6 ms·

“TikTok is a data collection service that is thinly-veiled as a social network.”

166 points by notRobot 6y ago

funtoos 6y ago
Isn't all social media is ultimately data collection service ?
- Kremator 6y ago
  For some people somehow the fact that this social media has ties to China is worrysome, while they also use smartphones manufactures in China, and consume cheap plastics which gives them way more economical power.
- fsflover 6y ago
  The author explicitly says: "For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is."
  - sukilot 6y ago
    All those apps are closed source and encrypt data, so comparing based on reverse engineering the code seems not an important point of distinction.
    - high_density 6y ago
      being closed source does not mean we can't analyze its behavior. the recent revelation of tiktok's clipboard watching? what were they trying? waiting for some unsuspecting password-manager apps?
  - CogentHedgehog 6y ago
    Didn't the Facebook app get in trouble for hoovering up user data too? Seems like that's already setting a pretty low bar for privacy.
  - zaro 6y ago
    But is it so really? Last year there were articles about how Facebook sdk collects data from each app that integrates it, even before you login with Facebook. To me it still looks like a much wider data collection than what a single app can do.
    - searchableguy 6y ago
      imo, this is even more eye-rolling situation - https://github.com/facebook/facebook-ios-sdk/issues/1374 https://github.com/facebook/facebook-ios-sdk/issues/1374
allzeros 6y ago
I wouldn't be surprised by any of this, but the reddit post reads too... reddit-y, I guess? I mean, I could easily write a post like that without actually doing anything. Where's the proof? I want to see these analytics payloads. I want to see how they disassembled the app. So far, though, there's not a lot of proof, just some statements about analytics data and "I'm a nerd who figures out how apps work for a job".
- parliament32 6y ago
  Oddly, lots of this stuff just seems wrong. On Android, so maybe that's the discrepancy, but he's going on about GPS pinging while the app doesn't even request the Location permission.
  - befictious 6y ago
    From their Privacy Policy... >We automatically collect certain information from you when you use the Platform, including internet or other network activity information such as your IP address, geolocation-related data (as described below), unique device identifiers, browsing and search history (including content you have viewed in the Platform), and Cookies (as defined below). >We collect information about your location, including location information based on your SIM card and/or IP address. With your permission, we may also collect Global Positioning System (GPS) data. >You can switch off GPS location information functionality on your mobile device if you do not wish to share GPS information. The above makes it sound like you have to turn off GPS for everything. They could likely be skirting different methods for collecting this. and the only way to prevent it is turning off gps at the device level not app permission level >We use the 'Region' you select in Settings to customise your TikTok experience. When you use the Platform on a mobile device, we will collect information about your location. In certain jurisdictions, with your permission, we will collect Global Positioning System (GPS) data and mobile device location information. If you do not wish to share your precise location with us, you can switch off location services via the settings on your mobile device >5. Where we store your personal data. The personal data we collect from you may be stored on a server located in Singapore or the United States, outside of the country where you live. We maintain major servers around the world to bring you our services globally and continuously.
curiouser2 6y ago
I'm confused by this. Aren't apps sandboxed fairly hard? How would TikTok get any data outside of what's allowed by Apple/Android's app APIs? If they're getting more information than that, isn't that up to the OS to limit?
- ganoushoreilly 6y ago
  I think one of the more recent allegations (past few days) is that it may be copying the clipboard of iPhones. I've only seen evidence that it was making an API call that can be used maliciously. It's definitely suspect given the value of the intel.
- KayL 6y ago
  The number of info that listed are fairly esay to collect via the STANDARD APIs and without extra approve to access bascially.
olliej 6y ago
As opposed to Facebook?
- EarthMephit 6y ago
  From the linked post he makes a direct comparison to facebook, and its pretty daming for TikTok: "For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare."
  - olliej 6y ago
    the apps themselves don't go to such abusive extent, but that's because they get all the information from the innumerable sites across the web that embed Facebook tracking code.
PEJOE 6y ago
Remote code execution is huge. Why does google allow this on their app store?
- parliament32 6y ago
  I guess because it's run with the permissions of the parent app so it doesn't really matter. You can download and exec all the code you want but it won't really help you do anything if you have the permissions and resource limits of the parent anyway.
  - yjftsjthsd-h 6y ago
    Google is, in fact, breaking such functions, which is a pain for those of us who users do have a legitimate use for it: https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An...
codedokode 6y ago
Isn't Google and Microsoft doing the same? As far as I remember, Google Maps is almost secretly collecting user location data and sending it home. A good solution would be to fix Android and don't let any app access phone number information, any hardware identifiers, location. But instead we see posts like this suggesting to ban TokTok instead. Why?
mcv 6y ago
I have only heard bad things about TikTok so far, and wouldn't let my kids use it. A couple of weeks ago, there was a story about presence of sexual predators preying on children and TikTok's utter lack of moderation.

166 points by notRobot 6y ago

funtoos 6y ago

Isn't all social media is ultimately data collection service ?

Kremator 6y ago
For some people somehow the fact that this social media has ties to China is worrysome, while they also use smartphones manufactures in China, and consume cheap plastics which gives them way more economical power.
fsflover 6y ago
The author explicitly says: "For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is."
- sukilot 6y ago
  All those apps are closed source and encrypt data, so comparing based on reverse engineering the code seems not an important point of distinction.
  - high_density 6y ago
    being closed source does not mean we can't analyze its behavior. the recent revelation of tiktok's clipboard watching? what were they trying? waiting for some unsuspecting password-manager apps?
- CogentHedgehog 6y ago
  Didn't the Facebook app get in trouble for hoovering up user data too? Seems like that's already setting a pretty low bar for privacy.
- zaro 6y ago
  But is it so really? Last year there were articles about how Facebook sdk collects data from each app that integrates it, even before you login with Facebook. To me it still looks like a much wider data collection than what a single app can do.
  - searchableguy 6y ago
    imo, this is even more eye-rolling situation - https://github.com/facebook/facebook-ios-sdk/issues/1374 https://github.com/facebook/facebook-ios-sdk/issues/1374

allzeros 6y ago

I wouldn't be surprised by any of this, but the reddit post reads too... reddit-y, I guess? I mean, I could easily write a post like that without actually doing anything. Where's the proof? I want to see these analytics payloads. I want to see how they disassembled the app. So far, though, there's not a lot of proof, just some statements about analytics data and "I'm a nerd who figures out how apps work for a job".

parliament32 6y ago
Oddly, lots of this stuff just seems wrong. On Android, so maybe that's the discrepancy, but he's going on about GPS pinging while the app doesn't even request the Location permission.
- befictious 6y ago
  From their Privacy Policy... >We automatically collect certain information from you when you use the Platform, including internet or other network activity information such as your IP address, geolocation-related data (as described below), unique device identifiers, browsing and search history (including content you have viewed in the Platform), and Cookies (as defined below). >We collect information about your location, including location information based on your SIM card and/or IP address. With your permission, we may also collect Global Positioning System (GPS) data. >You can switch off GPS location information functionality on your mobile device if you do not wish to share GPS information. The above makes it sound like you have to turn off GPS for everything. They could likely be skirting different methods for collecting this. and the only way to prevent it is turning off gps at the device level not app permission level >We use the 'Region' you select in Settings to customise your TikTok experience. When you use the Platform on a mobile device, we will collect information about your location. In certain jurisdictions, with your permission, we will collect Global Positioning System (GPS) data and mobile device location information. If you do not wish to share your precise location with us, you can switch off location services via the settings on your mobile device >5. Where we store your personal data. The personal data we collect from you may be stored on a server located in Singapore or the United States, outside of the country where you live. We maintain major servers around the world to bring you our services globally and continuously.

curiouser2 6y ago

I'm confused by this. Aren't apps sandboxed fairly hard? How would TikTok get any data outside of what's allowed by Apple/Android's app APIs? If they're getting more information than that, isn't that up to the OS to limit?

ganoushoreilly 6y ago
I think one of the more recent allegations (past few days) is that it may be copying the clipboard of iPhones. I've only seen evidence that it was making an API call that can be used maliciously. It's definitely suspect given the value of the intel.
KayL 6y ago
The number of info that listed are fairly esay to collect via the STANDARD APIs and without extra approve to access bascially.

olliej 6y ago

As opposed to Facebook?

EarthMephit 6y ago
From the linked post he makes a direct comparison to facebook, and its pretty daming for TikTok: "For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare."
- olliej 6y ago
  the apps themselves don't go to such abusive extent, but that's because they get all the information from the innumerable sites across the web that embed Facebook tracking code.

PEJOE 6y ago

Remote code execution is huge. Why does google allow this on their app store?

parliament32 6y ago
I guess because it's run with the permissions of the parent app so it doesn't really matter. You can download and exec all the code you want but it won't really help you do anything if you have the permissions and resource limits of the parent anyway.
- yjftsjthsd-h 6y ago
  Google is, in fact, breaking such functions, which is a pain for those of us who users do have a legitimate use for it: https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An...

codedokode 6y ago

Isn't Google and Microsoft doing the same? As far as I remember, Google Maps is almost secretly collecting user location data and sending it home. A good solution would be to fix Android and don't let any app access phone number information, any hardware identifiers, location. But instead we see posts like this suggesting to ban TokTok instead. Why?

mcv 6y ago

I have only heard bad things about TikTok so far, and wouldn't let my kids use it. A couple of weeks ago, there was a story about presence of sexual predators preying on children and TikTok's utter lack of moderation.