3 ms·

I’ll be showing my age here - but is TikTok so important that it’s worth the risk? I know teenagers aren’t going to care but are people on HN still using this t

by kevsim 6y ago

I’ll be showing my age here - but is TikTok so important that it’s worth the risk? I know teenagers aren’t going to care but are people on HN still using this thing on their phones?

djeiasbsbo 6y ago
I did install it but just to see what all of the fuss lately was about. I didn't "reverse engineer" it but instead used XPrivacyLua permissions manager to log the permission requests and NetGuard firewall application to log all network traffic (these are FOSS android apps/tools). I spoofed all of my device information such as IMEI, clipboard, phone number, location, ssid and so on and then opened the application and used it for a bit. It is true that the app requests/uses almost all permissions regularily but was that surprising? Not really... I'd say it behaves about the same as the WhatsApp application, which seems to have a much better reputation. I was surprised about the fact that TikTok has no login gate though. Videos and comments can be consumed without an account. Even reddit these days is forcing one to either log in or download their mobile app. Would love to share my results/logs but I don't have a blog or really any internet presence for that matter. If requested I would be down to analyse some other apps as well and compare the results!
- Craighead 6y ago
  pastebin your results
- noman-land 6y ago
  How do you spoof all your info like IMEI and phone number?
  - djeiasbsbo 6y ago
    I used the Xposed Module "XPrivacyLua". On Android 10 it only runs in EdXposed which itself is a Magisk Module; Magisk Root is needed. I should mention though, AFAIK only the pro version of XPrivacyLua can spoof these values and log when they are requested. I have it configured so that they randomise at boot. Also keep in mind that this is pretty useless if your IP is exposed. One would just use your IP to gather the location, regardless of spoofed location permissions. So you'd have to either have a firewall as well or use something like Tor.

by kevsim 6y ago

I’ll be showing my age here - but is TikTok so important that it’s worth the risk? I know teenagers aren’t going to care but are people on HN still using this thing on their phones?

djeiasbsbo 6y ago

I did install it but just to see what all of the fuss lately was about. I didn't "reverse engineer" it but instead used XPrivacyLua permissions manager to log the permission requests and NetGuard firewall application to log all network traffic (these are FOSS android apps/tools). I spoofed all of my device information such as IMEI, clipboard, phone number, location, ssid and so on and then opened the application and used it for a bit. It is true that the app requests/uses almost all permissions regularily but was that surprising? Not really... I'd say it behaves about the same as the WhatsApp application, which seems to have a much better reputation. I was surprised about the fact that TikTok has no login gate though. Videos and comments can be consumed without an account. Even reddit these days is forcing one to either log in or download their mobile app. Would love to share my results/logs but I don't have a blog or really any internet presence for that matter. If requested I would be down to analyse some other apps as well and compare the results!

Craighead 6y ago
pastebin your results
noman-land 6y ago
How do you spoof all your info like IMEI and phone number?
- djeiasbsbo 6y ago
  I used the Xposed Module "XPrivacyLua". On Android 10 it only runs in EdXposed which itself is a Magisk Module; Magisk Root is needed. I should mention though, AFAIK only the pro version of XPrivacyLua can spoof these values and log when they are requested. I have it configured so that they randomise at boot. Also keep in mind that this is pretty useless if your IP is exposed. One would just use your IP to gather the location, regardless of spoofed location permissions. So you'd have to either have a firewall as well or use something like Tor.