast, whole-home control of lights & other IoT devices, etc.

[1] https://en.wikipedia.org/wiki/Multicast_DNS

Re: TikTok requests access to devices on local network

#62

Post by oasisbob »

MichaelGroves wrote: post #39
oefrha wrote: post #23

Earlier quoted context omitted.

Of course you can. Look up VPN routing / split tunneling. It’s not uncommon for corporate VPNs to only route intranet traffic for instance; and LAN is usually whitelisted.

Besides corporate VPNs, typical consumer VPNs are also set up to allow LAN access. Your average joe-smoe would be annoyed if their network printer stopped working every time they turned on their VPN to watch netflix movies or whatever.

IPSEC VPNs (and others) have the remote networks defined in the protocol as part of the security association (SA). The SAs define which networks are available over the tunnel.

Saying "all RFC1918 addresses are available over here" is quite a cocky and obviously broken thing to do, unless you're dealing with a corporate device which is paranoid about leaking traffic to other networks.

Re: TikTok requests access to devices on local network

#63

Post by mdoms »

intrasight wrote: post #17

So just use their web site. Honest question - why do people use apps for such?

I think it's very unlikely that Tiktok could build an equivalent UX that would work in a browser, including the creators tools. And even if they could - have they done so?

And let's not forget that Apple actively works against this way of working by intentionally gimping their browser capabilities and outright disallowing competing browsers.

Re: TikTok requests access to devices on local network

#65

Post by Too »

q-rews wrote: post #44

Is it TikTok or is it just because of a captive portal on the WiFi? It happened to me just yesterday: “Why does X require local network access? Ugh.” A minute later “Oh, Y is also requiring network access.” Yes, I was on a public wifi. This may be 100% Apple’s fault, everyone here is just commenting on a photo and not confirming that they also saw the message today.

I had same thing happen some days ago while rebooting my modem at home after accidentally unplugging it.

All kinds of apps I use regularly, which have absolutely no use for it, started asking for permission to list devices on local network.

Re: TikTok requests access to devices on local network

#66

Post by judge2020 »

duiker101 wrote: post #60
judge2020 wrote: post #57

Earlier quoted context omitted.

The cool thing about phones is that you can MITM yourself and see what apps are sending, assuming they don't certificate pin (which TikTok doesn't). The person that reported this during the beta period didn't find any evidence when doing so. https://old.reddit.com/r/videos/comments/fxgi06/not_new_news...

Can you actually still widely do this? Last time I checked on the latest versions of Android apps don't accept user certificates so you can't really do much about any https traffic, which really is the bulk.

The basis of many enterprise networks is device-installed CAs so I would be thoroughly surprised. iOS at least still allows you to install a custom CA and only a few apps will refuse to work with it, who likely reject connections that aren't secured via a specific CA.

Re: TikTok requests access to devices on local network

#67

Post by jeroenhd »

duiker101 wrote: post #60
judge2020 wrote: post #57

Earlier quoted context omitted.

The cool thing about phones is that you can MITM yourself and see what apps are sending, assuming they don't certificate pin (which TikTok doesn't). The person that reported this during the beta period didn't find any evidence when doing so. https://old.reddit.com/r/videos/comments/fxgi06/not_new_news...

Can you actually still widely do this? Last time I checked on the latest versions of Android apps don't accept user certificates so you can't really do much about any https traffic, which really is the bulk.

You can, on a rooted phone. There's ways to install a CA certificate with root (described in my only popular blog post) but there's also alternatives, like using Frida to disable TLS verification all together.

It's certainly not as easy and reliable as it used to be, but it's still common for security research to use these tactics to see what apps are doing.

Re: TikTok requests access to devices on local network

#68

Post by azinman2 »

dangoor wrote: post #2

Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?

If this just start popping up and without an explanation string, my guess is they included some 3rd party SDK that is doing fingerprinting on the local LAN, much like FB SDK's used to do.

Re: TikTok requests access to devices on local network

#69

Post by blackoil »

MichaelGroves wrote: post #37
judge2020 wrote: post #19

Earlier quoted context omitted.

> They used to check your clipboard the whole time too. To be fair quite a lot of apps did this to enable deep links/automatically opening certain clipboard links. Every big app has changed this to no longer show the 'pasted from' notification. And it was never shown that they export those clipboard contents to homebase.

"Lots of people do it" should never be considered a legitimate excuse. Trying to use that excuse should get you kicked out of the meeting room.

Theoretically maybe, practically we have a proverbs 'No one is fired for buying (IBM|MS|Google|AWS)'

Re: TikTok requests access to devices on local network

#70

Post by toxik »

danudey wrote: post #49
mholm wrote: post #9

Earlier quoted context omitted.

Not chromecast. My charitable guess is they're adding support for chromecasting behind feature flags/AB testing, but don't yet have it correctly enabled/disabled. There was a lot of uproar over instagram immediately using the microphone/camera constantly, when they actually just always had the API initialized to make swiping to the camera snappier.

That could also explain why they didn't bother to provide in the notification to the user why they're requesting this access: because they weren't intending to request it (yet). I find the conspiracy theories more compelling, but less likely.

When an app tells you it’s stealing your data, I would say you should believe it.
Post reply on HN