28 ms·

Amazon says email banning TikTok from employee phones was ‘sent in error’

546 points by danso 6y ago

tzs 6y ago
How does Amazon email access work from home desktops? I assume it is not just simple POP/IMAP/SMTP authenticated by username/password, because if it was you could use that from mobile, too.
nitrobeast 6y ago
Standard corp policy? Google disallows dropbox on devices that can access Google internal data as well.
ziddoap 6y ago
I'm more surprised Amazon (or any company, really) employees using an employer-managed device would have TikTok on them to start with, to be honest. As the follow-up tweet says: "Completely independent of the specifics in this instance: get a second device before installing an employer's config profile on your personal device"
- ianmobbs 6y ago
  Does Amazon provide company phones or just install an MDM profile on your personal phone? I have TikTok installed on my phone, and if my employer said I had to remove it to access my work email, I'd ask them to buy me a work phone. It seems a bit ridiculous that they'd want to control what apps you download on your personal device without providing an alternative.
  - ziddoap 6y ago
    I'll admit I don't know the specifics beyond what was tweeted. I'm with you though... If an employer wants to manage my device, they can provide the device.
    - jkaplowitz 6y ago
      When I worked at Google over 5 years ago, mobile device options for accessing company accounts were a company-provided and company-owned device with a company-paid phone bill, a personal device with company-provided mobile device management (and sometimes cell phone bill expensing if you for example had on-call duties), a personal device with only limited browser-based work account access, and no account access via mobile. The first of these could sometimes have implications for ownership of personal projects created using the device, which was one of many reasons I picked the second option, but it was absolutely permitted at least for any case where the company cared about you having mobile account access.
      - jeffbee 6y ago
        The third option - accessing only browser sites - is under appreciated. I never needed to install Google's MDM on my mobile devices, I just used mobile web gmail and so forth. It's great, honestly, and the mobile web Calendar has the advantage that it doesn't destroy your battery life like the Calendar app will. I even saw a guy using the code review site on his mobile, on BART. That was dumb from the standpoint of infosec, usability, and mental health, but shows how much is possible in the browser.
        ghaff 6y ago
        Part of me thinks that MDM on employee phones has become a something of a checkbox item because customers ask for it but it's not clear to what extent it really protects sensitive customer data (which is what they're concerned about).
        jeffbee 6y ago
        It is literally a checkbox item for PCI DSS.
        prteja11 6y ago
        Can you share the requirement from PCI DSS? [it's not]
  - haalia 6y ago
    Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise.
    - filoleg 6y ago
      > Does Amazon provide company phones or just install an MDM profile on your personal phone? > Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise. Not true (source: current MSFT employee). More detailed explanation below, as neither former nor latter describes MSFT accurately. So, for most teams and positions (there are many exceptions), you don't get a dedicated work phone. So yeah, if you want to access work stuff on a mobile device, you need to install MSFT MDM on your personal phone, and they will, allegedly, be able to control stuff on it (depending on the device itself and how MDM is configured). However, there are no requirements to do it. You can simply not install any work-related stuff on your phone, so you won't need an MDM. I simply don't access any work resources on my personal phone. If I need to do work, i open my work laptop. If they want me to use work apps on mobile and be accessible, they should provide a company phone for this. There have been zero conflicts around it on my end, even after multiple years of working there on multiple different teams. Not once have I even got an implied request from anyone (managers, colleagues, etc.) to be accessible on mobile (except for when I am on-call, but for that, they just need my phone number, not any specific apps installed on my phone, and everyone knows it) or any questions about it. Everyone is totally cool with people not being glued to their work apps on their phones on their own free time. But you are correct, those who choose to use work apps have to give MDM permissions to their personal devices or buy a dedicated device for that (exceptions apply, because there are some teams that provide dedicated work phones). However, unless it is required for the job to be able to use work apps on your mobile device, I think it is fair if they don't provide a work phone. Makes it easier for me to not check on any work stuff during the weekend.
      - haalia 6y ago
        Yes, you're correct, and I didn't mean to imply that MSFT forces employees to install their MDM on personal devices. It was optional for me as well, with a large full-disclosure prompt stating that they can remotely wipe your device if you proceed with mobile setup.
  - unethical_ban 6y ago
    At my company, you have to provide your own device, but the phone number/plan is either (a) paid for by the company, or (b) you get a $40/mo stipend for cell service. It turns out that I can use our 2FA app without MDM, on my personal. And nowadays, I rarely use slack or email from mobile, and I don't get calls. I am pretty strong in the "don't put company stuff on personal devices" camp. Even if they don't control your phone by policy, they do technically. They put root certs on the device, and though they can't see individual app data (depending on config) they can see a list of installed apps, and enforce certain baselines.
  - ta20200710 6y ago
    Amazon has MDM (Airwatch). AFAIK there are not generally company phones or phone plans. Monthly limit on reimbursement for phone business expenditures in the US is $50, although I think you can also expense the device itself.
  - dickjocke 6y ago
    No Amazon generally does not provide you a company phone, at least not when I was there.
  - nixass 6y ago
    If your job requires it, you will get it. It's been like that for a while now
  - yumraj 6y ago
    No, they are controlling the environment under which their company emails can be accessed. If you, as an employee, don't want to remove TikTok I believe you will have that right, it's just that you won't be able to access company emails from that device. Now, whether or not that leads to a company phone or you having to look for another job, depends on the individual and how important that individual is to the company.
    - chooseaname 6y ago
      If any company expects me to access my work email while mobile, they have to provide a phone. I never mix work and personal. I've also never had a company say no to that.
      - cheonic729 6y ago
        > If any company expects me to access my work email while mobile, they have to provide a phone. No they don't. If you don't like it, switch employers.
        Assumer 6y ago
        Pretty sure that's what he's saying. The company gets to choose between dropping the requirement, providing a phone or hiring/retraining.
        sdoering 6y ago
        Depends on the jurisdiction. In Germany they do. Labor rights explicitly says that your employer needs to provide the means for you to do your work. And that includes mobile phones if they want you to access your work email (or whatever) from a mobile device.
        GekkePrutser 6y ago
        Yes they do... The problem is some users in Germany actually prefer to use their personal one so they don't have to carry two.. But due to this mindset they can't. I don't think the German approach is always the best.
  - spelunker 6y ago
    There's also no requirement to have your business email on your phone, at least in my organization in Amazon. I'm happy to leave it off and not worry about any issues like this. Of course I do have other apps directly related to work... I guess those aren't an issue if I had TikTok?
    - foolfoolz 6y ago
      i haven’t had work email on my phone in 7 years. it has not impacted my career negatively
      - smabie 6y ago
        How do you know?
  - Sodman 6y ago
    Most companies I've worked for wouldn't provide a work phone and there's no explicit expectation that you read or answer work e-mails on your phone. But like everything else, if you don't read/reply to work e-mails on your phone, and your colleagues do, good luck getting that promotion/raise/bonus.
- wilde 6y ago
  Not everyone can afford 2 phones, but their employers expect them to be online all the time anyway. This is particularly true of people who work in US hospitals.
  - tristor 6y ago
    Why would you need to be able to afford 2 phones if your employer is requiring you to have a mobile phone for work? That's a situation in which the employer should provide the phone. I've been on-call or mobile-connected for over a decade, I have never had an employer even suggest that I should foot the bill for a work device. Either they've provided me a phone fully paid for work to be returned if I exit, or have covered the cost of my phone bill for my personal device in return for accessibility outside business hours.
    - thereticent 6y ago
      There's no good explanation except that US healthcare orgs tend to misuse staff and clinical providers. Super-specialized doctor with untold postdoc training in faculty at my academic medical center? You've got to encrypt your personal phone to standard and install several required apps. No it is not expensed.
      - FireBeyond 6y ago
        Apropos of the rightness or otherwise of this stance, I don't think "specialist physicians" typically fall into the category of people who "cannot afford 2 phones".
        thereticent 6y ago
        I agree. Neither do top industry execs, top sales personnel, etc. It seems from most of the comments that even in lieu of a work phone, compensation for a mobile plan is normal and expected most places. I may be mistaken, but the culture of large healthcare orgs does seem to promote an expectation that the employees be more altruistic then would be expected elsewhere, even within the employer-employee relationship.
- thesausageking 6y ago
  Most people I know check their work email from their personal phone. Work either doesn't buy them one or they don't want to carry around two phones.
  - kevin_thibedeau 6y ago
    Most people don't need to be on call 24/7 so they could just divorce themselves from off hours work and live like in the ancient times.
    - disgruntledphd2 6y ago
      My dad worked in construction, and from the late 80's and throughout all of the 90's his company kept offering him a company phone (I think car-phone first). He never got one, because as he said, if they have your number they'll call you, if they don't then they'll solve their own problem. Looking back on it now, it was prescient advice.
    - coldpie 6y ago
      Amen. If you're not paying me to be on-call, I'm not putting any work info on my phone. Whatever's going on can wait until 9 tomorrow morning.
    - GekkePrutser 6y ago
      I don't really agree... I like the flexibility. Sometimes someone from the US calls me with an urgent problem in the evening (I'm in Europe so not much overlap in work hours). So what... Sometimes I go to the shop or bank during the day. Or even a walk to the beach if it's not so busy. They're paying me to do a (global) job, not to sit at my desk between 9:00 and 17:00. Personally I love this flexibility. And I don't feel like I work more than 40 hours, I don't even count them but I doubt I do, especially if I omit the time I spend during "working hours" reading hacker news or other stuff. My work is my hobby anyway. I do think people who like having fixed work times should have the opportunity to have them. But I also think people like me should be able to work like this without it being considered a bad thing.
- ardy42 6y ago
  > I'm more surprised Amazon (or any company, really) employees using an employer-managed device would have TikTok on them to start with, to be honest. I am too. Many years ago at my employer, someone fat-fingered a command and wiped every single iPhone/iPad that an employee had configured to connect the company email system. Even after restoring a backup, the devices would just wipe themselves again unless the owner managed to remove the MDM profile before it reconnected to the internet. A good fraction of my coworkers were affected. I'm not giving anyone access to do that to my personal data.
  - matsemann 6y ago
    Not exactly the same, but where I used to work someone had turned on "wipe the phone after x incorrect pins" without notifying anyone. Lots of people with kids got their phone remotely deleted. After that I've never allowed an employer to control my personal devices. Not that I actually did before, didn't know activating that stuff had so bug implications. I just wanted the calendar on my phone.
    - bonzini 6y ago
      With Android work profiles the employer can require you to allow remotely wiping the work profile, but that would not allow them to touch your personal profile.
  - btgeekboy 6y ago
    If you can't handle your phone being remotely wiped, you also can't handle it being lost, stolen, or broken. For me, it's a minor inconvenience at best, not a death sentence.
    - scohesc 6y ago
      I'd rather be able to blame myself for my stupid mistakes - not be beholden to Amazon's (or whoever's) MDM profile. Especially when companies don't make it clear that "if you log into your email on your phone using this app, we install MDM, root certificates, have the ability to remote wipe, etc. etc. etc."
- easytiger 6y ago
  Yea. Coming from a banking and financial services background I'm incredulous than any company would allow any social media on a device. This was all much easier in the blackberry days for them to control
  - braythwayt 6y ago
    "This was all much easier in the blackberry days for them to control" And indeed, that was Blackberry's big sales pitch. BYOD creates many, many wonderful consequences, however it also has tradeoffs, and those tradeoffs are not for the faint-of-security.
- wittyreference 6y ago
  It's been a while since I've seen employers offer work phones. What I've seen for the last few years is an offer to pay or subsidize a data plan. If Amazon doesn't provide me a work phone, they can eff right off in attempting to dictate what I put on my phone.
- wiredone 6y ago
  From what I know of ppl who work there, they pay for employees phone plans (is they pay for a phone).
markovbot 6y ago
I assume they won't be doing that to the main-stream spyware pushed by US companies.
- andybak 6y ago
  Which ones and what is your threat model?
  - vkou 6y ago
    The threat model of the US government, or a US company spying on a US citizen is, to the citizen, about as harmful as the Chinese government spying on them. Actually moreso, in the case of the US government.
    - rrix2 6y ago
      but amazon doesn't care about its employees in that context, only about protecting their own company standing. (and many people will say here "why shouldn't they?!")
    - ac29 6y ago
      There is no reason for the US government to do industrial espionage on US companies. China might not be doing it either (via TikTok, at least), but it does have a motive.
      - vkou 6y ago
        No, but there's reason for the US government to spy on you, if you are a problem person. Why do you assume industrial espionage is the sole reason for a government to spy on you?
- manquer 6y ago
  The threat model for AMZ is state sponsored corporate espionage, not government intruding on your and my privacy. The former cost them a ton of money unlike the later. Given their inability to enforce IP or many other laws in china even if there was similar espionage happening in the U.S. the legal system is strong enough for Amazon not to worry of losing money.
orblivion 6y ago
Sorry if I missed something obvious, but if we're at the point where the U.S. government is even contemplating banning TikTok, how come it's on Google and Apple stores at this point? They seem to be at least somewhat vigilant about spyware etc.
- tehwebguy 6y ago
  Apple should remove it for being spyware. Google should remove it for being competition.
- yesplorer 6y ago
  1. Because the app stores don't serve a single country. 2. People don't use the app store at the pleasure of the US government.
  - orblivion 6y ago
    Forget countries and governments. Don't they serve the users, at least to some extent? Forgetting the political issues, there have been multiple spyware scandals here, right? Or did I get the wrong idea? Of course these companies have selfish corporate interests, but I've seen both of these companies show at least _some_ level of care for their users. Even if it's part of keeping up appearances out of concern for their corporate interests.
    - yesplorer 6y ago
      At this point, no single government has provided a verifiable reason why Tik tok should be banned. if there were verifiable claims, you think Apple and Google will conveniently let them be in their app stores and take the heat for it? What benefit would they get?
  - sc11 6y ago
    > 1. Because the app stores don't serve a single country. There are country-specific Apple app stores and apps that are only available in some countries
adreamingsoul 6y ago
And that's why I never setup email on my personal mobile device when I worked for AWS.
hn3333 6y ago
Does anyone else feel we're suddenly supposed to be anti-China? Is it because of Hong Kong? (Honest question, I have no strong opinion .) Because it feels like after Russia and Muslims now China is the new enemy. Kind of stupid imho. Anyway, the high road would probably be not to ban any apps but to make the operating systems safer..
- partiallypro 6y ago
  China has been an American economic foe for a while. The CCP has stepped up measures and started to push their agenda and censorship globally. They have stepped up their presence in the South China sea and claimed ownership of international waters. They have clamped down on Hong Kong and other provinces, put Muslims in concentration camps using them as slave labor, stealing their organs, shaving their heads and selling the hair on the market. They've been using their state controlled enterprises to spy on people outside of their borders (I'm not saying the west is innocent 100% on that one.) So...I don't think it's stupid at all. China (the CCP) is anti-freedom. The west is generally a liberal society. https://www.axios.com/china-hong-kong-law-global-activism-ff1ea6d1-0589-4a71-a462-eda5bea3f78f.html?utm_source=twitter&utm_medium=social&utm_campaign=organic&utm_content=1100 https://www.axios.com/china-hong-kong-law-global-activism-ff...
  - 8ytecoder 6y ago
    They have used Belt and Road to expand their influence. They have extended loans and goodwill to bring various countries in Asia and Africa under their influence. They are way more aggressive and assertive than they used to be. Chinese companies and investment firms have been aggressively buying companies throughout the world. The list goes on. Without commenting on the values of it, at the very least it's a challenge to the current world order and we'd expect countries to at least push back a bit. In fact, I was surprised it took over a decade for countries to start pushing back.
    - president 6y ago
      > In fact, I was surprised it took over a decade for countries to start pushing back. It didn't help that many politicians, media, and elites had been slowly bought by China. There were many China skeptics that had raised red flags but were largely ignored.
danso 6y ago
Note: since this tweet/submission, some outlets have written stories about this: https://www.theverge.com/2020/7/10/21320196/amazon-employees-tiktok-uninstall-email-trump-administration-pompeo-ban https://www.theverge.com/2020/7/10/21320196/amazon-employees... https://www.nytimes.com/2020/07/10/technology/tiktok-amazon-security-risk.html https://www.nytimes.com/2020/07/10/technology/tiktok-amazon-...
- ehsankia 6y ago
  I'm curious, are these 1. Devices owned by Amazon, for work 2. Personal devices with the amazon email added directly 3. Personal devices with amazon email added on Work profile Could not find this info in the articles or tweet.
  - paxys 6y ago
    I don't think any mid-large company allows 2 anymore. Access to company resources always comes with an MDM policy.
    - codegladiator 6y ago
      You are wrong to think that. I wish I could name the companies.
      - sdoering 6y ago
        I know some. And I know others with MDM - but without policies regarding installation of apps.
      - deleted 6y ago
        [deleted]
    - btashton 6y ago
      I don't get why people are OK with a company being able to wipe a personal device on a whim. If you want full control of my mobile, then provide a mobile.
atarian 6y ago
Makes a lot of sense considering AWS deals with sensitive government data.
schnable 6y ago
What's the security/privacy vulnerability that would allow TikTok access to sensitive info from email?
- jeffbee 6y ago
  Clipboard access.
- Andrex 6y ago
  Contacts at least, as the lowest-hanging fruit.
- closetnerd 6y ago
  Likely that they have the potential to have as much information about us as Facebook does - but China? If there was a real security/privacy issue - I'd be more upset with Apple than China (as an iPhone user). Apple needs to watch my back.
  - gandutraveler 6y ago
    On top of background device data and analytics there is lot of sensetive user data shared on the app for which can be used to target certain audience. Social engineering this data and joining it with other apps(which can have security holes) is enough to hack the device and steal additional info. All this also applies to American companies like FB, Google etc however american companies don't have a parent like CCP who has access to all the data.
- deleted 6y ago
  [deleted]
- Randor 6y ago
  Exactly. The real question is why does your phone even allow such things to happen in the first place?
dequalant 6y ago
US would destroy anything not originating from its soil. Pathetic.
- LUmBULtERA 6y ago
  How do you make this leap?
  - dequalant 6y ago
    Look at TikTok? Not from US, immediately being attacked by US. If it was from US like FB, Twitter, there would be no discussion about it's security.
    - Crash0v3rid3 6y ago
      What a flawed stance to have on this. There are plenty of popular apps used in the US from other countries. Spotify immediately comes to mind, and they're not controlled by the CCP, an added bonus.
      - dequalant 6y ago
        Yes but none of those apps make their way to top 10, dont they? US works this way. They eliminate whatever not originating from their own companies. TikTok is very clear example of this. Give me a break about "Security concerns". Everyone knows that whats happening around TikTok is political.
        shripadk 6y ago
        Yes it is political. It is CCP controlled company. How is that hard to imagine? Yes this is a problem of National Security. India was the first to ban these apps. I don't see you having a problem there! But if US does it, it pains you. Why? Is National Security a concern only for Countries except US? Why is US an exception in your argument? If China can ban foreign apps why can't other Countries do the same? I don't understand your logic at all!
dvt 6y ago
Looks like TikTok is slowly imploding. I know there's plenty of political implications and a lot of discussion here is on that (which is interesting in its own right), but I wonder if there's opportunity here for a potential competitor.
- dragonwriter 6y ago
  Isn't this a space (short social video sharing) that has been filled by a near infinite succession of short-lived dominant offerings and that's pretty much always ready for a new, slightly different flavor of season?
  - rhizome 6y ago
    The space TikTok is occupying, for which video sharing is the vehicle: personal information.
  - qppo 6y ago
    I think they all failed for the same reason, video is expensive and the markets can't pick a winner when the game can't be won without money. But if the Chinese government wants to prop up TikTok and pick them as the winner, they can.
    - justicezyx 6y ago
      TikTok parent, ByteDance, already owns DouYin, which is the original APP that TikTok was based on, with significant ingestion from Musically. As a matter of fact, TikTok's previous CEO was Musical.ly's founding CEO. Although it seems the online records are disappearing fast. I could not find a good source of the TikTok history and key figures any more...
  - stjohnswarts 6y ago
    I think it might be a smart move by facebook to buy something similar and put it under their umbrella of companies while TikTok fades. Clearly it can be popular with the crowd that they're losing in droves.
- 6y ago
echelon 6y ago
What's the probability that the Trump admin/DOJ places a nationwide ban on TikTok and other Chinese apps? Could it actually be enforced, or will the First Amendment override any such ban? What would the ramifications be if a ban were enacted? Retaliation from China against domestic companies? Will this be an inflection point in the escalation of the trade war?
- bigpumpkin 6y ago
  25%. Yes. Yes. Millions of angry teenagers. China retaliates against by barring a few American SAAS companies/ cloud providers on national security grounds. It's a continuation of trends that were well underway since the Huawei entities list.
- J5892 6y ago
  I am 100% against anybody using TikTok for any reason. But if the government bans it, I will immediately start using it.
la6471 6y ago
Time to buy SNAP stocks :)
treebornfrog 6y ago
Byte.co waiting for adoption on the sidelines.
- s1mon 6y ago
  There are a bunch of TikTok wannabes (Byte, Dubsmash, or the various attempts by Facebook), none that I've seen are as fluid or addictive. TikTok's ability to navigate around with a bunch of responsive swipe gestures and keep showing things that might be interesting is miles ahead of the competition. The fluidity is very dependent on a good internet connection.
somethoughts 6y ago
Bytedance should just take the cash and spin off TikTok as a separate entity run by the new CEO Kevin Mayer. Perhaps selling the spin-off to Disney or Snapchat or Private Equity while its still worth something.
bigtones 6y ago
Jeff Bezos, Amazon CEO, got his phone hacked and embarrassing text messages stolen off it from a vulnerability in the video parsing library in WhatsApp in a message sent to him by Saudi Crown Prince Mohammed bin Salman in 2018. So Amazon as a company is now very sensitive to what applications are installed on staff devices and how data on those devices can be extracted from vulnerabilities in other installed apps. This may be an outcome of that. https://www.businessinsider.com/jeff-bezos-phone-hacked-saudi-crown-prince-mbs-whatsapp-report-2020-1 https://www.businessinsider.com/jeff-bezos-phone-hacked-saud...
- swyx 6y ago
  is the jury still out on whether MBS knowingly sent him that hack? that is, not to put too fine a point on it, a fast path to becoming even more of an international pariah than he already is
  - puranjay 6y ago
    I fail to see any situation where MBS would be an international pariah while still controlling Saudi Arabia
  - Natsu 6y ago
    The jury is still out on whether there was even a hack to begin with. The analysis team claimed they couldn't decrypt WhatsApp messages, so they never actually analyzed any malware at all. HN called them out on that failure: https://github.com/ddz/whatsapp-media-decrypt https://github.com/ddz/whatsapp-media-decrypt They never responded with an actual malware analysis on the file they claimed might be responsible. The only evidence left after that was a claim of higher data usage which has to be weighed against the alternate explanation for how this got out: https://www.forbes.com/sites/martingiles/2020/01/24/report-bezos-texts-leaked-first-from-his-girlfriend-to-her-brother-according-to-prosecutors/ https://www.forbes.com/sites/martingiles/2020/01/24/report-b...
    - swyx 6y ago
      TIL, thank you. if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.
a13n 6y ago
I feel like this TikTok backlash is so overblown. I don't think TikTok is spying on US consumers/business, and I don't think TikTok is sharing any US private data with CCP... I believe this because there's no evidence to the contrary, and out of principle you shouldn't assume malintent. In fact, TikTok explicitly left Hong Kong because if they didn't they would have to share private data with CCP to comply with new laws... they're intentionally leaving MAU on the table to keep their users' data safe. [1] If you look around, US social companies are making the same mistake with your clipboard data that TikTok did. LinkedIn just got caught reading your clipboard data [2], but we aren't talking about banning them... I would assume in all of these cases, it's just an engineer who accidentally shipped a bug. There are legitimate use cases to read the clipboard (eg. more seamless 2fa). It feels like the negative reaction to TikTok is so politicized and just comes from a "China bad" attitude. [1]: https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong-kong-intl-hnk/index.html https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong-kong... [2]: https://news.ycombinator.com/item?id=23716451 https://news.ycombinator.com/item?id=23716451
- michaelmrose 6y ago
  China is building concentration camps that they use for slave labor, ripping organs out of the still living bodies of political prisonersto give to its rich class, creating an increasingly dystopian super surveillance state wherein you could be subtly punished for associating with the wrong people, has no means of redress or removal of the dictator for life, and treats all enterprises as organs of the state that are expected to spy for the state. China is bad.
  - jml7c5 6y ago
    All that may be true, yet it still does not mean rationality should be thrown out the window when evaluating claims about TikTok.
    - apta 6y ago
      Better be safe than sorry. That's quite rational given what we've seen from the Chinese govt.
remarkEon 6y ago
Does anyone have a link to a legit security analysis on this app? I'm trying to weed through all details, and I want to get past any FUD.
blondie9x 6y ago
Snapchat are you listening? Make a page for your users and allow them to persist the videos and images. You will have implemented a complete platform for those who want images to disappear and for those who want them to persist. That makes TikTok redundant and unnecessary.
metaphorical 6y ago
In 2018, Bytedance CEO released a public statement after an incident with the CCP censor. In that statement, he promised that Bytedance apps would strengthen "the work of Party construction" and "socialist core values" etc. https://chinamediaproject.org/2018/04/11/tech-shame-in-the-new-era/ https://chinamediaproject.org/2018/04/11/tech-shame-in-the-n... I don't know how Bytedance as a company can serve CCP interests AND claim to be independent of CCP interference at the same time. TikTok is a good product, but it may not be a safe product. More on the dystopian practices of Douyin (TikTok in China): https://twitter.com/Izzy_Niu/status/1280906443273768960 https://twitter.com/Izzy_Niu/status/1280906443273768960 https://twitter.com/JoshuaDummer/status/1280877750245453828 https://twitter.com/JoshuaDummer/status/1280877750245453828
btgeekboy 6y ago
If I had to judge between whether I wanted TikTok or corporate email on my phone, it wouldn't be just about the email. I could live without that. What I really liked, especially back when we actually went into offices, was that I had my calendar available without opening up my laptop, and that it showed the next place I needed to be right on my wrist.
ddevault 6y ago
Is TikTok officially the scapegoat now? Sure it's bad, but it seems like an awful lot of attention is being brought to it compared to many of the other companies (and governments!) that are doing... the exact same shit, and often more so.
xendo 6y ago
For the context, as an Amazon employee I’m not required to access email from my mobile. The only app that I need to have is virtual pager and it doesn’t require allowing Amazon to administer my phone. Physical pagers are also an option.
- bonzini 6y ago
  Are they using work profiles on Android phones of employees that need mobile email access? It is a very good solution that lets the employer administer only a separate identity and gives them no access to personal stuff. The only global thing that the employer can do is enforce a certain level of security (for example requiring a PIN on the lock screen and data encryption).
  - ballark 6y ago
    Amazon employee here. They do use work profiles on Android phones.
    - bonzini 6y ago
      So in theory they should have no control on the apps you install on the personal side. Is this just moral obligation, or are they requiring full control of the phone even outside the work profile?
      - GekkePrutser 6y ago
        I manage phones for a big corp. Just want to clarify what's possible. Google highly limits what you can do in Work Profile mode, you can't control much outside the work profile. We can't see the app list on the personal side in work profile mode, BUT we can specify some that are a no-go. I'll show up as a compliance violation. But we can't view the list anymore like we could do with the pre-work profile Android Device Admin management (and still can with Apple). We're not blocking any apps ourselves right now but it is possible. We do grant all BYOD phones access to our network, so for that reason we would want the capability to block any known threats if they are around. We can also control some minor things on the personal side, like a pincode requirement and forbidding of sideloading and rooting. But in general we have very little visibility and control, which is the way I (as an admin) like it too. I only want to know what I really need to know especially on the personal side. We can (and do) also block copy/paste from work profile to personal, as data loss prevention, but we allow it the other way around. In general users complain a lot about the work profile being separate, and not being able to integrate their personal and work calendars.. But for personal privacy it's a big win IMO. Apple has something similar since iOS 13 (called User Enrolment) but it's still a bit too limited to be sufficient for us. And it requires Apple federated accounts which have some requirements that are impossible for us to meet :(
TedDoesntTalk 6y ago
This is an example why I don’t use Twitter regularly. Someone mentions the copy/paste sec vuln in TikTok and “Onur Olmez” writes: > LinkedIn app apparently also has this issue [...] Uncalled for to ban apps for this one reason. I mean, wtf? Everybody on Twitter has an opinion about everything, even things they know nothing about.
- jml7c5 6y ago
  Are they wrong?
  - TedDoesntTalk 6y ago
    In my opinion, yes. This is an enormous security vulnerability. TikTok can exfiltrate any data that the user types into any application: passwords, any kind of sensitive data.
    - jml7c5 6y ago
      I think the objection is to the double-standard, where two apps commit the same infraction but one is assumed to be nefarious.
m0nsoon 6y ago
TikTok and Chinese apps in general are having a tough day. While nothing malicious has been conclusively shown—save for iOS pasteboard spying which it seems EVERY app is doing—I suspect that this is a geo-strategic move by the US and our Allies to dominate and flex economic power over China.
apta 6y ago
Good start. Hopefully the rest of the corporations and world governments follow.
melling 6y ago
The email sent to Amazon employees was a mistake. https://variety.com/2020/digital/news/amazon-bans-tiktok-employee-security-risk-1234703472/ https://variety.com/2020/digital/news/amazon-bans-tiktok-emp...
- GekkePrutser 6y ago
  Someone goes through all the trouble of typing that explicit email and it's a mistake? Sounds more like 'pulled after huge feedback'. Though personally I'd agree with this decision. TikTok seems to be a particularly bad apple: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
  - kevincox 6y ago
    Yeah, not "This email was sent by mistake." but "Sending this email was a mistake." Two completely different sentences.
  - che_shirecat 6y ago
    I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a concern compared to other popular apps? The guy has like 10 paragraphs of stories but no actual evidence? What is TikTok doing that somehow is flying under the app store guidelines of both Google and Apple but still a "national security concern"? Why is the only actual "evidence" that can seemingly be found, a comment from some rando on Reddit, not peer-reviewed, reproducible work from legit cybersecurity researchers? This reeks of the same scent that Bloomberg's "omg they're hackz0ring our chips!" story gave off.
    - DaiPlusPlus 6y ago
      For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about. There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.
Sindrome 6y ago
Company doesn't want employees to install spyware. Is Fortnite next?
pinkfoot 6y ago
I cannot think of a single action that will promote the adoption of Hauwei's app store more than banning TikTok.

546 points by danso 6y ago

tzs 6y ago

How does Amazon email access work from home desktops? I assume it is not just simple POP/IMAP/SMTP authenticated by username/password, because if it was you could use that from mobile, too.

nitrobeast 6y ago

Standard corp policy? Google disallows dropbox on devices that can access Google internal data as well.

ziddoap 6y ago

I'm more surprised Amazon (or any company, really) employees using an employer-managed device would have TikTok on them to start with, to be honest. As the follow-up tweet says: "Completely independent of the specifics in this instance: get a second device before installing an employer's config profile on your personal device"

ianmobbs 6y ago
Does Amazon provide company phones or just install an MDM profile on your personal phone? I have TikTok installed on my phone, and if my employer said I had to remove it to access my work email, I'd ask them to buy me a work phone. It seems a bit ridiculous that they'd want to control what apps you download on your personal device without providing an alternative.
- ziddoap 6y ago
  I'll admit I don't know the specifics beyond what was tweeted. I'm with you though... If an employer wants to manage my device, they can provide the device.
  - jkaplowitz 6y ago
    When I worked at Google over 5 years ago, mobile device options for accessing company accounts were a company-provided and company-owned device with a company-paid phone bill, a personal device with company-provided mobile device management (and sometimes cell phone bill expensing if you for example had on-call duties), a personal device with only limited browser-based work account access, and no account access via mobile. The first of these could sometimes have implications for ownership of personal projects created using the device, which was one of many reasons I picked the second option, but it was absolutely permitted at least for any case where the company cared about you having mobile account access.
    - jeffbee 6y ago
      The third option - accessing only browser sites - is under appreciated. I never needed to install Google's MDM on my mobile devices, I just used mobile web gmail and so forth. It's great, honestly, and the mobile web Calendar has the advantage that it doesn't destroy your battery life like the Calendar app will. I even saw a guy using the code review site on his mobile, on BART. That was dumb from the standpoint of infosec, usability, and mental health, but shows how much is possible in the browser.
      - ghaff 6y ago
        Part of me thinks that MDM on employee phones has become a something of a checkbox item because customers ask for it but it's not clear to what extent it really protects sensitive customer data (which is what they're concerned about).
        jeffbee 6y ago
        It is literally a checkbox item for PCI DSS.
        prteja11 6y ago
        Can you share the requirement from PCI DSS? [it's not]
- haalia 6y ago
  Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise.
  - filoleg 6y ago
    > Does Amazon provide company phones or just install an MDM profile on your personal phone? > Microsoft does the latter, so it wouldn't surprise me if Amazon does likewise. Not true (source: current MSFT employee). More detailed explanation below, as neither former nor latter describes MSFT accurately. So, for most teams and positions (there are many exceptions), you don't get a dedicated work phone. So yeah, if you want to access work stuff on a mobile device, you need to install MSFT MDM on your personal phone, and they will, allegedly, be able to control stuff on it (depending on the device itself and how MDM is configured). However, there are no requirements to do it. You can simply not install any work-related stuff on your phone, so you won't need an MDM. I simply don't access any work resources on my personal phone. If I need to do work, i open my work laptop. If they want me to use work apps on mobile and be accessible, they should provide a company phone for this. There have been zero conflicts around it on my end, even after multiple years of working there on multiple different teams. Not once have I even got an implied request from anyone (managers, colleagues, etc.) to be accessible on mobile (except for when I am on-call, but for that, they just need my phone number, not any specific apps installed on my phone, and everyone knows it) or any questions about it. Everyone is totally cool with people not being glued to their work apps on their phones on their own free time. But you are correct, those who choose to use work apps have to give MDM permissions to their personal devices or buy a dedicated device for that (exceptions apply, because there are some teams that provide dedicated work phones). However, unless it is required for the job to be able to use work apps on your mobile device, I think it is fair if they don't provide a work phone. Makes it easier for me to not check on any work stuff during the weekend.
    - haalia 6y ago
      Yes, you're correct, and I didn't mean to imply that MSFT forces employees to install their MDM on personal devices. It was optional for me as well, with a large full-disclosure prompt stating that they can remotely wipe your device if you proceed with mobile setup.
- unethical_ban 6y ago
  At my company, you have to provide your own device, but the phone number/plan is either (a) paid for by the company, or (b) you get a $40/mo stipend for cell service. It turns out that I can use our 2FA app without MDM, on my personal. And nowadays, I rarely use slack or email from mobile, and I don't get calls. I am pretty strong in the "don't put company stuff on personal devices" camp. Even if they don't control your phone by policy, they do technically. They put root certs on the device, and though they can't see individual app data (depending on config) they can see a list of installed apps, and enforce certain baselines.
- ta20200710 6y ago
  Amazon has MDM (Airwatch). AFAIK there are not generally company phones or phone plans. Monthly limit on reimbursement for phone business expenditures in the US is $50, although I think you can also expense the device itself.
- dickjocke 6y ago
  No Amazon generally does not provide you a company phone, at least not when I was there.
- nixass 6y ago
  If your job requires it, you will get it. It's been like that for a while now
- yumraj 6y ago
  No, they are controlling the environment under which their company emails can be accessed. If you, as an employee, don't want to remove TikTok I believe you will have that right, it's just that you won't be able to access company emails from that device. Now, whether or not that leads to a company phone or you having to look for another job, depends on the individual and how important that individual is to the company.
  - chooseaname 6y ago
    If any company expects me to access my work email while mobile, they have to provide a phone. I never mix work and personal. I've also never had a company say no to that.
    - cheonic729 6y ago
      > If any company expects me to access my work email while mobile, they have to provide a phone. No they don't. If you don't like it, switch employers.
      - Assumer 6y ago
        Pretty sure that's what he's saying. The company gets to choose between dropping the requirement, providing a phone or hiring/retraining.
      - sdoering 6y ago
        Depends on the jurisdiction. In Germany they do. Labor rights explicitly says that your employer needs to provide the means for you to do your work. And that includes mobile phones if they want you to access your work email (or whatever) from a mobile device.
        GekkePrutser 6y ago
        Yes they do... The problem is some users in Germany actually prefer to use their personal one so they don't have to carry two.. But due to this mindset they can't. I don't think the German approach is always the best.
- spelunker 6y ago
  There's also no requirement to have your business email on your phone, at least in my organization in Amazon. I'm happy to leave it off and not worry about any issues like this. Of course I do have other apps directly related to work... I guess those aren't an issue if I had TikTok?
  - foolfoolz 6y ago
    i haven’t had work email on my phone in 7 years. it has not impacted my career negatively
    - smabie 6y ago
      How do you know?
- Sodman 6y ago
  Most companies I've worked for wouldn't provide a work phone and there's no explicit expectation that you read or answer work e-mails on your phone. But like everything else, if you don't read/reply to work e-mails on your phone, and your colleagues do, good luck getting that promotion/raise/bonus.
wilde 6y ago
Not everyone can afford 2 phones, but their employers expect them to be online all the time anyway. This is particularly true of people who work in US hospitals.
- tristor 6y ago
  Why would you need to be able to afford 2 phones if your employer is requiring you to have a mobile phone for work? That's a situation in which the employer should provide the phone. I've been on-call or mobile-connected for over a decade, I have never had an employer even suggest that I should foot the bill for a work device. Either they've provided me a phone fully paid for work to be returned if I exit, or have covered the cost of my phone bill for my personal device in return for accessibility outside business hours.
  - thereticent 6y ago
    There's no good explanation except that US healthcare orgs tend to misuse staff and clinical providers. Super-specialized doctor with untold postdoc training in faculty at my academic medical center? You've got to encrypt your personal phone to standard and install several required apps. No it is not expensed.
    - FireBeyond 6y ago
      Apropos of the rightness or otherwise of this stance, I don't think "specialist physicians" typically fall into the category of people who "cannot afford 2 phones".
      - thereticent 6y ago
        I agree. Neither do top industry execs, top sales personnel, etc. It seems from most of the comments that even in lieu of a work phone, compensation for a mobile plan is normal and expected most places. I may be mistaken, but the culture of large healthcare orgs does seem to promote an expectation that the employees be more altruistic then would be expected elsewhere, even within the employer-employee relationship.
thesausageking 6y ago
Most people I know check their work email from their personal phone. Work either doesn't buy them one or they don't want to carry around two phones.
- kevin_thibedeau 6y ago
  Most people don't need to be on call 24/7 so they could just divorce themselves from off hours work and live like in the ancient times.
  - disgruntledphd2 6y ago
    My dad worked in construction, and from the late 80's and throughout all of the 90's his company kept offering him a company phone (I think car-phone first). He never got one, because as he said, if they have your number they'll call you, if they don't then they'll solve their own problem. Looking back on it now, it was prescient advice.
  - coldpie 6y ago
    Amen. If you're not paying me to be on-call, I'm not putting any work info on my phone. Whatever's going on can wait until 9 tomorrow morning.
  - GekkePrutser 6y ago
    I don't really agree... I like the flexibility. Sometimes someone from the US calls me with an urgent problem in the evening (I'm in Europe so not much overlap in work hours). So what... Sometimes I go to the shop or bank during the day. Or even a walk to the beach if it's not so busy. They're paying me to do a (global) job, not to sit at my desk between 9:00 and 17:00. Personally I love this flexibility. And I don't feel like I work more than 40 hours, I don't even count them but I doubt I do, especially if I omit the time I spend during "working hours" reading hacker news or other stuff. My work is my hobby anyway. I do think people who like having fixed work times should have the opportunity to have them. But I also think people like me should be able to work like this without it being considered a bad thing.
ardy42 6y ago
> I'm more surprised Amazon (or any company, really) employees using an employer-managed device would have TikTok on them to start with, to be honest. I am too. Many years ago at my employer, someone fat-fingered a command and wiped every single iPhone/iPad that an employee had configured to connect the company email system. Even after restoring a backup, the devices would just wipe themselves again unless the owner managed to remove the MDM profile before it reconnected to the internet. A good fraction of my coworkers were affected. I'm not giving anyone access to do that to my personal data.
- matsemann 6y ago
  Not exactly the same, but where I used to work someone had turned on "wipe the phone after x incorrect pins" without notifying anyone. Lots of people with kids got their phone remotely deleted. After that I've never allowed an employer to control my personal devices. Not that I actually did before, didn't know activating that stuff had so bug implications. I just wanted the calendar on my phone.
  - bonzini 6y ago
    With Android work profiles the employer can require you to allow remotely wiping the work profile, but that would not allow them to touch your personal profile.
- btgeekboy 6y ago
  If you can't handle your phone being remotely wiped, you also can't handle it being lost, stolen, or broken. For me, it's a minor inconvenience at best, not a death sentence.
  - scohesc 6y ago
    I'd rather be able to blame myself for my stupid mistakes - not be beholden to Amazon's (or whoever's) MDM profile. Especially when companies don't make it clear that "if you log into your email on your phone using this app, we install MDM, root certificates, have the ability to remote wipe, etc. etc. etc."
easytiger 6y ago
Yea. Coming from a banking and financial services background I'm incredulous than any company would allow any social media on a device. This was all much easier in the blackberry days for them to control
- braythwayt 6y ago
  "This was all much easier in the blackberry days for them to control" And indeed, that was Blackberry's big sales pitch. BYOD creates many, many wonderful consequences, however it also has tradeoffs, and those tradeoffs are not for the faint-of-security.
wittyreference 6y ago
It's been a while since I've seen employers offer work phones. What I've seen for the last few years is an offer to pay or subsidize a data plan. If Amazon doesn't provide me a work phone, they can eff right off in attempting to dictate what I put on my phone.
wiredone 6y ago
From what I know of ppl who work there, they pay for employees phone plans (is they pay for a phone).

markovbot 6y ago

I assume they won't be doing that to the main-stream spyware pushed by US companies.

andybak 6y ago
Which ones and what is your threat model?
- vkou 6y ago
  The threat model of the US government, or a US company spying on a US citizen is, to the citizen, about as harmful as the Chinese government spying on them. Actually moreso, in the case of the US government.
  - rrix2 6y ago
    but amazon doesn't care about its employees in that context, only about protecting their own company standing. (and many people will say here "why shouldn't they?!")
  - ac29 6y ago
    There is no reason for the US government to do industrial espionage on US companies. China might not be doing it either (via TikTok, at least), but it does have a motive.
    - vkou 6y ago
      No, but there's reason for the US government to spy on you, if you are a problem person. Why do you assume industrial espionage is the sole reason for a government to spy on you?
manquer 6y ago
The threat model for AMZ is state sponsored corporate espionage, not government intruding on your and my privacy. The former cost them a ton of money unlike the later. Given their inability to enforce IP or many other laws in china even if there was similar espionage happening in the U.S. the legal system is strong enough for Amazon not to worry of losing money.

orblivion 6y ago

Sorry if I missed something obvious, but if we're at the point where the U.S. government is even contemplating banning TikTok, how come it's on Google and Apple stores at this point? They seem to be at least somewhat vigilant about spyware etc.

tehwebguy 6y ago
Apple should remove it for being spyware. Google should remove it for being competition.
yesplorer 6y ago
1. Because the app stores don't serve a single country. 2. People don't use the app store at the pleasure of the US government.
- orblivion 6y ago
  Forget countries and governments. Don't they serve the users, at least to some extent? Forgetting the political issues, there have been multiple spyware scandals here, right? Or did I get the wrong idea? Of course these companies have selfish corporate interests, but I've seen both of these companies show at least _some_ level of care for their users. Even if it's part of keeping up appearances out of concern for their corporate interests.
  - yesplorer 6y ago
    At this point, no single government has provided a verifiable reason why Tik tok should be banned. if there were verifiable claims, you think Apple and Google will conveniently let them be in their app stores and take the heat for it? What benefit would they get?
- sc11 6y ago
  > 1. Because the app stores don't serve a single country. There are country-specific Apple app stores and apps that are only available in some countries

adreamingsoul 6y ago

And that's why I never setup email on my personal mobile device when I worked for AWS.

hn3333 6y ago

Does anyone else feel we're suddenly supposed to be anti-China? Is it because of Hong Kong? (Honest question, I have no strong opinion .) Because it feels like after Russia and Muslims now China is the new enemy. Kind of stupid imho. Anyway, the high road would probably be not to ban any apps but to make the operating systems safer..

partiallypro 6y ago
China has been an American economic foe for a while. The CCP has stepped up measures and started to push their agenda and censorship globally. They have stepped up their presence in the South China sea and claimed ownership of international waters. They have clamped down on Hong Kong and other provinces, put Muslims in concentration camps using them as slave labor, stealing their organs, shaving their heads and selling the hair on the market. They've been using their state controlled enterprises to spy on people outside of their borders (I'm not saying the west is innocent 100% on that one.) So...I don't think it's stupid at all. China (the CCP) is anti-freedom. The west is generally a liberal society. https://www.axios.com/china-hong-kong-law-global-activism-ff1ea6d1-0589-4a71-a462-eda5bea3f78f.html?utm_source=twitter&utm_medium=social&utm_campaign=organic&utm_content=1100 https://www.axios.com/china-hong-kong-law-global-activism-ff...
- 8ytecoder 6y ago
  They have used Belt and Road to expand their influence. They have extended loans and goodwill to bring various countries in Asia and Africa under their influence. They are way more aggressive and assertive than they used to be. Chinese companies and investment firms have been aggressively buying companies throughout the world. The list goes on. Without commenting on the values of it, at the very least it's a challenge to the current world order and we'd expect countries to at least push back a bit. In fact, I was surprised it took over a decade for countries to start pushing back.
  - president 6y ago
    > In fact, I was surprised it took over a decade for countries to start pushing back. It didn't help that many politicians, media, and elites had been slowly bought by China. There were many China skeptics that had raised red flags but were largely ignored.

danso 6y ago

Note: since this tweet/submission, some outlets have written stories about this: https://www.theverge.com/2020/7/10/21320196/amazon-employees-tiktok-uninstall-email-trump-administration-pompeo-ban https://www.theverge.com/2020/7/10/21320196/amazon-employees... https://www.nytimes.com/2020/07/10/technology/tiktok-amazon-security-risk.html https://www.nytimes.com/2020/07/10/technology/tiktok-amazon-...

ehsankia 6y ago
I'm curious, are these 1. Devices owned by Amazon, for work 2. Personal devices with the amazon email added directly 3. Personal devices with amazon email added on Work profile Could not find this info in the articles or tweet.
- paxys 6y ago
  I don't think any mid-large company allows 2 anymore. Access to company resources always comes with an MDM policy.
  - codegladiator 6y ago
    You are wrong to think that. I wish I could name the companies.
    - sdoering 6y ago
      I know some. And I know others with MDM - but without policies regarding installation of apps.
    - deleted 6y ago
      [deleted]
  - btashton 6y ago
    I don't get why people are OK with a company being able to wipe a personal device on a whim. If you want full control of my mobile, then provide a mobile.

atarian 6y ago

Makes a lot of sense considering AWS deals with sensitive government data.

schnable 6y ago

What's the security/privacy vulnerability that would allow TikTok access to sensitive info from email?

jeffbee 6y ago
Clipboard access.
Andrex 6y ago
Contacts at least, as the lowest-hanging fruit.
closetnerd 6y ago
Likely that they have the potential to have as much information about us as Facebook does - but China? If there was a real security/privacy issue - I'd be more upset with Apple than China (as an iPhone user). Apple needs to watch my back.
- gandutraveler 6y ago
  On top of background device data and analytics there is lot of sensetive user data shared on the app for which can be used to target certain audience. Social engineering this data and joining it with other apps(which can have security holes) is enough to hack the device and steal additional info. All this also applies to American companies like FB, Google etc however american companies don't have a parent like CCP who has access to all the data.
deleted 6y ago
[deleted]
Randor 6y ago
Exactly. The real question is why does your phone even allow such things to happen in the first place?

dequalant 6y ago

US would destroy anything not originating from its soil. Pathetic.

LUmBULtERA 6y ago
How do you make this leap?
- dequalant 6y ago
  Look at TikTok? Not from US, immediately being attacked by US. If it was from US like FB, Twitter, there would be no discussion about it's security.
  - Crash0v3rid3 6y ago
    What a flawed stance to have on this. There are plenty of popular apps used in the US from other countries. Spotify immediately comes to mind, and they're not controlled by the CCP, an added bonus.
    - dequalant 6y ago
      Yes but none of those apps make their way to top 10, dont they? US works this way. They eliminate whatever not originating from their own companies. TikTok is very clear example of this. Give me a break about "Security concerns". Everyone knows that whats happening around TikTok is political.
      - shripadk 6y ago
        Yes it is political. It is CCP controlled company. How is that hard to imagine? Yes this is a problem of National Security. India was the first to ban these apps. I don't see you having a problem there! But if US does it, it pains you. Why? Is National Security a concern only for Countries except US? Why is US an exception in your argument? If China can ban foreign apps why can't other Countries do the same? I don't understand your logic at all!

dvt 6y ago

Looks like TikTok is slowly imploding. I know there's plenty of political implications and a lot of discussion here is on that (which is interesting in its own right), but I wonder if there's opportunity here for a potential competitor.

dragonwriter 6y ago
Isn't this a space (short social video sharing) that has been filled by a near infinite succession of short-lived dominant offerings and that's pretty much always ready for a new, slightly different flavor of season?
- rhizome 6y ago
  The space TikTok is occupying, for which video sharing is the vehicle: personal information.
- qppo 6y ago
  I think they all failed for the same reason, video is expensive and the markets can't pick a winner when the game can't be won without money. But if the Chinese government wants to prop up TikTok and pick them as the winner, they can.
  - justicezyx 6y ago
    TikTok parent, ByteDance, already owns DouYin, which is the original APP that TikTok was based on, with significant ingestion from Musically. As a matter of fact, TikTok's previous CEO was Musical.ly's founding CEO. Although it seems the online records are disappearing fast. I could not find a good source of the TikTok history and key figures any more...
- stjohnswarts 6y ago
  I think it might be a smart move by facebook to buy something similar and put it under their umbrella of companies while TikTok fades. Clearly it can be popular with the crowd that they're losing in droves.
6y ago

echelon 6y ago

What's the probability that the Trump admin/DOJ places a nationwide ban on TikTok and other Chinese apps? Could it actually be enforced, or will the First Amendment override any such ban? What would the ramifications be if a ban were enacted? Retaliation from China against domestic companies? Will this be an inflection point in the escalation of the trade war?

bigpumpkin 6y ago
25%. Yes. Yes. Millions of angry teenagers. China retaliates against by barring a few American SAAS companies/ cloud providers on national security grounds. It's a continuation of trends that were well underway since the Huawei entities list.
J5892 6y ago
I am 100% against anybody using TikTok for any reason. But if the government bans it, I will immediately start using it.

la6471 6y ago

Time to buy SNAP stocks :)

treebornfrog 6y ago

Byte.co waiting for adoption on the sidelines.

s1mon 6y ago
There are a bunch of TikTok wannabes (Byte, Dubsmash, or the various attempts by Facebook), none that I've seen are as fluid or addictive. TikTok's ability to navigate around with a bunch of responsive swipe gestures and keep showing things that might be interesting is miles ahead of the competition. The fluidity is very dependent on a good internet connection.

somethoughts 6y ago

Bytedance should just take the cash and spin off TikTok as a separate entity run by the new CEO Kevin Mayer. Perhaps selling the spin-off to Disney or Snapchat or Private Equity while its still worth something.

bigtones 6y ago

Jeff Bezos, Amazon CEO, got his phone hacked and embarrassing text messages stolen off it from a vulnerability in the video parsing library in WhatsApp in a message sent to him by Saudi Crown Prince Mohammed bin Salman in 2018. So Amazon as a company is now very sensitive to what applications are installed on staff devices and how data on those devices can be extracted from vulnerabilities in other installed apps. This may be an outcome of that. https://www.businessinsider.com/jeff-bezos-phone-hacked-saudi-crown-prince-mbs-whatsapp-report-2020-1 https://www.businessinsider.com/jeff-bezos-phone-hacked-saud...

swyx 6y ago
is the jury still out on whether MBS knowingly sent him that hack? that is, not to put too fine a point on it, a fast path to becoming even more of an international pariah than he already is
- puranjay 6y ago
  I fail to see any situation where MBS would be an international pariah while still controlling Saudi Arabia
- Natsu 6y ago
  The jury is still out on whether there was even a hack to begin with. The analysis team claimed they couldn't decrypt WhatsApp messages, so they never actually analyzed any malware at all. HN called them out on that failure: https://github.com/ddz/whatsapp-media-decrypt https://github.com/ddz/whatsapp-media-decrypt They never responded with an actual malware analysis on the file they claimed might be responsible. The only evidence left after that was a claim of higher data usage which has to be weighed against the alternate explanation for how this got out: https://www.forbes.com/sites/martingiles/2020/01/24/report-bezos-texts-leaked-first-from-his-girlfriend-to-her-brother-according-to-prosecutors/ https://www.forbes.com/sites/martingiles/2020/01/24/report-b...
  - swyx 6y ago
    TIL, thank you. if I were a billionaire I'd basically not stop until I got to the bottom of this one. everyone is vulnerable.

a13n 6y ago

I feel like this TikTok backlash is so overblown. I don't think TikTok is spying on US consumers/business, and I don't think TikTok is sharing any US private data with CCP... I believe this because there's no evidence to the contrary, and out of principle you shouldn't assume malintent. In fact, TikTok explicitly left Hong Kong because if they didn't they would have to share private data with CCP to comply with new laws... they're intentionally leaving MAU on the table to keep their users' data safe. [1] If you look around, US social companies are making the same mistake with your clipboard data that TikTok did. LinkedIn just got caught reading your clipboard data [2], but we aren't talking about banning them... I would assume in all of these cases, it's just an engineer who accidentally shipped a bug. There are legitimate use cases to read the clipboard (eg. more seamless 2fa). It feels like the negative reaction to TikTok is so politicized and just comes from a "China bad" attitude. [1]: https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong-kong-intl-hnk/index.html https://www.cnn.com/2020/07/07/tech/tiktok-leaving-hong-kong... [2]: https://news.ycombinator.com/item?id=23716451 https://news.ycombinator.com/item?id=23716451

michaelmrose 6y ago
China is building concentration camps that they use for slave labor, ripping organs out of the still living bodies of political prisonersto give to its rich class, creating an increasingly dystopian super surveillance state wherein you could be subtly punished for associating with the wrong people, has no means of redress or removal of the dictator for life, and treats all enterprises as organs of the state that are expected to spy for the state. China is bad.
- jml7c5 6y ago
  All that may be true, yet it still does not mean rationality should be thrown out the window when evaluating claims about TikTok.
  - apta 6y ago
    Better be safe than sorry. That's quite rational given what we've seen from the Chinese govt.

remarkEon 6y ago

Does anyone have a link to a legit security analysis on this app? I'm trying to weed through all details, and I want to get past any FUD.

blondie9x 6y ago

Snapchat are you listening? Make a page for your users and allow them to persist the videos and images. You will have implemented a complete platform for those who want images to disappear and for those who want them to persist. That makes TikTok redundant and unnecessary.

metaphorical 6y ago

In 2018, Bytedance CEO released a public statement after an incident with the CCP censor. In that statement, he promised that Bytedance apps would strengthen "the work of Party construction" and "socialist core values" etc. https://chinamediaproject.org/2018/04/11/tech-shame-in-the-new-era/ https://chinamediaproject.org/2018/04/11/tech-shame-in-the-n... I don't know how Bytedance as a company can serve CCP interests AND claim to be independent of CCP interference at the same time. TikTok is a good product, but it may not be a safe product. More on the dystopian practices of Douyin (TikTok in China): https://twitter.com/Izzy_Niu/status/1280906443273768960 https://twitter.com/Izzy_Niu/status/1280906443273768960 https://twitter.com/JoshuaDummer/status/1280877750245453828 https://twitter.com/JoshuaDummer/status/1280877750245453828

btgeekboy 6y ago

If I had to judge between whether I wanted TikTok or corporate email on my phone, it wouldn't be just about the email. I could live without that. What I really liked, especially back when we actually went into offices, was that I had my calendar available without opening up my laptop, and that it showed the next place I needed to be right on my wrist.

ddevault 6y ago

Is TikTok officially the scapegoat now? Sure it's bad, but it seems like an awful lot of attention is being brought to it compared to many of the other companies (and governments!) that are doing... the exact same shit, and often more so.

xendo 6y ago

For the context, as an Amazon employee I’m not required to access email from my mobile. The only app that I need to have is virtual pager and it doesn’t require allowing Amazon to administer my phone. Physical pagers are also an option.

bonzini 6y ago
Are they using work profiles on Android phones of employees that need mobile email access? It is a very good solution that lets the employer administer only a separate identity and gives them no access to personal stuff. The only global thing that the employer can do is enforce a certain level of security (for example requiring a PIN on the lock screen and data encryption).
- ballark 6y ago
  Amazon employee here. They do use work profiles on Android phones.
  - bonzini 6y ago
    So in theory they should have no control on the apps you install on the personal side. Is this just moral obligation, or are they requiring full control of the phone even outside the work profile?
    - GekkePrutser 6y ago
      I manage phones for a big corp. Just want to clarify what's possible. Google highly limits what you can do in Work Profile mode, you can't control much outside the work profile. We can't see the app list on the personal side in work profile mode, BUT we can specify some that are a no-go. I'll show up as a compliance violation. But we can't view the list anymore like we could do with the pre-work profile Android Device Admin management (and still can with Apple). We're not blocking any apps ourselves right now but it is possible. We do grant all BYOD phones access to our network, so for that reason we would want the capability to block any known threats if they are around. We can also control some minor things on the personal side, like a pincode requirement and forbidding of sideloading and rooting. But in general we have very little visibility and control, which is the way I (as an admin) like it too. I only want to know what I really need to know especially on the personal side. We can (and do) also block copy/paste from work profile to personal, as data loss prevention, but we allow it the other way around. In general users complain a lot about the work profile being separate, and not being able to integrate their personal and work calendars.. But for personal privacy it's a big win IMO. Apple has something similar since iOS 13 (called User Enrolment) but it's still a bit too limited to be sufficient for us. And it requires Apple federated accounts which have some requirements that are impossible for us to meet :(

TedDoesntTalk 6y ago

This is an example why I don’t use Twitter regularly. Someone mentions the copy/paste sec vuln in TikTok and “Onur Olmez” writes: > LinkedIn app apparently also has this issue [...] Uncalled for to ban apps for this one reason. I mean, wtf? Everybody on Twitter has an opinion about everything, even things they know nothing about.

jml7c5 6y ago
Are they wrong?
- TedDoesntTalk 6y ago
  In my opinion, yes. This is an enormous security vulnerability. TikTok can exfiltrate any data that the user types into any application: passwords, any kind of sensitive data.
  - jml7c5 6y ago
    I think the objection is to the double-standard, where two apps commit the same infraction but one is assumed to be nefarious.

m0nsoon 6y ago

TikTok and Chinese apps in general are having a tough day. While nothing malicious has been conclusively shown—save for iOS pasteboard spying which it seems EVERY app is doing—I suspect that this is a geo-strategic move by the US and our Allies to dominate and flex economic power over China.

apta 6y ago

Good start. Hopefully the rest of the corporations and world governments follow.

melling 6y ago

The email sent to Amazon employees was a mistake. https://variety.com/2020/digital/news/amazon-bans-tiktok-employee-security-risk-1234703472/ https://variety.com/2020/digital/news/amazon-bans-tiktok-emp...

GekkePrutser 6y ago
Someone goes through all the trouble of typing that explicit email and it's a mistake? Sounds more like 'pulled after huge feedback'. Though personally I'd agree with this decision. TikTok seems to be a particularly bad apple: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
- kevincox 6y ago
  Yeah, not "This email was sent by mistake." but "Sending this email was a mistake." Two completely different sentences.
- che_shirecat 6y ago
  I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a concern compared to other popular apps? The guy has like 10 paragraphs of stories but no actual evidence? What is TikTok doing that somehow is flying under the app store guidelines of both Google and Apple but still a "national security concern"? Why is the only actual "evidence" that can seemingly be found, a comment from some rando on Reddit, not peer-reviewed, reproducible work from legit cybersecurity researchers? This reeks of the same scent that Bloomberg's "omg they're hackz0ring our chips!" story gave off.
  - DaiPlusPlus 6y ago
    For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about. There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.

Sindrome 6y ago

Company doesn't want employees to install spyware. Is Fortnite next?

pinkfoot 6y ago

I cannot think of a single action that will promote the adoption of Hauwei's app store more than banning TikTok.