6 ms·

Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?

by dangoor 5y ago

xfitm3 5y ago
Assuming this is iOS doesn't the native screen sharing capability handle that?
- mholm 5y ago
  Not chromecast. My charitable guess is they're adding support for chromecasting behind feature flags/AB testing, but don't yet have it correctly enabled/disabled. There was a lot of uproar over instagram immediately using the microphone/camera constantly, when they actually just always had the API initialized to make swiping to the camera snappier.
  - danudey 5y ago
    That could also explain why they didn't bother to provide in the notification to the user why they're requesting this access: because they weren't intending to request it (yet). I find the conspiracy theories more compelling, but less likely.
    - toxik 5y ago
      When an app tells you it’s stealing your data, I would say you should believe it.
mercora 5y ago
it would be a little too obvious if this is done for nefarious reasons by TikTok developers themselves.
- mtgx 5y ago
  Why too obvious? 99% of people don't pay attention to this stuff. Look at what Facebook has been doing to users for years and years before being caught and blaming it on a bug or becoming way to familiar to Britney's lyrics in "Oops, I did it again."
Maxburn 5y ago
I don't see chromecast or apple tv called out as a capability, and I'm not installing it to find out. I also don't really see the LAN access reasons there either. https://apps.apple.com/us/app/tiktok/id835599320 https://apps.apple.com/us/app/tiktok/id835599320 https://play.google.com/store/apps/details?id=com.ss.android.ugc.trill&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.ss.android... Based on the things they do call out as permissions this app is scary.
Closi 5y ago
Yeah, although I can't think of an immediate use-case considering Tiktok doesn't support streaming to Chromecast or Apple TV.
SllX 5y ago
You no more need Bluetooth permissions to use AirPlay than you do to for AirPods because the OS is deciding the output device per the users instructions[1]. Also: TikTok doesn’t support AirPlay or Chromecast. [1] Per the user’s instructions on a good day at least.
dehrmann 5y ago
I saw the same message yesterday from Spotify when I tried to use Chromecast. At least it prompted me for the permissions when I took that action, so it was clear why.
- zahrc 5y ago
  Which is usually only when it appears - when I specifically request the app to do something which requires to scan for local devices. Tiktok doesn’t support chrome cast (I think)
Lammy 5y ago
Any discussion of intent is always going to be speculation. All we can think about is what such a thing would be capable of if it were somehow malicious. The first possibility that comes to my mind would be sniffing Ethernet MAC addresses because it could be done without any sort of device-specific support built in to the app. Assuming your local devices’ manufacturers are following Da Rulez, the first part of their MAC address usually tells you the company, and the second part tends to be individualized/serialized. That would, for example, let TikTok derive when certain users are together IRL if they both show up scan-adjacent to a unique MAC. Or maybe it could let them derive multiple accounts belonging to a single person if one is used on VPN-only to discuss political or personal topics that person might not want associated with their IRL identity.
- rafale 5y ago
  Can you send packets to local network if you are using a VPN on ur phone? Sounds like a VPN bug to me.
  - oefrha 5y ago
    Of course you can. Look up VPN routing / split tunneling. It’s not uncommon for corporate VPNs to only route intranet traffic for instance; and LAN is usually whitelisted.
    - MichaelGroves 5y ago
      Besides corporate VPNs, typical consumer VPNs are also set up to allow LAN access. Your average joe-smoe would be annoyed if their network printer stopped working every time they turned on their VPN to watch netflix movies or whatever.
      - oefrha 5y ago
        Yes, "LAN is usually whitelisted" in my comment is independent from the corporate split tunneling example.
      - 5y ago
SavantIdiot 5y ago
If it only connects to multimedia devices, and if my OS lets me know that TikTok is using my multimedia devices, then I'd be OK with it, but I don't TikTok. Like MicroSnitch, which warns you when a mic/camera becomes active (macOS only).
azinman2 5y ago
If this just start popping up and without an explanation string, my guess is they included some 3rd party SDK that is doing fingerprinting on the local LAN, much like FB SDK's used to do.
starik36 5y ago
TikTok doesn't have either feature. At least I don't see an obvious way to connect.
hatware 5y ago
Trusting companies not to abuse the simple explanation of Chromecast is dead in the water, though. Why on earth would you trust a company _not_ to abuse that?

Perhaps there's something nefarious here, or perhaps it's just looking for a Chromecast or Apple TV?

xfitm3 5y ago

Assuming this is iOS doesn't the native screen sharing capability handle that?

mholm 5y ago
Not chromecast. My charitable guess is they're adding support for chromecasting behind feature flags/AB testing, but don't yet have it correctly enabled/disabled. There was a lot of uproar over instagram immediately using the microphone/camera constantly, when they actually just always had the API initialized to make swiping to the camera snappier.
- danudey 5y ago
  That could also explain why they didn't bother to provide in the notification to the user why they're requesting this access: because they weren't intending to request it (yet). I find the conspiracy theories more compelling, but less likely.
  - toxik 5y ago
    When an app tells you it’s stealing your data, I would say you should believe it.

mercora 5y ago

it would be a little too obvious if this is done for nefarious reasons by TikTok developers themselves.

mtgx 5y ago
Why too obvious? 99% of people don't pay attention to this stuff. Look at what Facebook has been doing to users for years and years before being caught and blaming it on a bug or becoming way to familiar to Britney's lyrics in "Oops, I did it again."

Maxburn 5y ago

I don't see chromecast or apple tv called out as a capability, and I'm not installing it to find out. I also don't really see the LAN access reasons there either. https://apps.apple.com/us/app/tiktok/id835599320 https://apps.apple.com/us/app/tiktok/id835599320 https://play.google.com/store/apps/details?id=com.ss.android.ugc.trill&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.ss.android... Based on the things they do call out as permissions this app is scary.

Closi 5y ago

Yeah, although I can't think of an immediate use-case considering Tiktok doesn't support streaming to Chromecast or Apple TV.

SllX 5y ago

You no more need Bluetooth permissions to use AirPlay than you do to for AirPods because the OS is deciding the output device per the users instructions[1]. Also: TikTok doesn’t support AirPlay or Chromecast. [1] Per the user’s instructions on a good day at least.

dehrmann 5y ago

I saw the same message yesterday from Spotify when I tried to use Chromecast. At least it prompted me for the permissions when I took that action, so it was clear why.

zahrc 5y ago
Which is usually only when it appears - when I specifically request the app to do something which requires to scan for local devices. Tiktok doesn’t support chrome cast (I think)

Lammy 5y ago

Any discussion of intent is always going to be speculation. All we can think about is what such a thing would be capable of if it were somehow malicious. The first possibility that comes to my mind would be sniffing Ethernet MAC addresses because it could be done without any sort of device-specific support built in to the app. Assuming your local devices’ manufacturers are following Da Rulez, the first part of their MAC address usually tells you the company, and the second part tends to be individualized/serialized. That would, for example, let TikTok derive when certain users are together IRL if they both show up scan-adjacent to a unique MAC. Or maybe it could let them derive multiple accounts belonging to a single person if one is used on VPN-only to discuss political or personal topics that person might not want associated with their IRL identity.

rafale 5y ago
Can you send packets to local network if you are using a VPN on ur phone? Sounds like a VPN bug to me.
- oefrha 5y ago
  Of course you can. Look up VPN routing / split tunneling. It’s not uncommon for corporate VPNs to only route intranet traffic for instance; and LAN is usually whitelisted.
  - MichaelGroves 5y ago
    Besides corporate VPNs, typical consumer VPNs are also set up to allow LAN access. Your average joe-smoe would be annoyed if their network printer stopped working every time they turned on their VPN to watch netflix movies or whatever.
    - oefrha 5y ago
      Yes, "LAN is usually whitelisted" in my comment is independent from the corporate split tunneling example.
    - 5y ago

SavantIdiot 5y ago

If it only connects to multimedia devices, and if my OS lets me know that TikTok is using my multimedia devices, then I'd be OK with it, but I don't TikTok. Like MicroSnitch, which warns you when a mic/camera becomes active (macOS only).

azinman2 5y ago

If this just start popping up and without an explanation string, my guess is they included some 3rd party SDK that is doing fingerprinting on the local LAN, much like FB SDK's used to do.

starik36 5y ago

TikTok doesn't have either feature. At least I don't see an obvious way to connect.

hatware 5y ago

Trusting companies not to abuse the simple explanation of Chromecast is dead in the water, though. Why on earth would you trust a company _not_ to abuse that?