7 ms·

Also if you check the AndroidManifest.xml of TikTok app you'll see they are tracking persistent device identifiers coupled with phone #. Then if you uninstall T

Also if you check the AndroidManifest.xml of TikTok app you'll see they are tracking persistent device identifiers coupled with phone #. Then if you uninstall TikTok you'll still have a bunch of their files in shared space that other Chinese apps can pick up were you to install them, presumably so they can track you even if you uninstall the app.

vymague 7y ago
Is this something we can report? Or is it allowed in Android?
- avocado4 7y ago
  It's a bad practice according to Google, but not forbidden. https://developer.android.com/training/articles/user-data-ids https://developer.android.com/training/articles/user-data-id...
  - mtgx 7y ago
    I believe there were some slight restrictions in Android 10, but probably nowhere near enough (the platform is owned by a tracking company after all): https://developer.android.com/about/versions/10/privacy/changes#data-ids https://developer.android.com/about/versions/10/privacy/chan... Check this out: https://blog.acolyer.org/2019/09/25/50-ways-to-leak-your-data/ https://blog.acolyer.org/2019/09/25/50-ways-to-leak-your-dat...
- chii 7y ago
  Is there a way to prevent an app from leaking data put like this, e.g, some kind of sandbox disk where files written with one app cannot be accessed by another app (until the user allows it - like photo sharing etc)?
  - inetknght 7y ago
    A container, for example?
  - baroffoos 7y ago
    Android has this but it works on the app authors side. Each app has its own private storage space where other apps and even the device owner(!!) can't access. There is then a shared /sdcard folder which apps must request permission to use (Access device storage). Tiktok is requesting this sdcard folder access and dropping trackers in it. Android does allow you to deny this permission but the app will probably require it to share images (Even though I'm pretty sure android provides a ui for sending images without storage access)
  - htfy96 7y ago
    This would be enforced in the next version of Android IIRC. If you happen to have a rooted device and trust closed-source app you can also try Storage Redirect ( https://rikka.app/storage_redirect/ https://rikka.app/storage_redirect/ )
    - manderley 7y ago
      Can't you simply deny TikTok access to shared storage? This permission has been part of Android for a few years now.
LimKruscal 7y ago
Is that so? I decompile the v7.4.6 APK file through javadecompilers.com and only find out they ask for several devices permission. Also, I think if they want to do this they will not put it in the AndroidManifest.xml because this file is not able to store the ID of devices and it will make it super easy for us to sue them.
- deleted 7y ago
  [deleted]
- Cthulhu_ 7y ago
  Who are you? You only registered to make this one comment, denying the claims without any backing information and while promoting a random website / service. I'm not sure you're acting in good faith and I wonder whose payroll you're on.
  - LimKruscal 7y ago
    In fact, this is the first news I'm interested in because I use TikTok often. I'm sorry and I'm really just a beginner in programming. The website is used to decompile the APK file so that I can see through the XML file, but I just haven't figured out how they track persistent device identifiers in the XML file. Maybe just because I am not familiar with Android and I should do my research first...
  - LimKruscal 7y ago
    Sorry again.
yorwba 7y ago
Relevant HN submission about this kind of behavior: https://news.ycombinator.com/item?id=21071746 https://news.ycombinator.com/item?id=21071746

vymague 7y ago

Is this something we can report? Or is it allowed in Android?

avocado4 7y ago
It's a bad practice according to Google, but not forbidden. https://developer.android.com/training/articles/user-data-ids https://developer.android.com/training/articles/user-data-id...
- mtgx 7y ago
  I believe there were some slight restrictions in Android 10, but probably nowhere near enough (the platform is owned by a tracking company after all): https://developer.android.com/about/versions/10/privacy/changes#data-ids https://developer.android.com/about/versions/10/privacy/chan... Check this out: https://blog.acolyer.org/2019/09/25/50-ways-to-leak-your-data/ https://blog.acolyer.org/2019/09/25/50-ways-to-leak-your-dat...
chii 7y ago
Is there a way to prevent an app from leaking data put like this, e.g, some kind of sandbox disk where files written with one app cannot be accessed by another app (until the user allows it - like photo sharing etc)?
- inetknght 7y ago
  A container, for example?
- baroffoos 7y ago
  Android has this but it works on the app authors side. Each app has its own private storage space where other apps and even the device owner(!!) can't access. There is then a shared /sdcard folder which apps must request permission to use (Access device storage). Tiktok is requesting this sdcard folder access and dropping trackers in it. Android does allow you to deny this permission but the app will probably require it to share images (Even though I'm pretty sure android provides a ui for sending images without storage access)
- htfy96 7y ago
  This would be enforced in the next version of Android IIRC. If you happen to have a rooted device and trust closed-source app you can also try Storage Redirect ( https://rikka.app/storage_redirect/ https://rikka.app/storage_redirect/ )
  - manderley 7y ago
    Can't you simply deny TikTok access to shared storage? This permission has been part of Android for a few years now.

LimKruscal 7y ago

Is that so? I decompile the v7.4.6 APK file through javadecompilers.com and only find out they ask for several devices permission. Also, I think if they want to do this they will not put it in the AndroidManifest.xml because this file is not able to store the ID of devices and it will make it super easy for us to sue them.

deleted 7y ago
[deleted]
Cthulhu_ 7y ago
Who are you? You only registered to make this one comment, denying the claims without any backing information and while promoting a random website / service. I'm not sure you're acting in good faith and I wonder whose payroll you're on.
- LimKruscal 7y ago
  In fact, this is the first news I'm interested in because I use TikTok often. I'm sorry and I'm really just a beginner in programming. The website is used to decompile the APK file so that I can see through the XML file, but I just haven't figured out how they track persistent device identifiers in the XML file. Maybe just because I am not familiar with Android and I should do my research first...
- LimKruscal 7y ago
  Sorry again.

yorwba 7y ago

Relevant HN submission about this kind of behavior: https://news.ycombinator.com/item?id=21071746 https://news.ycombinator.com/item?id=21071746