4 ms·

>>Everything they're accusing TikTok of - from data harvesting to the government having access to said data - is true for western companies as well and that sho

>>Everything they're accusing TikTok of - from data harvesting to the government having access to said data - is true for western companies as well and that should be the problem The thing is, yes Facebook and Google's data collection is horrendous, but TikTok it literally on another level. Quite a good explanation here: https://www.reddit.com/r/videos/comments/fxgi06/comment/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/comment/fmuk...

janekm 4y ago
Personally I feel this is as much a failing of of mobile OSs as anything else. As long as we have an environment where ad networks think it's desirable to collect this kind of information it's going to get collected, whether by TikTok or ad networks. Apple at least attempt to limit what data is accessible by apps, Google is less incentivized to do so. It's not much help to "ban TikTok" while the ad networks run wild. If we're going to be worried about China I doubt it'd be too much trouble for them to place a few engineers into ad networks and exfiltrate the data from there.
- Ekaros 4y ago
  Maybe the governments should force mobile OS to provide absolute zero information about anything to apps. If the apps can't get anything they can't leak anything.
  - hulitu 4y ago
    The governments are the direct beneficiaries of this data collection either directly or indirectly.
    - gzer0 4y ago
      Exactly right. As can be seen via the purchases of large swaths of private location data by the Department of Homeland Security and other government entities, essentially side stepping US citizens’ 4th amendment rights [1]. [1] https://www.aclu.org/news/privacy-technology/new-records-detail-dhs-purchase-and-use-of-vast-quantities-of-cell-phone-location-data https://www.aclu.org/news/privacy-technology/new-records-det...
  - iggldiggl 4y ago
    Unfortunately that approach pretty easily ends up in a territory where you can't do anything interesting with your phone, either, because it's all too dangerous.
  - kaba0 4y ago
    Then your phone will be a quite useless device.
  - yreg 4y ago
    As a user I want to have the app as isolated as possible and have the ability to grant it any system permissions I want. Perhaps combined with a store rule that an app isn't allowed to block unrelated functionality when it doesn't get the permissions it wants. iOS has been quite good to me in this regard, although it still needs improvements (e.g. add a permission for accessing internet).
snehk 4y ago
We have newer leaks about data collections that seem genuine but that particular post you've linked to has been debunked. He even promoted a subreddit where he was unable to provide proof for _any_ of his claims. Nothing ever happened. Some things just didn't make any sense like the app making regular http requests. Google doesn't allow that and they haven't allowed it for years. It's literally impossible for that to be the case, for example. https://www.reddit.com/r/tiktok_reversing/comments/i8gig3/been_played_like_a_fiddle/ https://www.reddit.com/r/tiktok_reversing/comments/i8gig3/be...
soganess 4y ago
From the link: * - Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc) - Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?) - Everything network-related (ip, local ip, router mac, your mac, wifi access point name) - Whether or not you're rooted/jailbroken - Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC - They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their... * Not trying to be flippant, but that list just sounds like google play services to me. In fact, I assumed play services collects way more data. Also, tiktok surely must be collecting some engagement / interaction analytics... That list doesn't seem complete or legitimate.
- sofixa 4y ago
  Or any random debugging library like Crashlytics.
- andruby 4y ago
  didn't the facebook app do mostly the same?
- pastage 4y ago
  Interesting! Is this allowed in GDPR? I would not think any of these points would be ok. You seem to argue that this is something "everyone does", that does not make it ok. I really thought we had gotten further in the privacy discussion.
  - hulitu 4y ago
    If GDPR would be enforced, Google, Microsoft, Facebook and other will exit EU market. At the moment GDPR is a joke.
    - 4y ago
david_allison 4y ago
Do you have a better source? I don't buy the comment at all, and the whitepaper[0] is of very low quality. [0] https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
mola 4y ago
Seems not true. I worked in mobile security. We had massive amounts of data about mobile apps and the suspected behaviour they show (via dynamic analysis, static analysis, code signatures, etc) We saw a huge amount of Ad SDKs showing all kinds of malicious behaviour. Facebook etc were the worse, TikTok was not particularly exceptional. One of the biggest problem for an anti malware product in that space is that most "legitimate" software looked indistinguishable from spywares. And if we were to mark these as malware then our product won't be usable. These apps are hoovering crazy amount of information. They should be banned, universally. No matter which country they originate at. Giving politicians this kind of power over the population in a democratic society is a huge national security risk. No less than a foreign power having these capabilities.
Schroedingersat 4y ago
I'm sure tiktok does a llt worse since that comment was written, but that list is a tiny subset of what facebook has been caught doing in the past and what microsoft, google and apple do now. The US government do not hold large corportations to account, quite the opposite. They put people in jail for successfully fighting them legally or turn a blind eye when whistleblowers are car bombed. They make deals with facebook and google for the data so they can say 'it's a private company and independent entity'. China would likely be just as bad if they were as powerful, but from the point of view of most of the world they have stolen far less of our natural resources, killed/deposed far fewer of our democratically elected governments, bought up far less of our media and turned it into propaganda, spied on our citizens less, and abused treaty law to curtail our freedoms far less.
whyagain1885 4y ago
From Reddit: > Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc) > Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?) > Everything network-related (ip, local ip, router mac, your mac, wifi access point name) > Whether or not you're rooted/jailbroken > Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC > They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication Wait a minute - Why was Android or iPhone - built by West allows everything... Or if tiktok are the topdog in writing apps and FB missed out on writing these? Sour grapes?
- herbturbo 4y ago
  Most of those metrics can be gathered by off the shelf analytics SDKs. Not hardware IDs though. If they are doing that on iOS they are certainly violating a number of rules. The proxy server is disturbing if true. Only reason I could think of that being necessary would be to use customer devices to perform distributed transcoding of other people's videos. Can't imagine that being something Apple would allow.

janekm 4y ago

Personally I feel this is as much a failing of of mobile OSs as anything else. As long as we have an environment where ad networks think it's desirable to collect this kind of information it's going to get collected, whether by TikTok or ad networks. Apple at least attempt to limit what data is accessible by apps, Google is less incentivized to do so. It's not much help to "ban TikTok" while the ad networks run wild. If we're going to be worried about China I doubt it'd be too much trouble for them to place a few engineers into ad networks and exfiltrate the data from there.

Ekaros 4y ago
Maybe the governments should force mobile OS to provide absolute zero information about anything to apps. If the apps can't get anything they can't leak anything.
- hulitu 4y ago
  The governments are the direct beneficiaries of this data collection either directly or indirectly.
  - gzer0 4y ago
    Exactly right. As can be seen via the purchases of large swaths of private location data by the Department of Homeland Security and other government entities, essentially side stepping US citizens’ 4th amendment rights [1]. [1] https://www.aclu.org/news/privacy-technology/new-records-detail-dhs-purchase-and-use-of-vast-quantities-of-cell-phone-location-data https://www.aclu.org/news/privacy-technology/new-records-det...
- iggldiggl 4y ago
  Unfortunately that approach pretty easily ends up in a territory where you can't do anything interesting with your phone, either, because it's all too dangerous.
- kaba0 4y ago
  Then your phone will be a quite useless device.
- yreg 4y ago
  As a user I want to have the app as isolated as possible and have the ability to grant it any system permissions I want. Perhaps combined with a store rule that an app isn't allowed to block unrelated functionality when it doesn't get the permissions it wants. iOS has been quite good to me in this regard, although it still needs improvements (e.g. add a permission for accessing internet).

snehk 4y ago

We have newer leaks about data collections that seem genuine but that particular post you've linked to has been debunked. He even promoted a subreddit where he was unable to provide proof for _any_ of his claims. Nothing ever happened. Some things just didn't make any sense like the app making regular http requests. Google doesn't allow that and they haven't allowed it for years. It's literally impossible for that to be the case, for example. https://www.reddit.com/r/tiktok_reversing/comments/i8gig3/been_played_like_a_fiddle/ https://www.reddit.com/r/tiktok_reversing/comments/i8gig3/be...

soganess 4y ago

From the link: * - Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc) - Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?) - Everything network-related (ip, local ip, router mac, your mac, wifi access point name) - Whether or not you're rooted/jailbroken - Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC - They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their... * Not trying to be flippant, but that list just sounds like google play services to me. In fact, I assumed play services collects way more data. Also, tiktok surely must be collecting some engagement / interaction analytics... That list doesn't seem complete or legitimate.

sofixa 4y ago
Or any random debugging library like Crashlytics.
andruby 4y ago
didn't the facebook app do mostly the same?
pastage 4y ago
Interesting! Is this allowed in GDPR? I would not think any of these points would be ok. You seem to argue that this is something "everyone does", that does not make it ok. I really thought we had gotten further in the privacy discussion.
- hulitu 4y ago
  If GDPR would be enforced, Google, Microsoft, Facebook and other will exit EU market. At the moment GDPR is a joke.
  - 4y ago

david_allison 4y ago

Do you have a better source? I don't buy the comment at all, and the whitepaper[0] is of very low quality. [0] https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...

mola 4y ago

Seems not true. I worked in mobile security. We had massive amounts of data about mobile apps and the suspected behaviour they show (via dynamic analysis, static analysis, code signatures, etc) We saw a huge amount of Ad SDKs showing all kinds of malicious behaviour. Facebook etc were the worse, TikTok was not particularly exceptional. One of the biggest problem for an anti malware product in that space is that most "legitimate" software looked indistinguishable from spywares. And if we were to mark these as malware then our product won't be usable. These apps are hoovering crazy amount of information. They should be banned, universally. No matter which country they originate at. Giving politicians this kind of power over the population in a democratic society is a huge national security risk. No less than a foreign power having these capabilities.

Schroedingersat 4y ago

I'm sure tiktok does a llt worse since that comment was written, but that list is a tiny subset of what facebook has been caught doing in the past and what microsoft, google and apple do now. The US government do not hold large corportations to account, quite the opposite. They put people in jail for successfully fighting them legally or turn a blind eye when whistleblowers are car bombed. They make deals with facebook and google for the data so they can say 'it's a private company and independent entity'. China would likely be just as bad if they were as powerful, but from the point of view of most of the world they have stolen far less of our natural resources, killed/deposed far fewer of our democratically elected governments, bought up far less of our media and turned it into propaganda, spied on our citizens less, and abused treaty law to curtail our freedoms far less.

whyagain1885 4y ago

From Reddit: > Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc) > Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?) > Everything network-related (ip, local ip, router mac, your mac, wifi access point name) > Whether or not you're rooted/jailbroken > Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC > They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication Wait a minute - Why was Android or iPhone - built by West allows everything... Or if tiktok are the topdog in writing apps and FB missed out on writing these? Sour grapes?

herbturbo 4y ago
Most of those metrics can be gathered by off the shelf analytics SDKs. Not hardware IDs though. If they are doing that on iOS they are certainly violating a number of rules. The proxy server is disturbing if true. Only reason I could think of that being necessary would be to use customer devices to perform distributed transcoding of other people's videos. Can't imagine that being something Apple would allow.