5 ms·

I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a

I keep seeing that Reddit thread linked (even the NYT is citing it now?) but still cannot for the life of me figure out what substantially TikTok does that is a concern compared to other popular apps? The guy has like 10 paragraphs of stories but no actual evidence? What is TikTok doing that somehow is flying under the app store guidelines of both Google and Apple but still a "national security concern"? Why is the only actual "evidence" that can seemingly be found, a comment from some rando on Reddit, not peer-reviewed, reproducible work from legit cybersecurity researchers? This reeks of the same scent that Bloomberg's "omg they're hackz0ring our chips!" story gave off.

DaiPlusPlus 6y ago
For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about. There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.
- che_shirecat 6y ago
  So, like LinkedIn and Reddit? (the site that the "researcher" behind these NYT-cited claims is using) [1] You could run through the toplist of apps and find hundreds that exhibit the same behavior. Not trying to derail this via whataboutism, I just feel like the core HN ethos is lost when we mindlessly repeat the obvious geopolitically-driven narrative here without any critical thinking. What I definitely do understand is Amazon's concerns with just the base level of data collection that's seemingly the norm in our industry. Which prompts the quesiton, why are we comfortable as a society with this sort of collection, by anyone? [1] https://www.businessinsider.com/apple-ios-14-catches-reddit-linkedin-copying-iphone-clipboard-data-2020-7 https://www.businessinsider.com/apple-ios-14-catches-reddit-...
  - xster 6y ago
    https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo Here's a rundown of just general apps that would be on everyone's home screens doing the same thing.
    - ilikeerp 6y ago
      Any word on why those apps do what they're doing? Why copy from messages?
  - GekkePrutser 6y ago
    That the others are doing it too doesn't make it right. Really Apple should take a stand and give all of them 30 days to fix their apps or get banned. But TikTok annoyed me in particular for a long time. Nothing to do with geopolitics, I already hated it before I knew it was owned by China and everyone started banning it. It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality. Especially with the lockdown it became extra annoying, every day I got multiple stupid lockdown videos and the ones with people doing stupid stuff and then the coffin dancers thing. So that's my personal reason for hating on TikTok. The privacy revelations just sealed the deal. Not saying it's a valid reason for everybody but it's my reason :P
    - deleted 6y ago
      [deleted]
    - DaiPlusPlus 6y ago
      > It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality. This quote comes to mind: > I used to be with ‘it’, but then they changed what ‘it’ was. Now what I’m with isn’t ‘it’ anymore and what’s ‘it’ seems weird and scary. It’ll happen to you! https://www.youtube.com/watch?v=LV0wTtiJygY https://www.youtube.com/watch?v=LV0wTtiJygY
- scarface74 6y ago
  For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. Your password should never be in your clipboard at least with iOS. If you’re using either the native password manager or a third party password manager, the password manager is directly integrated with the keyboard and would auto fill into your app. https://techcrunch.com/2018/06/05/password-autofill-in-ios-12-will-work-with-third-party-password-managers/ https://techcrunch.com/2018/06/05/password-autofill-in-ios-1...
  - johnmaguire2013 6y ago
    Android does this too. On neither platform does it work 100% of the time, especially in browsers. That's why almost all clipboard managers also have a "copy to clipboard" feature from the autofill view.
    - Teknoman117 6y ago
      It rarely fails for me in the browser, but it fails on me regularly for apps. The ones that particularly annoy me are the ones that haven't updated to the new Android biometric API versus just supporting the old fingerprint API. I'm looking at you Chase mobile app.
      - johnmaguire2013 6y ago
        Amazon consistently fails in the browser for me with 1Password + Android.
    - scarface74 6y ago
      I’ve never had it not work in the browser.
      - simcop2387 6y ago
        It's usually a result of the webpage doing stupid stuff to try to explicitly block password managers. There's a lot of banking and government websites that believe this makes things more secure somehow.
GekkePrutser 6y ago
Well for one, the fact that they do all these things. Some apps do some of these but rarely all of them. The other is the way they hide what they're doing so elaborately. I wouldn't call it a national security concern, no. Someone who works with critical or military infrastructure should have a locked-down phone anyway for work stuff. But really I wonder how this kind of stuff is OK in the eyes of Apple with their self-proclaimed privacy focus. I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. Popularity seems to overrule that.
- elliekelly 6y ago
  > I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. I suspect you’re right and would be very interested in the results of this experiment if you (or anyone else) happen to undertake it.
crazygringo 6y ago
Honestly I can't figure it out either. We found out other apps too (like LinkedIn) constantly check the clipboard, and one HN commenter here said it was due to a text editing library, nothing intentional. Literally the only fact is that it's a Chinese company. And it's not like there's even much it seems like they could do, with how sandboxed phone apps are. I'm not saying iOS or Android are perfectly secure, but it't totally different from installing something on your desktop with root permissions. Either it's just generic hate for China that's bizarrely gone viral, or else it's a story intentionally being pushed by the US government for god-only-knows what political reason, like leverage in trade negotiations or something. But it's completely weird, and nobody should be taking it at face value.
- 40four 6y ago
  I don’t think it just hate for China, or politics. Real security researchers are finding really bad things. https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled
  - crazygringo 6y ago
    But are these things any worse than what other major apps do? Other social networking and entertainment apps are crammed full of tracking code, analytics, advertising networks, that all collect excessive user data, don't put it in their privacy policies, etc. And similarly, we hear about bad use of cryptography and SQL all the time. Apps can be pretty bad in general with these things. Now obviously, apps and code in general should be improved. But the question here is, is TikTok really that much worse? That it's such a worse threat than others, that it needs to be banned? Because that's what I still don't see evidence of.
40four 6y ago
There is certainly ‘actual’ evidence linked in the reddit post. I’ve never seen the thread before, looks like they have edited/ added information. Here’s a report from cyber security researchers https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled - App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. - Files may contain hardcoded informations like usernames, passwords, keys etc.

DaiPlusPlus 6y ago

For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. ...and we only know about this issue now because iOS 14 adds clipboard snooping notifications - and that was only a month ago! Think about the stuff that the app could be doing that we don’t yet know about. There’s too many bloody-obvious security vulnerabilities that are decades old but don’t get fixed until they either become a meme (like SQL Injection) or the platform vendor does something about it (iOS 14 clipboard notifications) - and don’t forget that the SIGINT community is sitting on millions of dollars worth of zero-days that they won’t disclose to vendors unless they feel like it - so I fully expect there to be more surprises in TikTok - and other apps - in the years to come - probably indefinitely.

che_shirecat 6y ago
So, like LinkedIn and Reddit? (the site that the "researcher" behind these NYT-cited claims is using) [1] You could run through the toplist of apps and find hundreds that exhibit the same behavior. Not trying to derail this via whataboutism, I just feel like the core HN ethos is lost when we mindlessly repeat the obvious geopolitically-driven narrative here without any critical thinking. What I definitely do understand is Amazon's concerns with just the base level of data collection that's seemingly the norm in our industry. Which prompts the quesiton, why are we comfortable as a society with this sort of collection, by anyone? [1] https://www.businessinsider.com/apple-ios-14-catches-reddit-linkedin-copying-iphone-clipboard-data-2020-7 https://www.businessinsider.com/apple-ios-14-catches-reddit-...
- xster 6y ago
  https://www.youtube.com/watch?v=pRSWdtoUAjo https://www.youtube.com/watch?v=pRSWdtoUAjo Here's a rundown of just general apps that would be on everyone's home screens doing the same thing.
  - ilikeerp 6y ago
    Any word on why those apps do what they're doing? Why copy from messages?
- GekkePrutser 6y ago
  That the others are doing it too doesn't make it right. Really Apple should take a stand and give all of them 30 days to fix their apps or get banned. But TikTok annoyed me in particular for a long time. Nothing to do with geopolitics, I already hated it before I knew it was owned by China and everyone started banning it. It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality. Especially with the lockdown it became extra annoying, every day I got multiple stupid lockdown videos and the ones with people doing stupid stuff and then the coffin dancers thing. So that's my personal reason for hating on TikTok. The privacy revelations just sealed the deal. Not saying it's a valid reason for everybody but it's my reason :P
  - deleted 6y ago
    [deleted]
  - DaiPlusPlus 6y ago
    > It was just that for the past months every time someone forwarded me a stupid video I was supposed to like, it had a TikTok logo on it. So in my view this became the source of "stupid videos people bother me with". Not exactly a charming quality. This quote comes to mind: > I used to be with ‘it’, but then they changed what ‘it’ was. Now what I’m with isn’t ‘it’ anymore and what’s ‘it’ seems weird and scary. It’ll happen to you! https://www.youtube.com/watch?v=LV0wTtiJygY https://www.youtube.com/watch?v=LV0wTtiJygY
scarface74 6y ago
For one, the clipboard snooping problem. If you’re using a password-manager (like we’re supposed to!) and use it to copy passwords (say, your Amazon employee internal credentials...) while you have TikTok open, the TikTok app would see it and could upload it somewhere. Your password should never be in your clipboard at least with iOS. If you’re using either the native password manager or a third party password manager, the password manager is directly integrated with the keyboard and would auto fill into your app. https://techcrunch.com/2018/06/05/password-autofill-in-ios-12-will-work-with-third-party-password-managers/ https://techcrunch.com/2018/06/05/password-autofill-in-ios-1...
- johnmaguire2013 6y ago
  Android does this too. On neither platform does it work 100% of the time, especially in browsers. That's why almost all clipboard managers also have a "copy to clipboard" feature from the autofill view.
  - Teknoman117 6y ago
    It rarely fails for me in the browser, but it fails on me regularly for apps. The ones that particularly annoy me are the ones that haven't updated to the new Android biometric API versus just supporting the old fingerprint API. I'm looking at you Chase mobile app.
    - johnmaguire2013 6y ago
      Amazon consistently fails in the browser for me with 1Password + Android.
  - scarface74 6y ago
    I’ve never had it not work in the browser.
    - simcop2387 6y ago
      It's usually a result of the webpage doing stupid stuff to try to explicitly block password managers. There's a lot of banking and government websites that believe this makes things more secure somehow.

GekkePrutser 6y ago

Well for one, the fact that they do all these things. Some apps do some of these but rarely all of them. The other is the way they hide what they're doing so elaborately. I wouldn't call it a national security concern, no. Someone who works with critical or military infrastructure should have a locked-down phone anyway for work stuff. But really I wonder how this kind of stuff is OK in the eyes of Apple with their self-proclaimed privacy focus. I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. Popularity seems to overrule that.

elliekelly 6y ago
> I'm pretty sure if I were to submit an app that does all this, it'll be rejected right away. I suspect you’re right and would be very interested in the results of this experiment if you (or anyone else) happen to undertake it.

crazygringo 6y ago

Honestly I can't figure it out either. We found out other apps too (like LinkedIn) constantly check the clipboard, and one HN commenter here said it was due to a text editing library, nothing intentional. Literally the only fact is that it's a Chinese company. And it's not like there's even much it seems like they could do, with how sandboxed phone apps are. I'm not saying iOS or Android are perfectly secure, but it't totally different from installing something on your desktop with root permissions. Either it's just generic hate for China that's bizarrely gone viral, or else it's a story intentionally being pushed by the US government for god-only-knows what political reason, like leverage in trade negotiations or something. But it's completely weird, and nobody should be taking it at face value.

40four 6y ago
I don’t think it just hate for China, or politics. Real security researchers are finding really bad things. https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled
- crazygringo 6y ago
  But are these things any worse than what other major apps do? Other social networking and entertainment apps are crammed full of tracking code, analytics, advertising networks, that all collect excessive user data, don't put it in their privacy policies, etc. And similarly, we hear about bad use of cryptography and SQL all the time. Apps can be pretty bad in general with these things. Now obviously, apps and code in general should be improved. But the question here is, is TikTok really that much worse? That it's such a worse threat than others, that it needs to be banned? Because that's what I still don't see evidence of.

40four 6y ago

There is certainly ‘actual’ evidence linked in the reddit post. I’ve never seen the thread before, looks like they have edited/ added information. Here’s a report from cyber security researchers https://penetrum.com/research https://penetrum.com/research https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi... https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pdf https://penetrum.com/tiktok/tiktok_15.2.3_static_analysis.pd... Things they found - Excessive data collection - Privacy policies that allow distribution of said data - Execution of OS commands - Insecure cryptography usage - Potential SQL injection code from user defined variables - Storing of API tokens - Webview enabled by default along with insecure webview enabled - App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it. - Files may contain hardcoded informations like usernames, passwords, keys etc.