4 ms·

"TikTok is said to collect “everything”, from search and browsing histories; keystroke patterns; biometric identifiers—including faceprints" How can they even

by XiS 4y ago

"TikTok is said to collect “everything”, from search and browsing histories; keystroke patterns; biometric identifiers—including faceprints" How can they even collect browsing history or biometric identifiers on Android? Isn't browser history stored in the browser's private storage space, or am I being naive here?

eloisius 4y ago
Probably means browsing within the app. Although the fyp is the meat of it, you can also browse topics and hashtags.
netsharc 4y ago
Browsing history: many apps (like reddit, Instagram) have their own browser in the app so they can track it, and they nag you to use their app when you open their website. Biometric identifiers, I'm guessing mostly facial features: if you take a selfie/self-video with TikTok (which millions of people do) they can just take the data from there.
deleted 4y ago
[deleted]
worthless-trash 4y ago
IIRC you can use the android shared webview to determine if a site is in cache on the system by measuring access times.
- daenz 4y ago
  Sounds similar to a timing attack[0] 0. https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack
  - worthless-trash 4y ago
    Very similar... Inferring data through response time.
    - bencollier49 4y ago
      Do you not get access to the response code as well? That would be simpler.
      - jazzyjackson 4y ago
        off the top of my head, the response code from cache is simply 200 OK, is it not?
        bencollier49 4y ago
        Interesting, I just looked and certainly in FF it now is. I have a distinct memory of locally cached files returning a 3xx in the past, though.
        jazzyjackson 4y ago
        I think that would happen in combination with the remote server replying "304 Not Modified" Now that you mentioned it tho, I'm not sure whether developer tools is showing me the ground truth, how does it give me 200 OK from cache without asking the remote whether the resource has changed? My memory agrees with you, something has changed in the matrix.
david_allison 4y ago
Very unlikely to be accurate. If it was, TikTok wouldn't be on the app stores. * Browsing history: If a user uses a WebView in your app, you can obtain the history of* that WebView instance. Xiaomi phones let applications have access to the first (100?) bytes of each pcap line. [note: this is probably unintended, but their bug bounty programme didn't care]. * Keystroke patterns: You can track user keystrokes within your app. If you're a keyboard or accessibility provider, you can access keystrokes globally. I haven't used TikTok, but it's very unlikely that they do either of these, the UX to enable them is not pleasant because they're dangerous actions to take. * Biometric identifiers: If a user takes a selfie, you have their iris/fingerprint/faceprint
- NullPrefix 4y ago
  >Xiaomi phones let applications have access to the first (100?) bytes of each pcap line What is pcap line?
  - david_allison 4y ago
    A 'row' of packet capture data (in Wireshark's output). I apologize for the lack of clarity. I'm unfamiliar with network terminology and unsure what this looks like on the binary level. The files are in: /storage/emulated/0/MIUI/debug_log/common/tcpdump if you have a phone to test.
    - NullPrefix 4y ago
      Does it refer to just WebView in your own app or general browser app too?
      - david_allison 4y ago
        The standard Android ability to get WebView history is only the history for the instance of the WebView which you created (totally reasonable IMO, there's lots of non-nefarious purposes that you'd want to intercept requests[0]). To my limited understanding, the file on Xiaomi phones is a dump of all the packets that your router would see. If you're using HTTPS, it's probably leaking the sites, but it's mostly garbage. [0] https://github.com/ankidroid/Anki-Android/blob/31cfbc914a7467eaeeeb74a461821f1166d707f5/AnkiDroid/src/main/java/com/ichi2/anki/AbstractFlashcardViewer.kt#L2201-L2223 https://github.com/ankidroid/Anki-Android/blob/31cfbc914a746...

by XiS 4y ago

eloisius 4y ago

Probably means browsing within the app. Although the fyp is the meat of it, you can also browse topics and hashtags.

netsharc 4y ago

Browsing history: many apps (like reddit, Instagram) have their own browser in the app so they can track it, and they nag you to use their app when you open their website. Biometric identifiers, I'm guessing mostly facial features: if you take a selfie/self-video with TikTok (which millions of people do) they can just take the data from there.

deleted 4y ago

[deleted]

worthless-trash 4y ago

IIRC you can use the android shared webview to determine if a site is in cache on the system by measuring access times.

daenz 4y ago
Sounds similar to a timing attack[0] 0. https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack
- worthless-trash 4y ago
  Very similar... Inferring data through response time.
  - bencollier49 4y ago
    Do you not get access to the response code as well? That would be simpler.
    - jazzyjackson 4y ago
      off the top of my head, the response code from cache is simply 200 OK, is it not?
      - bencollier49 4y ago
        Interesting, I just looked and certainly in FF it now is. I have a distinct memory of locally cached files returning a 3xx in the past, though.
        jazzyjackson 4y ago
        I think that would happen in combination with the remote server replying "304 Not Modified" Now that you mentioned it tho, I'm not sure whether developer tools is showing me the ground truth, how does it give me 200 OK from cache without asking the remote whether the resource has changed? My memory agrees with you, something has changed in the matrix.

david_allison 4y ago

Very unlikely to be accurate. If it was, TikTok wouldn't be on the app stores. * Browsing history: If a user uses a WebView in your app, you can obtain the history of* that WebView instance. Xiaomi phones let applications have access to the first (100?) bytes of each pcap line. [note: this is probably unintended, but their bug bounty programme didn't care]. * Keystroke patterns: You can track user keystrokes within your app. If you're a keyboard or accessibility provider, you can access keystrokes globally. I haven't used TikTok, but it's very unlikely that they do either of these, the UX to enable them is not pleasant because they're dangerous actions to take. * Biometric identifiers: If a user takes a selfie, you have their iris/fingerprint/faceprint

NullPrefix 4y ago
>Xiaomi phones let applications have access to the first (100?) bytes of each pcap line What is pcap line?
- david_allison 4y ago
  A 'row' of packet capture data (in Wireshark's output). I apologize for the lack of clarity. I'm unfamiliar with network terminology and unsure what this looks like on the binary level. The files are in: /storage/emulated/0/MIUI/debug_log/common/tcpdump if you have a phone to test.
  - NullPrefix 4y ago
    Does it refer to just WebView in your own app or general browser app too?
    - david_allison 4y ago
      The standard Android ability to get WebView history is only the history for the instance of the WebView which you created (totally reasonable IMO, there's lots of non-nefarious purposes that you'd want to intercept requests[0]). To my limited understanding, the file on Xiaomi phones is a dump of all the packets that your router would see. If you're using HTTPS, it's probably leaking the sites, but it's mostly garbage. [0] https://github.com/ankidroid/Anki-Android/blob/31cfbc914a7467eaeeeb74a461821f1166d707f5/AnkiDroid/src/main/java/com/ichi2/anki/AbstractFlashcardViewer.kt#L2201-L2223 https://github.com/ankidroid/Anki-Android/blob/31cfbc914a746...