11 ms·

U.S. Navy bans TikTok from government-issued mobile devices

386 points by swat535 7y ago

Operyl 7y ago
Since I’ve seen this asked elsewhere: There is a legitimate usage for these kinds of apps on some devices. Armed services recruiters tend to use various social media apps to communicate with people they are trying to recruit.
- NullPrefix 7y ago
  Security researchers have a legitimate use of computer viruses. Behavioural analysis or whatever else. Does your grandma have the same legitimate use case?
  - gpm 7y ago
    Depends, does your grandmother feel like learning about viruses? If so, why not.
  - Operyl 7y ago
    I do not quite see that as a fair or valid comparison. Recruiters are trying to target 18 year olds, and the reality is a lot of these 18 year olds (outside of the tech field) prefer to use Snapchat, Facebook, etc to communicate. They’re not using these apps to communicate classified information.
    - NullPrefix 7y ago
      My point is that the Navy has roles other than Recruiter.
  - deleted 7y ago
    [deleted]
- DyslexicAtheist 7y ago
  with recruiters you mean actual recruitment agencies[1] or in the sense of the Chinese IC recruiting foreign agents? [1] I don't see job-recruiting being a reason to allow this app. IMO any device that is used by a public servant paid with tax-$$ should be limited to what it runs and I'd be surprised if they don't have a very strict BYOD policy for this reason. Never mind TikTok they shouldn't be running any social media apps on their phones. There are other problems with this use such as what data ends up being leaked to social media companies (regardless of where they are).
- falcolas 7y ago
  Someone likely did a risk/benefit analysis and the analysis didn’t come out in favor of the benefits. It’s probably that simple.
  - Operyl 7y ago
    In the case of Tiktok, I agree. I’m just arguing for the class of apps in general (social media applications) not for TikTok.
    - falcolas 7y ago
      Given the intrusiveness of social media platforms, I think they would justify having hardware that’s air gapped from their military devices. That way they retain access to their audience, while maintaining security.
- Cougher 7y ago
  Yup, because it's easier to get around the parents' influence when they want to sell kids a line of BS.
- webninja 7y ago
  They can just use Facebook’s Lasso app instead
- kp98 7y ago
  I suppose the message that is sent here is : 'if you want to recruit you'll have to do it on Snapchat, YouTube, Instagram, Twitter, or Facebook instead of the one Chinese based app' Is that not fair?
- bretpiatt 7y ago
  Totally different risk assessment level on a threat actor gaining location information of a recruiter (or all recruiters) vs. location of special forces service members. The recruiter should get a waiver, a use case like that isn't a good reason to default to allowing.
aritmo 7y ago
This is silly. Do they allow any other social networking apps at all on government-issued phones? edit: tik tok makes sense for recruiting, and apparently it is currently used in the UK.
- ngold 7y ago
  It would be hilariously tragic if a major government official used twitter for communication.
  - doublement 7y ago
    I think they all do now. You have to engage with people where the people are.
    - snakeboy 7y ago
      I think it was a Trump joke.
      - doublement 7y ago
        I know that was the intent, but the reality is that eschewing Twitter gains a politician nothing, and costs them an audience.
- vesche 7y ago
  You obviously didn't read the article. > ... Naval and Marine personnel who use government issued smart devices are generally allowed to use popular commercial apps, including common social media apps ...
- KineticLensman 7y ago
  > apparently it is currently used in the UK There are various stories (the Daily Mail, Reuters, Times, please take your pick) that report that the Army is 'playing with' TikTok to see if it works in recruitment. Those same reports say it is being used by 'The Guards Division'. The British Army doesn't have a 'Guards Division' [0] [0] https://www.army.mod.uk/who-we-are/formations-divisions-brigades/ https://www.army.mod.uk/who-we-are/formations-divisions-brig...
aritmo 7y ago
I have watched hundreds of TikTok videos. The adults featured on the videos are less than 5%.
- charlesju 7y ago
  I think it's probably more for security reasons -- ie. they can be passing a dot map of all the Navy personnel around the world and their traveling patterns to the Chinese government.
  - excalibur 7y ago
    That level of basic location data seems almost trivial, they probably don't even need you to install anything for that. I would expect the app feeds them far more data.
  - vesche 7y ago
    Related (fitbit/strava leaking overseas military base layouts): https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki...
aris85 7y ago
Probably due to all the Ghost that appear as you use tiktok
rolltiide 7y ago
and then a Chinese company buys an American app that already has all the data
- kristianc 7y ago
  They already have Grindr (for now)
  - manuelflara 7y ago
    That sale was blocked due to security concerns, so no.
    - mjcl 7y ago
      Currently Grindr is owned by Kunlun, but they have agreed to sell it by June 2020.
- thrower123 7y ago
  By now, I'd be relatively certain that all but the absolute blackest sites are mapped comprehensively with publicly available app data.
  - rolltiide 7y ago
    An American financial service that I had multiple accounts with was just bought by a Chinese organization. There was nothing obscure about the service nor was there publicly available data about my accounts.
    - technofiend 7y ago
      I'd say buying Experian is the nightmare scenario but all that data has already leaked. So maybe buying a major US bank like Wells Fargo is the way to go if someone wants more detailed data about American spending habits. I'm sure it's why Google's Project Cache is extending their reach to banking in 2020.
  - 7y ago
angry_octet 7y ago
Doesn't matter, they have it on their personal phone. App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. The whole idea of unrestricted network access is stupid.
- kardos 7y ago
  How would restricted network access help? If you permit a dodgy app to talk to only one remote endpoint, it can exfiltrate whatever it wants.
  - angry_octet 7y ago
    Why would a flashlight app need to talk to the internet at all? (Advertising.)
- thaumasiotes 7y ago
  > The whole idea of unrestricted network access is stupid. I've been coming around to a similar idea. I'd like a setup something like this for my desktop: 1. Some devices representing network connections. One or more are "real"; others may be VPNs. 2. Per-application settings governing which network devices, if any, the application may use. Default to none. For example, the common way to use a VPN is like this: 1. Start your machine. You're connected to the internet, but not yet to the VPN. All of your running software is already using the internet over the unprotected connection. 2. Start the VPN. It will magically do something such that applications wanting to use "the internet" find it instead of the connection they used to find (the one the VPN itself is still using). All of your running software is now using the VPN. Did you want something to use the other connection? Too bad. I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device.
  - deleted 7y ago
    [deleted]
Trias11 7y ago
Why's "ban" needed? Government should have full control over government issued devices and only whitelisted modifications should be allowed. If it's not this way - someone at government should be held accountable for jeopardizing the security of the nation.
- ralfd 7y ago
  > A Navy spokesman said Naval and Marine personnel who use government issued smart devices are generally allowed to use popular commercial apps, including common social media apps, but from time to time specific programs that present security threats are banned. Should the Navy whitelist Ebay and Amazon? What about the Walmart app? If Target has one should they then apply to get whitelisted? What about navy personal in other countries with their apps? What about popular app/game xyz? There are a million apps? If all that has to be whitelisted the buerocratic overhead would be either really cumbersome or the value of an issued device so small, that people would buy and use their own devices anyways.
  - beatgammit 7y ago
    Do they need those apps to carry out their duties? If not, that should remain on personal devices and left in a secure location while on duty. There have been too many incidents of apps like Strava publishing locations that it's just not worth missing something important.
  - choward 7y ago
    All the "apps" you mentioned should just be well designed web sites. No reason for an app.
    - jomoio 7y ago
      Good point, we'll get the Navy right on that.
      - bdcravens 7y ago
        The point is that if you argue a soldier shouldn't have Target or Amazon on their phone, it's pointless, as they still have Safari or Chrome.
rshnotsecure 7y ago
Not surprising. For several days now TikTok has left the information of 700 million of their users available via an open S3 bucket. It is online now at this very moment and includes IDFAs from Apple as well as interestingly, although I bet American companies do this to, the MAC Addresses. This is significant because my understanding is that Apple rotates / randomizes the MAC address because those can be used to, quite effectively, track individuals anywhere in the world (I would say it is better than GPS often at this point, especially indoors). Storage is cheap so maybe everyone stores them these days, or perhaps someone has found how to guess the rotation pattern (completely unproven theory that is likely wrong but only thing I can think of). The coverage that Skyhook claims to have for instance is extraordinary considering this is totally reliant on Wifi points and cell towers: https://www.skyhook.com/Coverage-Map https://www.skyhook.com/Coverage-Map
- baobabKoodaa 7y ago
  Source needed. I wasn't able to find anything on this by googling.
  - rshnotsecure 7y ago
    Email me. Look at my profile for address.
- webo 7y ago
  Quick google search didn’t reveal anything, source?
- xwdv 7y ago
  What is the link to the open S3 bucket?
- brobinson 7y ago
  Source? Also, will you post a source for your claim that ProtonMail is compromised? (I remember your username from a thread a few weeks ago)
  - 7y ago
dwmcqueen 7y ago
I first read this as banning Twitter from all government devices and thought it was an early Christmas present for America.
Phylter 7y ago
They need to ban Chinese anything from US government anything.
- dang 7y ago
  Please don't post unsubstantive comments here, and certainly not nationalistic flamebait. We don't need yet another nationalistic flamewar. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - pbhjpbhj 7y ago
    I'm not sure that's fair. To me GP comes over as jingoistic nationalism, but it also seems to have a substantive basis - the idea that foreign nations should be ejected at all levels from a governments internal systems? I'd really like to ask "should other nations eject all USA companies products from their governmental systems too?" (because I'm really curious how an apparent ultra-nationalist sees that?), but you've decided we can't explore that avenue. Sure, if things get perjorative cut it off, but conversations here tend to have a higher standard of discourse and excluding anything that might get touchy , IMO, unnecessarily limits the topics we can [usefully!] address here. We can't learn to understand one another if we're afraid to enter discourse on the tricky topics. Yes, there are other places, but this is special here somehow; I think we, HN, as a community can explore these ideas intelligently and maturely with perhaps a slightly lighter tiller.
    - grzm 7y ago
      A key difference between your comment here and the one 'dang is responding to is that yours is conducive to continuing such a conversation in a constructive manner and the latter is not. I find that's very important in engendering the kind of environment you're striving for. That's how I read 'dang's admonishment: it's unsubstantive and flamebait because it doesn't provide much leverage to continue a meaningful conversation and rather encourages knee-jerk, similarly unsubstantive comments (as you've noted in describing it as coming across as "jingoistic nationalism"). (I'll leave this now as continuing a meta-discussion is something these threads often need less of, and I don't have a lot to add beyond this.)
dmix 7y ago
Just what the Navy needs, more hyper bureaucracy for some weak attempt at security.
- noja 7y ago
  Hyper bureaucracy? It's a whitelist for trusted apps on a government device.
  - dmix 7y ago
    One off bans makes more sense, a whole unit set up to pre-approve millions of potential apps is crazy-town. Then they use Google Chrome and hit a phishing-hole site and get their phone owned. But don't worry, they weren't allowed to install Netflix! The problem here is open-source intelligence because TikTok is very popular among young members who spend all their free time in their bunk on their phone. Limiting the apps might help with that, but I'm highly skeptical. There's already plenty of restrictions on social media use for armed-forces members. I believe that path is the way to go - create restrictions on posting personal information. Having some paper pusher unit pre-approving millions of potential apps sounds like a giant waste of time. It makes a lot more sense to react to bad stuff (like one-off reactions for a massively popular video sharing app with sketchy Chinese ownership) than pre-emptively ban everything, simply because it won't do much for security beyond what Apple and Google are already doing in the app store.
    - noja 7y ago
      So because it adds a layer of security rather than 100% watertight perfection, it is bad?
      - dmix 7y ago
        Explain to me how it's useful for security? Because I can guarantee you it will be a giant time-and-money waster with plenty of arbitrary rules that do nothing for security. There's millions of apps and tons come out every year. This nation-wide 'unit' will have to be constantly 'measuring them for security'. This isn't going to accomplish much of anything. Either have a secure phone with pre-installed apps (ie, just a browser plus encrypted phone/messenger, military mapping tools, etc) and let them install nothing (which means they'll just use their private phone any way for the OPSEC fail stuff). Or let them do whatever and selectively ban the ones like TikTok which are massive surveillance potential just based on its popularity alone. These one-off or watching for bad-stuff and react approach makes far more sense to me.
dontwhy 7y ago
Tiktok should be kicked out from our country. Chinese government ban everything(google, facebook, twitter, instgram, ...) of our country, why their company can make money in our country?
- welder 7y ago
  An eye for an eye leaves everyone blind.
  - dontwhy 7y ago
    when our Aircraft carrier is under attack, you won't say that again
- danso 7y ago
  Because the U.S. tends toward having a free market?
  - kp98 7y ago
    I am genuinely curious here, when one player has a free market and the other does not, how do you think that will work out? Do you believe that America can remain dominant while its companies get 85% access to the world population and Chinese companies get 100% access? I honestly don't understand this attitude, yes free markets are great as long as your counter parties are free market economies also, but China has been proven to be anything but
    - madiathomas 7y ago
      Free market is the main feature of Capitalism. China is ruled by a Communist party and they subscribe to communism. Free market is the last thing that can be expected from a communist country. They don't even claim to be a free market. US claims to be a free market. In fact, they are regarded as the most free market in the world. China is forcing US to play by their own rules.
      - 7y ago
cm2187 7y ago
What sort of vetting does Microsoft do on drivers written by manufacturers that ship with Windows?
- wyldfire 7y ago
  Traditionally they have done testing for WHQL certification. It may make sense for them to do analysis or reversing in order to raise the bar. Or maybe change the design of the NT kernel to isolate device drivers better.
  - cm2187 7y ago
    Does that do anything to uncover backdoors? Particularly if they have all the appearance of a bug.
diminish 7y ago
Now the world will see Google & Facebook & Apple as security threats.
- svnpenn 7y ago
  As they should.
- freeflight 7y ago
  Don't forget MS. Took German privacy regulators until recently, more than 3 years after the release of Windows 10, to notice that the thing is phoning encrypted data home even after disabling as much of that stuff as possible. Their final conclusion is that using Windows 10, in a data privacy-compliant way, is only possible with a "rest risk" [0]. Too bad that by now Windows 10 is not just in wide use among businesses, but also the de facto government OS, most of these installations running default settings. Same deal with Intel's ME: The German Federal Office for Information Security, a bit like the IT department for the government, rated Intel ME's risk as high early 2018 [1]. Yet no actual consequences besides that release, government systems still running Windows 10 on Intel platforms. So while a lot of the threats are known and acknowledged, nobody seems to really act on these findings. [0] https://www.heise.de/newsticker/meldung/Datenschutzkonferenz-Hohe-Huerden-fuer-den-Einsatz-von-Windows-10-4584678.html https://www.heise.de/newsticker/meldung/Datenschutzkonferenz... [1] https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2018/01/warnmeldung_cb-k17-2012_update_1.html https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2018/...
- stjohnswarts 7y ago
  That sounds like win-win to me because they kinda are, especially if you work somewhere that deals in highly secure data.
40four 7y ago
After reading this post a couple weeks ago (https://news.ycombinator.com/item?id=21725139 https://news.ycombinator.com/item?id=21725139), banning the app sounds like a good idea. I’m no expert on security, but the situation regarding Tik Tok’s practices sounds really bad.
- anaphor 7y ago
  As soon as I heard about it, I knew right away that they would have some shady practices around how they handle user data. You don't grow that quickly without not having robust data protection safeguards/policies, let alone being run by a company in a jurisdiction not known for their robust data protection laws (to put it nicely).
noobermin 7y ago
How many gov-isssued phones have TikTok? Instagram? If they want to make posts on official accounts shouldn't they do it in a more secure way anyway?
m0zg 7y ago
It's absurd that _any_ non-sanctioned software was ever allowed on US Navy phones, let alone apps developed by a major adversary known for pervasive metadata collection. WTF kind of total and utter incompetence is this? Sounds to me like a major house cleaning is needed.
kccqzy 7y ago
I'm surprised there's even a blacklist of apps for work phones. Shouldn't there be a whitelist instead?
- Diesel555 7y ago
  That is how it actually works. There is an approved app App Store. You have to go through a whole process to get it approved (I've tried). What the article really means to say is it that it's been removed from among the approved apps.
danmg 7y ago
Sino bashing is apparently an acceptable form of racism in 2020. This is no different than the "jap bashing" of the 80s. What coercive things China does do, is mostly for internal stability, a few small border disputes with neighboring areas that were arguably at one point Chinese, and to maintain harmonious trade arrangements. It's a kitten compared to what the CIA has done internationally.
- stjohnswarts 7y ago
  Denying apps from an adversarial country on military personnel phones is not "Sino bashing". I wouldn't see it as American bashing if the Chinese government did similar. I'd just shrug and say "that makes sense".
Priem19 7y ago
Perhaps I should sell the U.S. Navy on my website https://www.quitfacebook.org https://www.quitfacebook.org.
theklub 7y ago
It took that long? Seems like they should have all apps banned and then approve the handful they want
stjohnswarts 7y ago
This is the right thing to do, but they need to do a lot more.
nvr219 7y ago
Why was it ever allowed on these devices in the first place?
avgeek23 7y ago
Tik tok should be wiped off the internet. Pure fucking cancer

386 points by swat535 7y ago

Since I’ve seen this asked elsewhere: There is a legitimate usage for these kinds of apps on some devices. Armed services recruiters tend to use various social media apps to communicate with people they are trying to recruit.

NullPrefix 7y ago
Security researchers have a legitimate use of computer viruses. Behavioural analysis or whatever else. Does your grandma have the same legitimate use case?
- gpm 7y ago
  Depends, does your grandmother feel like learning about viruses? If so, why not.
- Operyl 7y ago
  I do not quite see that as a fair or valid comparison. Recruiters are trying to target 18 year olds, and the reality is a lot of these 18 year olds (outside of the tech field) prefer to use Snapchat, Facebook, etc to communicate. They’re not using these apps to communicate classified information.
  - NullPrefix 7y ago
    My point is that the Navy has roles other than Recruiter.
- deleted 7y ago
  [deleted]
DyslexicAtheist 7y ago
with recruiters you mean actual recruitment agencies[1] or in the sense of the Chinese IC recruiting foreign agents? [1] I don't see job-recruiting being a reason to allow this app. IMO any device that is used by a public servant paid with tax-$$ should be limited to what it runs and I'd be surprised if they don't have a very strict BYOD policy for this reason. Never mind TikTok they shouldn't be running any social media apps on their phones. There are other problems with this use such as what data ends up being leaked to social media companies (regardless of where they are).
falcolas 7y ago
Someone likely did a risk/benefit analysis and the analysis didn’t come out in favor of the benefits. It’s probably that simple.
- Operyl 7y ago
  In the case of Tiktok, I agree. I’m just arguing for the class of apps in general (social media applications) not for TikTok.
  - falcolas 7y ago
    Given the intrusiveness of social media platforms, I think they would justify having hardware that’s air gapped from their military devices. That way they retain access to their audience, while maintaining security.
Cougher 7y ago
Yup, because it's easier to get around the parents' influence when they want to sell kids a line of BS.
webninja 7y ago
They can just use Facebook’s Lasso app instead
kp98 7y ago
I suppose the message that is sent here is : 'if you want to recruit you'll have to do it on Snapchat, YouTube, Instagram, Twitter, or Facebook instead of the one Chinese based app' Is that not fair?
bretpiatt 7y ago
Totally different risk assessment level on a threat actor gaining location information of a recruiter (or all recruiters) vs. location of special forces service members. The recruiter should get a waiver, a use case like that isn't a good reason to default to allowing.

aritmo 7y ago

This is silly. Do they allow any other social networking apps at all on government-issued phones? edit: tik tok makes sense for recruiting, and apparently it is currently used in the UK.

ngold 7y ago
It would be hilariously tragic if a major government official used twitter for communication.
- doublement 7y ago
  I think they all do now. You have to engage with people where the people are.
  - snakeboy 7y ago
    I think it was a Trump joke.
    - doublement 7y ago
      I know that was the intent, but the reality is that eschewing Twitter gains a politician nothing, and costs them an audience.
vesche 7y ago
You obviously didn't read the article. > ... Naval and Marine personnel who use government issued smart devices are generally allowed to use popular commercial apps, including common social media apps ...
KineticLensman 7y ago
> apparently it is currently used in the UK There are various stories (the Daily Mail, Reuters, Times, please take your pick) that report that the Army is 'playing with' TikTok to see if it works in recruitment. Those same reports say it is being used by 'The Guards Division'. The British Army doesn't have a 'Guards Division' [0] [0] https://www.army.mod.uk/who-we-are/formations-divisions-brigades/ https://www.army.mod.uk/who-we-are/formations-divisions-brig...

aritmo 7y ago

I have watched hundreds of TikTok videos. The adults featured on the videos are less than 5%.

charlesju 7y ago
I think it's probably more for security reasons -- ie. they can be passing a dot map of all the Navy personnel around the world and their traveling patterns to the Chinese government.
- excalibur 7y ago
  That level of basic location data seems almost trivial, they probably don't even need you to install anything for that. I would expect the app feeds them far more data.
- vesche 7y ago
  Related (fitbit/strava leaking overseas military base layouts): https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki...

aris85 7y ago

Probably due to all the Ghost that appear as you use tiktok

rolltiide 7y ago

and then a Chinese company buys an American app that already has all the data

kristianc 7y ago
They already have Grindr (for now)
- manuelflara 7y ago
  That sale was blocked due to security concerns, so no.
  - mjcl 7y ago
    Currently Grindr is owned by Kunlun, but they have agreed to sell it by June 2020.
thrower123 7y ago
By now, I'd be relatively certain that all but the absolute blackest sites are mapped comprehensively with publicly available app data.
- rolltiide 7y ago
  An American financial service that I had multiple accounts with was just bought by a Chinese organization. There was nothing obscure about the service nor was there publicly available data about my accounts.
  - technofiend 7y ago
    I'd say buying Experian is the nightmare scenario but all that data has already leaked. So maybe buying a major US bank like Wells Fargo is the way to go if someone wants more detailed data about American spending habits. I'm sure it's why Google's Project Cache is extending their reach to banking in 2020.
- 7y ago

angry_octet 7y ago

Doesn't matter, they have it on their personal phone. App security is so bad that you pretty much need to virtualize the phone and feed it fake sensor data. The whole idea of unrestricted network access is stupid.

kardos 7y ago
How would restricted network access help? If you permit a dodgy app to talk to only one remote endpoint, it can exfiltrate whatever it wants.
- angry_octet 7y ago
  Why would a flashlight app need to talk to the internet at all? (Advertising.)
thaumasiotes 7y ago
> The whole idea of unrestricted network access is stupid. I've been coming around to a similar idea. I'd like a setup something like this for my desktop: 1. Some devices representing network connections. One or more are "real"; others may be VPNs. 2. Per-application settings governing which network devices, if any, the application may use. Default to none. For example, the common way to use a VPN is like this: 1. Start your machine. You're connected to the internet, but not yet to the VPN. All of your running software is already using the internet over the unprotected connection. 2. Start the VPN. It will magically do something such that applications wanting to use "the internet" find it instead of the connection they used to find (the one the VPN itself is still using). All of your running software is now using the VPN. Did you want something to use the other connection? Too bad. I'm sick of the idea that Windows perceives an internet connection somehow, hides it from me, and automatically makes it available to everything that asks for "the internet". But I don't actually know how to do this. Someone is working really, really hard to make sure I don't affect who uses what device.
- deleted 7y ago
  [deleted]

Trias11 7y ago

Why's "ban" needed? Government should have full control over government issued devices and only whitelisted modifications should be allowed. If it's not this way - someone at government should be held accountable for jeopardizing the security of the nation.

ralfd 7y ago
> A Navy spokesman said Naval and Marine personnel who use government issued smart devices are generally allowed to use popular commercial apps, including common social media apps, but from time to time specific programs that present security threats are banned. Should the Navy whitelist Ebay and Amazon? What about the Walmart app? If Target has one should they then apply to get whitelisted? What about navy personal in other countries with their apps? What about popular app/game xyz? There are a million apps? If all that has to be whitelisted the buerocratic overhead would be either really cumbersome or the value of an issued device so small, that people would buy and use their own devices anyways.
- beatgammit 7y ago
  Do they need those apps to carry out their duties? If not, that should remain on personal devices and left in a secure location while on duty. There have been too many incidents of apps like Strava publishing locations that it's just not worth missing something important.
- choward 7y ago
  All the "apps" you mentioned should just be well designed web sites. No reason for an app.
  - jomoio 7y ago
    Good point, we'll get the Navy right on that.
    - bdcravens 7y ago
      The point is that if you argue a soldier shouldn't have Target or Amazon on their phone, it's pointless, as they still have Safari or Chrome.

rshnotsecure 7y ago

Not surprising. For several days now TikTok has left the information of 700 million of their users available via an open S3 bucket. It is online now at this very moment and includes IDFAs from Apple as well as interestingly, although I bet American companies do this to, the MAC Addresses. This is significant because my understanding is that Apple rotates / randomizes the MAC address because those can be used to, quite effectively, track individuals anywhere in the world (I would say it is better than GPS often at this point, especially indoors). Storage is cheap so maybe everyone stores them these days, or perhaps someone has found how to guess the rotation pattern (completely unproven theory that is likely wrong but only thing I can think of). The coverage that Skyhook claims to have for instance is extraordinary considering this is totally reliant on Wifi points and cell towers: https://www.skyhook.com/Coverage-Map https://www.skyhook.com/Coverage-Map

baobabKoodaa 7y ago
Source needed. I wasn't able to find anything on this by googling.
- rshnotsecure 7y ago
  Email me. Look at my profile for address.
webo 7y ago
Quick google search didn’t reveal anything, source?
xwdv 7y ago
What is the link to the open S3 bucket?
brobinson 7y ago
Source? Also, will you post a source for your claim that ProtonMail is compromised? (I remember your username from a thread a few weeks ago)
- 7y ago

dwmcqueen 7y ago

I first read this as banning Twitter from all government devices and thought it was an early Christmas present for America.

Phylter 7y ago

They need to ban Chinese anything from US government anything.

dang 7y ago
Please don't post unsubstantive comments here, and certainly not nationalistic flamebait. We don't need yet another nationalistic flamewar. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- pbhjpbhj 7y ago
  I'm not sure that's fair. To me GP comes over as jingoistic nationalism, but it also seems to have a substantive basis - the idea that foreign nations should be ejected at all levels from a governments internal systems? I'd really like to ask "should other nations eject all USA companies products from their governmental systems too?" (because I'm really curious how an apparent ultra-nationalist sees that?), but you've decided we can't explore that avenue. Sure, if things get perjorative cut it off, but conversations here tend to have a higher standard of discourse and excluding anything that might get touchy , IMO, unnecessarily limits the topics we can [usefully!] address here. We can't learn to understand one another if we're afraid to enter discourse on the tricky topics. Yes, there are other places, but this is special here somehow; I think we, HN, as a community can explore these ideas intelligently and maturely with perhaps a slightly lighter tiller.
  - grzm 7y ago
    A key difference between your comment here and the one 'dang is responding to is that yours is conducive to continuing such a conversation in a constructive manner and the latter is not. I find that's very important in engendering the kind of environment you're striving for. That's how I read 'dang's admonishment: it's unsubstantive and flamebait because it doesn't provide much leverage to continue a meaningful conversation and rather encourages knee-jerk, similarly unsubstantive comments (as you've noted in describing it as coming across as "jingoistic nationalism"). (I'll leave this now as continuing a meta-discussion is something these threads often need less of, and I don't have a lot to add beyond this.)

dmix 7y ago

Just what the Navy needs, more hyper bureaucracy for some weak attempt at security.

noja 7y ago
Hyper bureaucracy? It's a whitelist for trusted apps on a government device.
- dmix 7y ago
  One off bans makes more sense, a whole unit set up to pre-approve millions of potential apps is crazy-town. Then they use Google Chrome and hit a phishing-hole site and get their phone owned. But don't worry, they weren't allowed to install Netflix! The problem here is open-source intelligence because TikTok is very popular among young members who spend all their free time in their bunk on their phone. Limiting the apps might help with that, but I'm highly skeptical. There's already plenty of restrictions on social media use for armed-forces members. I believe that path is the way to go - create restrictions on posting personal information. Having some paper pusher unit pre-approving millions of potential apps sounds like a giant waste of time. It makes a lot more sense to react to bad stuff (like one-off reactions for a massively popular video sharing app with sketchy Chinese ownership) than pre-emptively ban everything, simply because it won't do much for security beyond what Apple and Google are already doing in the app store.
  - noja 7y ago
    So because it adds a layer of security rather than 100% watertight perfection, it is bad?
    - dmix 7y ago
      Explain to me how it's useful for security? Because I can guarantee you it will be a giant time-and-money waster with plenty of arbitrary rules that do nothing for security. There's millions of apps and tons come out every year. This nation-wide 'unit' will have to be constantly 'measuring them for security'. This isn't going to accomplish much of anything. Either have a secure phone with pre-installed apps (ie, just a browser plus encrypted phone/messenger, military mapping tools, etc) and let them install nothing (which means they'll just use their private phone any way for the OPSEC fail stuff). Or let them do whatever and selectively ban the ones like TikTok which are massive surveillance potential just based on its popularity alone. These one-off or watching for bad-stuff and react approach makes far more sense to me.

dontwhy 7y ago

Tiktok should be kicked out from our country. Chinese government ban everything(google, facebook, twitter, instgram, ...) of our country, why their company can make money in our country?

welder 7y ago
An eye for an eye leaves everyone blind.
- dontwhy 7y ago
  when our Aircraft carrier is under attack, you won't say that again
danso 7y ago
Because the U.S. tends toward having a free market?
- kp98 7y ago
  I am genuinely curious here, when one player has a free market and the other does not, how do you think that will work out? Do you believe that America can remain dominant while its companies get 85% access to the world population and Chinese companies get 100% access? I honestly don't understand this attitude, yes free markets are great as long as your counter parties are free market economies also, but China has been proven to be anything but
  - madiathomas 7y ago
    Free market is the main feature of Capitalism. China is ruled by a Communist party and they subscribe to communism. Free market is the last thing that can be expected from a communist country. They don't even claim to be a free market. US claims to be a free market. In fact, they are regarded as the most free market in the world. China is forcing US to play by their own rules.
    - 7y ago

cm2187 7y ago

What sort of vetting does Microsoft do on drivers written by manufacturers that ship with Windows?

wyldfire 7y ago
Traditionally they have done testing for WHQL certification. It may make sense for them to do analysis or reversing in order to raise the bar. Or maybe change the design of the NT kernel to isolate device drivers better.
- cm2187 7y ago
  Does that do anything to uncover backdoors? Particularly if they have all the appearance of a bug.

diminish 7y ago

Now the world will see Google & Facebook & Apple as security threats.

svnpenn 7y ago
As they should.
freeflight 7y ago
Don't forget MS. Took German privacy regulators until recently, more than 3 years after the release of Windows 10, to notice that the thing is phoning encrypted data home even after disabling as much of that stuff as possible. Their final conclusion is that using Windows 10, in a data privacy-compliant way, is only possible with a "rest risk" [0]. Too bad that by now Windows 10 is not just in wide use among businesses, but also the de facto government OS, most of these installations running default settings. Same deal with Intel's ME: The German Federal Office for Information Security, a bit like the IT department for the government, rated Intel ME's risk as high early 2018 [1]. Yet no actual consequences besides that release, government systems still running Windows 10 on Intel platforms. So while a lot of the threats are known and acknowledged, nobody seems to really act on these findings. [0] https://www.heise.de/newsticker/meldung/Datenschutzkonferenz-Hohe-Huerden-fuer-den-Einsatz-von-Windows-10-4584678.html https://www.heise.de/newsticker/meldung/Datenschutzkonferenz... [1] https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2018/01/warnmeldung_cb-k17-2012_update_1.html https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2018/...
stjohnswarts 7y ago
That sounds like win-win to me because they kinda are, especially if you work somewhere that deals in highly secure data.

40four 7y ago

After reading this post a couple weeks ago (https://news.ycombinator.com/item?id=21725139 https://news.ycombinator.com/item?id=21725139), banning the app sounds like a good idea. I’m no expert on security, but the situation regarding Tik Tok’s practices sounds really bad.

anaphor 7y ago
As soon as I heard about it, I knew right away that they would have some shady practices around how they handle user data. You don't grow that quickly without not having robust data protection safeguards/policies, let alone being run by a company in a jurisdiction not known for their robust data protection laws (to put it nicely).

noobermin 7y ago

How many gov-isssued phones have TikTok? Instagram? If they want to make posts on official accounts shouldn't they do it in a more secure way anyway?

m0zg 7y ago

It's absurd that _any_ non-sanctioned software was ever allowed on US Navy phones, let alone apps developed by a major adversary known for pervasive metadata collection. WTF kind of total and utter incompetence is this? Sounds to me like a major house cleaning is needed.

kccqzy 7y ago

I'm surprised there's even a blacklist of apps for work phones. Shouldn't there be a whitelist instead?

Diesel555 7y ago
That is how it actually works. There is an approved app App Store. You have to go through a whole process to get it approved (I've tried). What the article really means to say is it that it's been removed from among the approved apps.

danmg 7y ago

Sino bashing is apparently an acceptable form of racism in 2020. This is no different than the "jap bashing" of the 80s. What coercive things China does do, is mostly for internal stability, a few small border disputes with neighboring areas that were arguably at one point Chinese, and to maintain harmonious trade arrangements. It's a kitten compared to what the CIA has done internationally.

stjohnswarts 7y ago
Denying apps from an adversarial country on military personnel phones is not "Sino bashing". I wouldn't see it as American bashing if the Chinese government did similar. I'd just shrug and say "that makes sense".

Priem19 7y ago

Perhaps I should sell the U.S. Navy on my website https://www.quitfacebook.org https://www.quitfacebook.org.

theklub 7y ago

It took that long? Seems like they should have all apps banned and then approve the handful they want

stjohnswarts 7y ago

This is the right thing to do, but they need to do a lot more.

nvr219 7y ago

Why was it ever allowed on these devices in the first place?

avgeek23 7y ago

Tik tok should be wiped off the internet. Pure fucking cancer