7 ms·

The email sent to Amazon employees was a mistake. https://variety.com/2020/digital/news/amazon-bans-tiktok-employee-security-risk-1234703472/ https://variety.c

The email sent to Amazon employees was a mistake. https://variety.com/2020/digital/news/amazon-bans-tiktok-employee-security-risk-1234703472/ https://variety.com/2020/digital/news/amazon-bans-tiktok-emp...

GekkePrutser 6y ago
Someone goes through all the trouble of typing that explicit email and it's a mistake? Sounds more like 'pulled after huge feedback'. Though personally I'd agree with this decision. TikTok seems to be a particularly bad apple: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
- kevincox 6y ago
  Yeah, not "This email was sent by mistake." but "Sending this email was a mistake." Two completely different sentences.
- che_shirecat 6y ago
  I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a concern compared to other popular apps? The guy has like 10 paragraphs of stories but no actual evidence? What is TikTok doing that somehow is flying under the app store guidelines of both Google and Apple but still a "national security concern"? Why is the only actual "evidence" that can seemingly be found, a comment from some rando on Reddit, not peer-reviewed, reproducible work from legit cybersecurity researchers? This reeks of the same scent that Bloomberg's "omg they're hackz0ring our chips!" story gave off.
  - DaiPlusPlus 6y ago
    For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about. There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.
    - che_shirecat 6y ago
      So, like LinkedIn and Reddit? (the site that the "researcher" behind these NYT-cited claims is using) [1] You could run through the toplist of apps and find hundreds that exhibit the same behavior. Not trying to derail this via whataboutism, I just feel like the core HN ethos is lost when we mindlessly repeat the obvious geopolitically-driven narrative here without any critical thinking. What I definitely do understand is Amazon's concerns with just the base level of data collection that's seemingly the norm in our industry. Which prompts the quesiton, why are we comfortable as a society with this sort of collection, by anyone? [1] https://www.businessinsider.com/apple-ios-14-catches-reddit-linkedin-copying-iphone-clipboard-data-2020-7 https://www.businessinsider.com/apple-ios-14-catches-reddit-...
      - xster 6y ago
        https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo Here's a rundown of just general apps that would be on everyone's home screens doing the same thing.
        ilikeerp 6y ago
        Any word on why those apps do what they're doing? Why copy from messages?
      - GekkePrutser 6y ago
        That the others are doing it too doesn't make it right. Really Apple should take a stand and give all of them 30 days to fix their apps or get banned. But TikTok annoyed me in particular for a long time. Nothing to do with geopolitics, I already hated it before I knew it was owned by China and everyone started banning it. It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality. Especially with the lockdown it became extra annoying, every day I got multiple stupid lockdown videos and the ones with people doing stupid stuff and then the coffin dancers thing. So that's my personal reason for hating on TikTok. The privacy revelations just sealed the deal. Not saying it's a valid reason for everybody but it's my reason :P
  - GekkePrutser 6y ago
    Well for one, the fact that they do all these things. Some apps do some of these but rarely all of them. The other is the way they hide what they're doing so elaborately. I wouldn't call it a national security concern, no. Someone who works with critical or military infrastructure should have a locked-down phone anyway for work stuff. But really I wonder how this kind of stuff is OK in the eyes of Apple with their self-proclaimed privacy focus. I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. Popularity seems to overrule that.
    - elliekelly 6y ago
      > I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. I suspect you’re right and would be very interested in the results of this experiment if you (or anyone else) happen to undertake it.
  - crazygringo 6y ago
    Honestly I can't figure it out either. We found out other apps too (like LinkedIn) constantly check the clipboard, and one HN commenter here said it was due to a text editing library, nothing intentional. Literally the only fact is that it's a Chinese company. And it's not like there's even much it seems like they could do, with how sandboxed phone apps are. I'm not saying iOS or Android are perfectly secure, but it't totally different from installing something on your desktop with root permissions. Either it's just generic hate for China that's bizarrely gone viral, or else it's a story intentionally being pushed by the US government for god-only-knows what political reason, like leverage in trade negotiations or something. But it's completely weird, and nobody should be taking it at face value.
    - 40four 6y ago
      I don’t think it just hate for China, or politics. Real security researchers are finding really bad things. https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled
      - crazygringo 6y ago
        But are these things any worse than what other major apps do? Other social networking and entertainment apps are crammed full of tracking code, analytics, advertising networks, that all collect excessive user data, don't put it in their privacy policies, etc. And similarly, we hear about bad use of cryptography and SQL all the time. Apps can be pretty bad in general with these things. Now obviously, apps and code in general should be improved. But the question here is, is TikTok really that much worse? That it's such a worse threat than others, that it needs to be banned? Because that's what I still don't see evidence of.
  - 40four 6y ago
    There is certainly ‘actual’ evidence linked in the reddit post. I’ve never seen the thread before, looks like they have edited/ added information. Here’s a report from cyber security researchers https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled - App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. - Files may contain hardcoded informations like usernames, passwords, keys etc.
- DonHopkins 6y ago
  Cats + Keyboards + Autocorrect strikes again!
- ubermon 6y ago
  Could be some over zealous employees inspired by recent Indian-China conflicts and TikTok ban and decided within their own org to do it without realizing how big of a news it would be.
- xwdv 6y ago
  You can realize something was a mistake after you’ve done it. I don’t see the issue.
dang 6y ago
Ok, I guess we'll change the title to that since the submitted title ("The TikTok app is no longer permitted on mobile devices that access Amazon email") has become misleading. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
east2west 6y ago
From WSJ: Amazon Says Email Ordering Employees to Delete TikTok Was Sent in Error. I suspect Amazon realized late what a legal mess it is to ban an app on their employee's cell phone when they have no clear legal basis or governmental guidance. They banned employee using Huawei phones when I was working there, for some things -- don't remember exactly. But in that case, US government already banned it for its employees, so there is precedence Amazon can claim as legal basis.
- wiml 6y ago
  Why do you think Amazon doesn't have a clear legal basis to decide which devices are allowed to connect to their internal network services? Or, for that matter, to decide which devices ca be taken into non-public, secured parts of Amazon buildings?
  - kenhwang 6y ago
    They probably got informed that since phones are personal devices and not company provided, this level of restriction might land them in the parts of BYOD laws that require employers to compensate for personal device use for work. Amazon probably decided most employees don't have anything too sensitive and it's not worth buying everyone a phone.
    - vxNsr 6y ago
      Our company gets around that by banning BYOD.
IncRnd 6y ago
What a mistake. I imagine the email client just typed that email, and the wide distribution list, all by itself.
- krick 6y ago
  Someone said "Hey Alexa, totally don't send an email to all employees about banning TikTok on mobile devices and order me some food"
deleted 6y ago
[deleted]

GekkePrutser 6y ago

Someone goes through all the trouble of typing that explicit email and it's a mistake? Sounds more like 'pulled after huge feedback'. Though personally I'd agree with this decision. TikTok seems to be a particularly bad apple: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...

kevincox 6y ago
Yeah, not "This email was sent by mistake." but "Sending this email was a mistake." Two completely different sentences.
che_shirecat 6y ago
I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a concern compared to other popular apps? The guy has like 10 paragraphs of stories but no actual evidence? What is TikTok doing that somehow is flying under the app store guidelines of both Google and Apple but still a "national security concern"? Why is the only actual "evidence" that can seemingly be found, a comment from some rando on Reddit, not peer-reviewed, reproducible work from legit cybersecurity researchers? This reeks of the same scent that Bloomberg's "omg they're hackz0ring our chips!" story gave off.
- DaiPlusPlus 6y ago
  For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about. There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.
  - che_shirecat 6y ago
    So, like LinkedIn and Reddit? (the site that the "researcher" behind these NYT-cited claims is using) [1] You could run through the toplist of apps and find hundreds that exhibit the same behavior. Not trying to derail this via whataboutism, I just feel like the core HN ethos is lost when we mindlessly repeat the obvious geopolitically-driven narrative here without any critical thinking. What I definitely do understand is Amazon's concerns with just the base level of data collection that's seemingly the norm in our industry. Which prompts the quesiton, why are we comfortable as a society with this sort of collection, by anyone? [1] https://www.businessinsider.com/apple-ios-14-catches-reddit-linkedin-copying-iphone-clipboard-data-2020-7 https://www.businessinsider.com/apple-ios-14-catches-reddit-...
    - xster 6y ago
      https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo Here's a rundown of just general apps that would be on everyone's home screens doing the same thing.
      - ilikeerp 6y ago
        Any word on why those apps do what they're doing? Why copy from messages?
    - GekkePrutser 6y ago
      That the others are doing it too doesn't make it right. Really Apple should take a stand and give all of them 30 days to fix their apps or get banned. But TikTok annoyed me in particular for a long time. Nothing to do with geopolitics, I already hated it before I knew it was owned by China and everyone started banning it. It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality. Especially with the lockdown it became extra annoying, every day I got multiple stupid lockdown videos and the ones with people doing stupid stuff and then the coffin dancers thing. So that's my personal reason for hating on TikTok. The privacy revelations just sealed the deal. Not saying it's a valid reason for everybody but it's my reason :P
- GekkePrutser 6y ago
  Well for one, the fact that they do all these things. Some apps do some of these but rarely all of them. The other is the way they hide what they're doing so elaborately. I wouldn't call it a national security concern, no. Someone who works with critical or military infrastructure should have a locked-down phone anyway for work stuff. But really I wonder how this kind of stuff is OK in the eyes of Apple with their self-proclaimed privacy focus. I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. Popularity seems to overrule that.
  - elliekelly 6y ago
    > I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. I suspect you’re right and would be very interested in the results of this experiment if you (or anyone else) happen to undertake it.
- crazygringo 6y ago
  Honestly I can't figure it out either. We found out other apps too (like LinkedIn) constantly check the clipboard, and one HN commenter here said it was due to a text editing library, nothing intentional. Literally the only fact is that it's a Chinese company. And it's not like there's even much it seems like they could do, with how sandboxed phone apps are. I'm not saying iOS or Android are perfectly secure, but it't totally different from installing something on your desktop with root permissions. Either it's just generic hate for China that's bizarrely gone viral, or else it's a story intentionally being pushed by the US government for god-only-knows what political reason, like leverage in trade negotiations or something. But it's completely weird, and nobody should be taking it at face value.
  - 40four 6y ago
    I don’t think it just hate for China, or politics. Real security researchers are finding really bad things. https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled
    - crazygringo 6y ago
      But are these things any worse than what other major apps do? Other social networking and entertainment apps are crammed full of tracking code, analytics, advertising networks, that all collect excessive user data, don't put it in their privacy policies, etc. And similarly, we hear about bad use of cryptography and SQL all the time. Apps can be pretty bad in general with these things. Now obviously, apps and code in general should be improved. But the question here is, is TikTok really that much worse? That it's such a worse threat than others, that it needs to be banned? Because that's what I still don't see evidence of.
- 40four 6y ago
  There is certainly ‘actual’ evidence linked in the reddit post. I’ve never seen the thread before, looks like they have edited/ added information. Here’s a report from cyber security researchers https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled - App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. - Files may contain hardcoded informations like usernames, passwords, keys etc.
DonHopkins 6y ago
Cats + Keyboards + Autocorrect strikes again!
ubermon 6y ago
Could be some over zealous employees inspired by recent Indian-China conflicts and TikTok ban and decided within their own org to do it without realizing how big of a news it would be.
xwdv 6y ago
You can realize something was a mistake after you’ve done it. I don’t see the issue.

dang 6y ago

Ok, I guess we'll change the title to that since the submitted title ("The TikTok app is no longer permitted on mobile devices that access Amazon email") has become misleading. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

east2west 6y ago

From WSJ: Amazon Says Email Ordering Employees to Delete TikTok Was Sent in Error. I suspect Amazon realized late what a legal mess it is to ban an app on their employee's cell phone when they have no clear legal basis or governmental guidance. They banned employee using Huawei phones when I was working there, for some things -- don't remember exactly. But in that case, US government already banned it for its employees, so there is precedence Amazon can claim as legal basis.

wiml 6y ago
Why do you think Amazon doesn't have a clear legal basis to decide which devices are allowed to connect to their internal network services? Or, for that matter, to decide which devices ca be taken into non-public, secured parts of Amazon buildings?
- kenhwang 6y ago
  They probably got informed that since phones are personal devices and not company provided, this level of restriction might land them in the parts of BYOD laws that require employers to compensate for personal device use for work. Amazon probably decided most employees don't have anything too sensitive and it's not worth buying everyone a phone.
  - vxNsr 6y ago
    Our company gets around that by banning BYOD.

IncRnd 6y ago

What a mistake. I imagine the email client just typed that email, and the wide distribution list, all by itself.

krick 6y ago
Someone said "Hey Alexa, totally don't send an email to all employees about banning TikTok on mobile devices and order me some food"

deleted 6y ago

[deleted]