9 ms·
“Tencent QQ caught scraping all browser history on Windows”
- namanyayg 6y agoFor those unaware, QQ is a desktop IM service by Tencent
- dawnerd 6y agoIt’s also a massive source of spam. We’ve had to do a lot of work last year to prevent spam qq signups while also allowing legit users. Those spammers are freakin relentless.
- meibo 6y agoI wonder how much you get away with posting/publicizing RE of these things on Chinese blogs as a PRC citizen. I would be very careful.
- crentist_the_d 6y agoThe article says "no, QQ is not stealing your history, you just need to disable the rule and it stops". I guess that's how they cover for themselves.
- oefrha 6y agoNowhere does the article say that. Please don't spread made-up bullshit like this.
- kiaraa_hk 6y agoMaybe you could consider that I didn't just make that up. I have a Chinese person with me, albeit non tech person, that read it for me. I could have added that "apprently it says this", but your phrasing is uncalled for.
- oefrha 6y agoI happen to know the language so don’t need a Chinese person with me. And I can tell you it doesn’t say that, or anything close to that, apparently or not; it’s not a long post so it’s not like I would miss anything. If you disagree, point to the specific sentence and we can have a discussion.
- yorwba 6y agoI guess it might be a misunderstanding based on 幸好之前用火绒的自定义拦截功能，设置了一些重要或敏感数据目录的保护。 "Luckily I had previously used Huorong's user-defined interception functionality to set up protection for a few important or sensitive data folders." (Which is how they noticed that QQ was trying to access them.) So yes, if your antivirus allows you to deny QQ access to your browser history, it won't read your browser history. But most QQ users probably didn't do that, considering that it went undetected for so long.
- shbooms 6y agoApparently not very much. The author has since deleted the post saying: "I just noticed that someone linked my previous tweet on HN. Sorry I have to delete it in case something come after me" https://twitter.com/CodeColorist/status/1350798973431283712?s=20 https://twitter.com/CodeColorist/status/1350798973431283712?...
- yorwba 6y agoThat was just someone who posted a link to the V2EX thread https://www.v2ex.com/t/745030 https://www.v2ex.com/t/745030 on Twitter. Kind of ironic that the original Chinese post is still up while the tweet was deleted.
- pharmakom 6y agoHow does this work? does this run inside the browser views inside the QQ app? Does Instagram do the same?
- nguyenkien 6y agoChromium based browser save history in sqlite file
- Avery3R 6y agoIt just reads the history file off of the disk directly
- blackrock 6y agoSo browse in incognito mode?
- weare138 6y agoThat may mitigate the problem but it doesn't solve it especially when you didn't know it was occurring to begin with. The app is blatantly stealing your data. Would you accept that as a viable solution?
- yoz-y 6y agoBrowsing history is a very useful tool though.
- ttt0 6y agoOr just don't use proprietary garbage.
- stjohnswarts 6y agoAlways browse in incognito? Eff that, uninstall the offending app when you find out they are tracking everything you do online.
- pharmakom 6y agoDoesn't Android block apps from reading each other's saved files?
- dannyw 6y agoIf China wants to use protectionism to wage digital economy warfare, let's respond in kind. No more Wechat, TikTok, Alipay, or League of Legends or Valorant, until China gives equal treatment to foreign internet firms. Note: Valorant installs a kernel driver as part of the "anti-cheat" system; described by many as a rootkit: https://www.osnews.com/story/131665/riot-games-maker-of-league-of-legends-installs-rootkit-with-their-new-hit-game-valorant/ https://www.osnews.com/story/131665/riot-games-maker-of-leag... Valorant's parent company is Tencent, the same company mentioned in this tweet.
- alexmingoia 6y agoThis behavior isn’t unique to Chinese companies.
- pjc50 6y agoThat's basically the problem, isn't it? In order to address this behaviour, the West would have to admit that it was bad, and that it was also bad when done by western companies, and have a coherent theory of privacy.
- Yetanfou 6y agoNope, the problem here is that Recent does this, had it been Microsoft who was caught (as has happened several times) the problem would have been that Microsoft did it. The problem, in other words, is not related to the identity of the perpetrator. In some cases that identity might be a country - Tencent, Vkontakte, etc - while in other cases it is some commercial entity with probable ties to a country - Microsoft, Facebook, Twitter, Google, Apple, AT&T, etc.
- Wolfenstein98k 6y agoCorrect, but it is much more typical and common of them than any other nation. This has been a major issue for decades across many countries, all of whom have been lobbying (for instance in the WTO) to crack down on Chinese IP theft, their use of non-Chinese citizens' data for censorship training purposes, etc
- alexmingoia 6y agoThis is the type of behavior Apple intends to prevent with their signed app distribution, loathed by so many here.
- uncledave 6y agoNot loathed here. As an end user I am consciously paying for the sand boxing and permissions features of iOS and the app review process. With so much shitty behaviour out there it’s a trade off I’ve had to make.
- outime 6y agoI guess the people who loathe it (not me though) are very well aware of this particular benefit and still think isn’t enough justification to enable it by default.
- LockAndLol 6y agoDoesn't Google Chrome do that already (log everything) and still many people use it? And wasn't there a recent article about how programs couldn't be run on Big Sur because some server somewhere could verify the hash before it was ran? It was discovered because the OS slowed down to an unbearable speed except when running Apple programs. Signed app distribution won't solve this problem.
- meibo 6y agoThe difference is really that chrome is not a third party app doing it live to other browsers. Chrome hides this as legitimate value to users - when I type out an URL on my desktop, I will get auto complete for it and shared history on my phone and my laptop. It's a trade-off.
- deleted 6y ago[deleted]
- veeti 6y agoThere is no technical reason or requirement for Apple to be the ultimate gatekeeper of their walled garden just to sandbox file access. But I'm sure they are more than happy to conflate these things in the name of "security".
- uncledave 6y agoUnrelated, sort of, but I was watching Venom the other day and noticed QQ was heavily marketed in the film. Also sponsored and funded by Tencent. This made me feel a bit dirty. I’d never knowingly use any software by them.
- Iolaum 6y agoApart from a lot of other issues mentioned here, this looks to me for a good argument of app sandboxing. It is a thing on mobile but not much on the desktop.
- nomay 6y agoQQ comes with a bundled QQProtect.exe that can't be killed, QQ simply refuses to run without it.
- orbital-decay 6y agoCan't you sandbox both though?
- ev1 6y agoUnsure, but multiple Tencent products ship with various "protects" (like TenProtect) that are kernel level rootkits that start at boot.
- yorwba 6y agoThe OP on V2EX mentioned[1] that they downloaded QQ from the Microsoft Store, specifically because it doesn't come with QQProtect. Didn't help, apparently. [1] https://www.v2ex.com/t/745030?p=1#r_10067077 https://www.v2ex.com/t/745030?p=1#r_10067077
- lostmsu 6y agoThere's a fatal issue with Microsoft Store apps: it allows both sandboxed and unsandboxed apps, and the developer can just upload a new version for their sandboxed app, that is not sandboxed. Updates are automatic, so the app, that looked like restricted to access only say calls will after update be able to access anything it wants.
- bserge 6y agoI tried Tencent's app on Android a long time ago when they were offering 1TB of free cloud storage. It started uploading all my photos (and who knows what else) as soon as I allowed file access. I immediately deleted it, who the hell does that? Even Google Drive asks for permission first. I guess that's what you trade for 1TB haha.
- nomay 6y agoIt was trying to read certain types of URLs encoded in MD5, found to be these. https://i.imgur.com/rSOyTt7.jpg https://i.imgur.com/rSOyTt7.jpg It wants to know what you searched on e-commerce sites. This is somewhat unsursprising, Tencent failed on e-commerce, it desperately needs these data to help with user profiling.
- yorwba 6y agoHere it is as text: https://www.v2ex.com/t/745030?p=3#r_10077384 https://www.v2ex.com/t/745030?p=3#r_10077384 According to that post, they don't even upload the URLs that match, but just the fact that there was a match for one of three groups of keywords. Seems like a lot of effort for little information gain...
- m463 6y agoI used to use camscanner plus on ios (camera -> pdf). It was bought by tencent and the privacy policy was either a broken link, or when it later worked - horrendous and basically said they take everything. I deleted it.
- wyxuan 6y agoLooks like the author deleted the tweet out of fear. > I just noticed that someone linked my previous tweet on HN. Sorry I have to delete it in case something come after me https://twitter.com/CodeColorist/status/1350798973431283712?s=20 https://twitter.com/CodeColorist/status/1350798973431283712?...
- djohnston 6y agoAnd we still have whataboutism running rampant. I suppose the difference between tencent and Facebook is that you can call FB out on their practices without worrying about getting disappeared and then deleting your tweets out of fear.
- yorwba 6y agoStill up on V2EX https://www.v2ex.com/t/745030 https://www.v2ex.com/t/745030 which the tweet was basically just a link to. Edit: Internet Archive of tweet: https://web.archive.org/web/20210117115536/https://twitter.com/CodeColorist/status/1350625255765671938 https://web.archive.org/web/20210117115536/https://twitter.c...
- knolax 6y agoOP of the tweet probably doesn't want the attention of the orange website. If something of mine got posted on HN I'd delete it too.
- Debug_Overload 6y agoMentioning the author deleted it out of fear and then posting his Twitter handle might not be a great combination here.
- wyxuan 6y agoWell you can still see the author’s Twitter handle in the submission link, so I don’t think it’s a huge deal.
- felixcode 6y agohttps://www.youtube.com/watch?v=QWicxjR7fz0&feature=emb_logo https://www.youtube.com/watch?v=QWicxjR7fz0&feature=emb_logo tracing and blocking QQ/TIM from reading browsing history.
- zepto 6y agoNote that Tencent owns 40% of Epic, who a lot of people think is a hero for trying to take away Apple’s power to prevent bad actors on their store.
- oblio 6y agoEpic vs Apple is a matter of principle, even if the complaint is from a untrustworthy source. Walled gardens should be dismantled. They shouldn't have been allowed to begin with, for Nintendo 64 or whatever it was.
- zepto 6y agoThere is no principle involved. ‘Wall garden’ isn’t a real category’. People should be able to choose to enter a walled garden if it suits them. When a corporation like Epic uses the law to take away people’s rights is rarely about principle. Epic vs Apple is about nothing except Epic profiting from Apple’s work, and removing a relatively safe place to buy software. At the very least if Epic and Tencent are in fact bad actors, we should be curious about why they are motivated in the case. It’s not out of altruism.
- Trill-I-Am 6y agoWould iPhone users be worse off if they gained the ability to use multiple different app stores?
- hexhu 6y agoraion on V2EX[1][2] reverse-engineered Tencent QQ's scraping code and acquired the list of URLs and keywords: 1. S.TAOBAO.COM/SEARCH? 2. LIST.TMALL.COM/SEARCH_PRODUCT.HTM? 3. (30, 0xDDA1029, 0x9E67F3BB, 0xB18ACC45, 0x597CF438): b'', # not yet decoded 4. SEARCH.JD.COM/SEARCH? Keyword Group 1: 5. 古着 (kanji meaning old cloths) 6. VINTAGE Keyword Group 2: 7. 融券 (margin trading-short) 8. 融资 (financing) Keyword Group 3: 9. 炒股 (stock trading) 10. 股票 (stock) [1]: https://archive.vn/c1ABO https://archive.vn/c1ABO post id 229 [2]: https://sm.ms/image/hxiVvDNsf2lFJ7u https://sm.ms/image/hxiVvDNsf2lFJ7u
- hexhu 6y agoThe last url has been found by lhprojects through brute-forcing Chinese eCommerce website urls. It's first 30 characters are: `uland.taobao com/sem/tbsearch?` Credit to lhprojects https://nbviewer.jupyter.org/github/lhprojects/blog/blob/master/JupyterNotebooks/HumanBurstCrackQQDomain.ipynb https://nbviewer.jupyter.org/github/lhprojects/blog/blob/mas...
- est 6y agoI was expecting some clever brute-forcing turns out it's just lucky guess.
- beatle_sauce 6y agoDoes Wechat on Windows have a similar feature?